4 ms·
How do you enforce a unique password? With unique I mean that the user has not used that password for any other website.
by fphilipe 13y ago
How do you enforce a unique password? With unique I mean that the user has not used that password for any other website.
- nilved 13y agoGenerating it for them.
- oneeyedpigeon 13y agohow do you make it memorable enough so they don't just write it down? passphrases?
- mdpopescu 13y agoWhat's the problem with writing it down? I periodically generate a strong random new password, write it down and put it in my wallet with my credit cards, until I type it enough times that I learned it. Writing it down and leaving it exposed in a public place, like taped to your monitor - bad. Writing it down and treating it like any other important asset - not that bad.
- oneeyedpigeon 13y agoActually, that's very nearly the approach I'm taking myself, so fair point (just that IT professionals usually run screaming for the hills if you talk about writing a password down). However, it also sounds like you're using just one password for everything - that seems very unwise.
- mdpopescu 13y agoAh - that's the master password for LastPass. I should have clarified that.
- deleted 13y ago[deleted]
- joshguthrie 13y agoThis. A thousand times this. Passwords are HARD to remember but it's better to have it under hand than to ask for a new one every two days because we didn't have time to remember it (my school stored students password in clear text in their DB and gave them out printed on paper sheets. Four years later, I still have this sheet in my wallet, my three passwords never got compromised and I memorized each of them after less than two weeks of heavy usage). > IT professionals usually run screaming for the hills if you talk about writing a password down I can understand that. You and I keep our passwords in our wallets. Some employees keep them on post-its taped to their computer screen at work. If a password I keep in my wallet gets compromised because it's been stolen with the wallet, I have more pressing matters to deal with than "oh crap, a random guy who stole me my wallet in the subway may use it to access our repo and add bad code in my name". The point about "not that bad" is that security is an illusion: you can use a thousand passwords everywhere with different set of keys for github, server A and server B, change password every week and never write it down, plus a little bit of tin foil hat paranoia,... But in the end, a $5 wrench will make you spit out all the access keys needed by someone who REALLY wants an access.
- DoggettCK 13y agoI've kept a post-it under my keyboard for years with "How do you keep a security auditor busy?" written in a pigpen cipher.
- islon 13y agoI do the same, only KeePass is my wallet, safer and easier =)