3 ms·

Use a password manager that generates a random password for every site.

• brudgers 13y ago
  Providing strong passwords on throw away accounts provides useful information to an attacker - I.e. that I am using password manager "foo". If "foo" is comprised, then all my passwords generated from it are at risk. To put it another way, where there is no reasonable chain of trust, I provide useless data for determining my strategy where there is a reasonable chain of trust. Revealing '11111' does not improve the probability of an attacker generating my bank password.
  • owenmarshall 13y ago
    >Providing strong passwords on throw away accounts provides useful information to an attacker - I.e. that I am using password manager "foo". What? The attacker could infer: * that you consider this account to be valuable and have created your own strong password for it. * that you are a security conscious individual and keep a list of hand-generated passwords written down in a safe by your desk. * that you may be running one of any number of password managers. ... in other words, it tells the attacker nothing. That's not to say that using a junk password for a junk account is bad, just that your logic doesn't follow. >Revealing '11111' does not improve the probability of an attacker generating my bank password. Neither would me revealing my password for a throw-away service is "Sfx16tJ{=DK=x4A0v". What can you infer about my bank password from that?