5 ms·

My problem is that 1Password et al are curing symptoms, not solving causes. Personal infosec hasn't evolved quick enough to match the technology it depends on.

My problem is that 1Password et al are curing symptoms, not solving causes. Personal infosec hasn't evolved quick enough to match the technology it depends on. Sure we're comfortable with 12 character, 3 month rotation passwords, but the average 'civilian'? Probably doesn't even have a passcode on their phone despite the massive personal security risk they're carrying around with them. We need to educate and/or provide easier authentication.

dredmorbius 12y ago
12 character? Please! ;-) (Most of mine are markedly longer.) Though I'll admit to being a tad less aggressive on the rotation than I ought to be.
- rquirk 12y ago
  A lot of sites don't allow more than 12 chars. Of the top of my head, Nintendo's rewards scheme has a limit on the number of characters, it lets you use more but actually truncates the password to 12 or so. Some sites truncate it on the sly then say "incorrect username or password!" when you enter your stored 16+ character password. Other sites silently break if you use characters outside A-Za-z0-9. e.g. you set a password with } or @ in it, then can't log back in again. Ebay wouldn't let me paste a password into the password field recently, I had to type it out, and the keepassx "autotype" feature was thwarted by their focus-altering javascript code on the form. I also think they silently dropped special characters - I know it took me 4 or 5 password reset emails to get the new stored pw to stick. Paypal requires that you enter a credit card number to change the password, so rotating it is tricky if you don't have the card on hand. I'm undecided if this is good or bad, since this sort of 2 factor makes it harder for someone to hijack your account. There are a lot of ways that sites try and make life hard if you are doing things the right way and using a pw manager. It feels like there's this big conspiracy driving us to use the same "Monkey123" password everywhere.
  - dredmorbius 12y ago
    Oh, I know. God do I ever know. I use a password generator. My defaults are _long_. But the nice thing is that I can pass it most constraint rules reasonably readily to create a valid password if I need to fit another use-case. I don't use Ebay, but that sounds particularly annoying. Conversation on G+ suggests that the copy/paste defeat is to combat copy/paste exploits elsewhere, though by that point you might as well declare game over anyhow. I'm definitely _not_ using "Monkey123" everywhere. But a lot of sites get a perfectly cromulent password ... and a mailinator.com email address (also randomly generated). I never use the same tokens twice (mostly registration-required but no real utility / long-term state storage).
antimagic 12y ago
No, no I am not comfortable with 12 character, 3 month rotating passwords. 12 character, ok, but only if the damn thing isn't going to change all of the time. I have a hard enough time remembering my passwords for the computers at work that rotate every three months. You start making it necessary to do that for all of the sites I use on the Internet, and I'll lose access to pretty much every service. Not a workable solution! At least not without a password manager...
- fluidcruft 12y ago
  Why not just extend the 12-char password you are comfortable with using a random 4-character-ish suffix that you change every three months? It doesn't take long to learn a new set of 4 characters.

dredmorbius 12y ago

12 character? Please! ;-) (Most of mine are markedly longer.) Though I'll admit to being a tad less aggressive on the rotation than I ought to be.

rquirk 12y ago
A lot of sites don't allow more than 12 chars. Of the top of my head, Nintendo's rewards scheme has a limit on the number of characters, it lets you use more but actually truncates the password to 12 or so. Some sites truncate it on the sly then say "incorrect username or password!" when you enter your stored 16+ character password. Other sites silently break if you use characters outside A-Za-z0-9. e.g. you set a password with } or @ in it, then can't log back in again. Ebay wouldn't let me paste a password into the password field recently, I had to type it out, and the keepassx "autotype" feature was thwarted by their focus-altering javascript code on the form. I also think they silently dropped special characters - I know it took me 4 or 5 password reset emails to get the new stored pw to stick. Paypal requires that you enter a credit card number to change the password, so rotating it is tricky if you don't have the card on hand. I'm undecided if this is good or bad, since this sort of 2 factor makes it harder for someone to hijack your account. There are a lot of ways that sites try and make life hard if you are doing things the right way and using a pw manager. It feels like there's this big conspiracy driving us to use the same "Monkey123" password everywhere.
- dredmorbius 12y ago
  Oh, I know. God do I ever know. I use a password generator. My defaults are _long_. But the nice thing is that I can pass it most constraint rules reasonably readily to create a valid password if I need to fit another use-case. I don't use Ebay, but that sounds particularly annoying. Conversation on G+ suggests that the copy/paste defeat is to combat copy/paste exploits elsewhere, though by that point you might as well declare game over anyhow. I'm definitely _not_ using "Monkey123" everywhere. But a lot of sites get a perfectly cromulent password ... and a mailinator.com email address (also randomly generated). I never use the same tokens twice (mostly registration-required but no real utility / long-term state storage).

antimagic 12y ago

No, no I am not comfortable with 12 character, 3 month rotating passwords. 12 character, ok, but only if the damn thing isn't going to change all of the time. I have a hard enough time remembering my passwords for the computers at work that rotate every three months. You start making it necessary to do that for all of the sites I use on the Internet, and I'll lose access to pretty much every service. Not a workable solution! At least not without a password manager...

fluidcruft 12y ago
Why not just extend the 12-char password you are comfortable with using a random 4-character-ish suffix that you change every three months? It doesn't take long to learn a new set of 4 characters.