5 ms·

Interesting. Some random website is hacked and user account and passwords are revealed. In the user accounts notice there is a "bob@nvidia.com" with associate

Interesting. Some random website is hacked and user account and passwords are revealed. In the user accounts notice there is a "bob@nvidia.com" with associated password. If you are the hacker, might as well type that in to nvidia's corporate system right? Scary.

Ixiaus 12y ago
Passwords are clearly a badly broken model. Even if each entity handles your password safely (you can easily argue that most don't) the weakest link in the chain is still the human being.
- akerl_ 12y ago
  Use password manager -> generate high entropy passwords -> Victory. It's pretty easy to keep your password manager secure against the threats that most people actually face, and this removes the worst elements: password reuse and low-entropy passwords.
  - themartorana 12y ago
    It does, but a "good" password manager is the cost of a Twitter, Facebook, Gmail, Pandora, Spotify, and iTunes accounts combined times infinity. 1Password is probably my favorite app/suite of apps ever. And I willingly shelled out for them. But most people balk at paying $.99 to remove advertising in mobile games, so I don't see this catching on. (Plus sync, plus backups, plus...)
    - citruspi 12y ago
      > a "good" password manager is the cost of a Twitter, Facebook, Gmail, Pandora, Spotify, and iTunes accounts combined times infinity. It can be, but it doesn't have to be. There's perfectly good password managers[0] which are free and open source. The problem in this case is getting people who aren't technically literate to use them. [0] http://www.passwordstore.org http://www.passwordstore.org
    - bro-kaizen 12y ago
      May I humbly suggest Keepass (0) and its many incarnations for various platforms? It's free as in beer and speech and seems to work pretty well. (0) http://keepass.info http://keepass.info
  - Ixiaus 12y ago
    I do use a password manager, LastPass, but my mother doesn't. My father does because I set it up for him and he's the partner of a really big lawfirm in LA! Password Managers are not the solution to the problem, they are a bandaid.
  - raverbashing 12y ago
    Lose password manager master pw: you lose access to your accounts Have your master pw compromised: have all passwords compromised You're taking multiple failure points (which certainly has a higher chance of a failure than a single failure point) and replacing it with a single point, with lower chance of failure BUT with bigger consequences
    - ratsmack 12y ago
      I believe using a password manager is better than not using anything and relying a single password for many accounts. One thing about a password manager is that you control its contents and so I believe the risks can be mitigated. The following is a password manager developed by Bruce Schneier: http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/
      - raverbashing 12y ago
        "and relying a single password for many accounts" Then don't. I rely on similar passwords for non-important services, but important ones have an unique password/2FA
    - deleted 12y ago
      [deleted]
    - pfranz 12y ago
      I think the difference is a bit more subtle. When not using a password manager, you rely on an array of sites and services with varying levels of security to authenticate, transmit, and store passwords. With a password manager you store the database, your master password isn't transmitted anywhere, and you're storing everything locally. You could even choose to air gap your password manager if you wanted. You're still vulnerable some attacks like keyloggers but I think your description downplays many of the benefits (mitm or a poorly secured remote database wouldn't expose your master password). There are other great features password managers are starting to add; letting you know how long ago you changed your password, informing you if you haven't changed a password after a site had been compromised, changing your password for you (each site is different and updating passwords is very time consuming).

Ixiaus 12y ago

Passwords are clearly a badly broken model. Even if each entity handles your password safely (you can easily argue that most don't) the weakest link in the chain is still the human being.

akerl_ 12y ago
Use password manager -> generate high entropy passwords -> Victory. It's pretty easy to keep your password manager secure against the threats that most people actually face, and this removes the worst elements: password reuse and low-entropy passwords.
- themartorana 12y ago
  It does, but a "good" password manager is the cost of a Twitter, Facebook, Gmail, Pandora, Spotify, and iTunes accounts combined times infinity. 1Password is probably my favorite app/suite of apps ever. And I willingly shelled out for them. But most people balk at paying $.99 to remove advertising in mobile games, so I don't see this catching on. (Plus sync, plus backups, plus...)
  - citruspi 12y ago
    > a "good" password manager is the cost of a Twitter, Facebook, Gmail, Pandora, Spotify, and iTunes accounts combined times infinity. It can be, but it doesn't have to be. There's perfectly good password managers[0] which are free and open source. The problem in this case is getting people who aren't technically literate to use them. [0] http://www.passwordstore.org http://www.passwordstore.org
  - bro-kaizen 12y ago
    May I humbly suggest Keepass (0) and its many incarnations for various platforms? It's free as in beer and speech and seems to work pretty well. (0) http://keepass.info http://keepass.info
- Ixiaus 12y ago
  I do use a password manager, LastPass, but my mother doesn't. My father does because I set it up for him and he's the partner of a really big lawfirm in LA! Password Managers are not the solution to the problem, they are a bandaid.
- raverbashing 12y ago
  Lose password manager master pw: you lose access to your accounts Have your master pw compromised: have all passwords compromised You're taking multiple failure points (which certainly has a higher chance of a failure than a single failure point) and replacing it with a single point, with lower chance of failure BUT with bigger consequences
  - ratsmack 12y ago
    I believe using a password manager is better than not using anything and relying a single password for many accounts. One thing about a password manager is that you control its contents and so I believe the risks can be mitigated. The following is a password manager developed by Bruce Schneier: http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/
    - raverbashing 12y ago
      "and relying a single password for many accounts" Then don't. I rely on similar passwords for non-important services, but important ones have an unique password/2FA
  - deleted 12y ago
    [deleted]
  - pfranz 12y ago
    I think the difference is a bit more subtle. When not using a password manager, you rely on an array of sites and services with varying levels of security to authenticate, transmit, and store passwords. With a password manager you store the database, your master password isn't transmitted anywhere, and you're storing everything locally. You could even choose to air gap your password manager if you wanted. You're still vulnerable some attacks like keyloggers but I think your description downplays many of the benefits (mitm or a poorly secured remote database wouldn't expose your master password). There are other great features password managers are starting to add; letting you know how long ago you changed your password, informing you if you haven't changed a password after a site had been compromised, changing your password for you (each site is different and updating passwords is very time consuming).