6 ms·

A pragmatic one I like to say to non technical people like my mom and sister: - Have a dedicated email password that is different from every other password you

A pragmatic one I like to say to non technical people like my mom and sister: - Have a dedicated email password that is different from every other password you use. Let's be honest: You should have different passwords for every site, and you should use strong passwords and a manager, but you don't because you're a normal person. At the very least, be pragmatic and have an email password that's separate from every other service password. The idea being, if your random-service-you-signed-up-for-once.com password gets hacked, and your username was your email address, the first thing an attacker will try to do is use that password on your email. So have a strong email password and trust that your gmail account is less likely to be hacked than your random-service account password.

mey 12y ago
KeePass plus multiple supported clients have allowed me (and my wife) to manage a unique password per account without too much effort. My eyes really opened when my linkedin leak happened and I realised how many accounts shared that same password.
arjie 12y ago
I use LastPass and I can't recommend it enough. It's fantastic and I have different passwords for everything simply because I never bother making passwords. I just hit the random function on it. I still have my email passwords memorized, though. This is honestly the best service I've ever paid for. It has never failed me, and it substantially improves my life.
- seanwilson 12y ago
  I use LastPass and think it's great as well. I've tried to recommend it to others though and the common reply is "that doesn't sound secure enough for company policy". They don't seem to realise though that their usual approach of sharing passwords over email, using the same password for several logins so it's easy to remember and using easy to remember passwords in general is much more insecure. Services like LastPass make it practical for you to use impossible to guess passwords, different passwords for every site and let you share passwords securely.
  - dikaiosune 12y ago
    My key argument when I've convinced past employers to implement it: you already outsource all of the hard parts of your security. Antivirus, firewall, AD permissions, server config, all of it. They either bought a product to fit the need or hired a consultant to do the advanced stuff. $12/year is pretty cheap to hire a dedicated team of security wonks to safeguard your passwords, IMO.
    - seanwilson 12y ago
      It's not the cost that's the issue though, people don't like the idea of passwords being stored in a single place on a internet connected computer. I mention that you can secure password access behind two factor authentication but it doesn't get around the knee-jerk reaction often. Sharing lots of passwords when working with a team remotely is especially painful when password managers are not allowed...
- walterbell 12y ago
  Strip (https://www.zetetic.net/blog/ https://www.zetetic.net/blog/) is a mature and multi-platform local password manager that does not need a cloud connection, and can optionally sync from mobile to a local desktop. Made by the developers of open-source SQLCipher for SQLite, https://github.com/sqlcipher/sqlcipher https://github.com/sqlcipher/sqlcipher I wish they would integrate with iOS8 Safari as an extension.
- nostromo 12y ago
  That's all built in on Safari now. It's dead simple to use. But obviously it only works inside the Apple ecosystem. I'm surprised Google hasn't built it in to Chrome yet.
  - deadhead 12y ago
    Chrome does have a password generator and password syncing though I think the generator is hidden behind a flag still.
- emn13 12y ago
  Lastpass is surprisingly slow however - and that affects general browsing performance.
- kristiandupont 12y ago
  I use LastPass too and I am happy with it but I really wish they would do something about that UI. Not a very good experience, IMO.
- sleepychu 12y ago
  My issue with lastpass is that it's basically unusable when you don't use it as an extension. I'm not willing to load a proprietary blob that actively manipulates the dom and passwords every time I visit a page.
seanwilson 12y ago
That's what I recommend as well. Once someone has access to your email, the attacker can then use the "forgot your password?" of most sites to get further passwords and access.
x0x0 12y ago
I think the best tips for non-savvy people are: 1 - use an iphone for all banking. It's the single hardest system for someone to install spyware on: they are more careful about which apps are in their store than android, and the apps are more isolated. Android apps often have spyware; android install prompts on websites are super sketchy (and cover 1/4 of the screen, perfect to trick older or unfamiliar users into installation), and the permissions are far less granular. Windows is a disaster for secure computing, from viruses to "install this to get 500 smiley faces" to flash with monthly zero-days to fake software installs advertised via google sem. 2 - use gmail, and use 2fa 3 - pay the $30 for the hardware login tokens for your brokerage (and ideally, banking) account 4 - don't use any wifi except home wifi; just use wireless 5 - NO, your friend/cousin/grandchild is not stranded in an airport in Europe
- semi-extrinsic 12y ago
  You have to pay for hardware login tokens? In most of Europe, they're not only free, but mandatory. And, depending on how un-savvy you're talking about, I'd recommend just doing internet banking at your local bank. Just set all regular bills on auto, and configure your account to text you if something unusual happens (like your current account is running low). Then you should only really need internet banking a handful of times a year.
  - cantrevealname 12y ago
    > Just set all regular bills on auto I realize that opinions on this differ, but I think that automatic bill payment is a horrible security practice. Just last week I was paying with credit card in which the merchant punched in $5504 by accident instead of $504. Had I not noticed it right away, at least I'd get another chance to correct the error when my credit card bill arrived. With auto-pay, my bank account would have been emptied. What would you do if some sort of auto pay error emptied your bank account? These things take time to resolve. What if it's a weekend, or a holiday, or you're traveling overseas, or the entity that caused the problem is on strike, or they want a written dispute from you?
    - 12y ago
hyh1048576 12y ago
Alipay differentiates login password and "payment password", and it always asks SMS verification code if one tries to login via VPN, from new device, or from new location. I think that's good practice for websites.
JoshTriplett 12y ago
> You should have different passwords for every site, and you should use strong passwords and a manager, but you don't because you're a normal person. I'm amazed that people favor remembering passwords over using a password manager. With Firefox Sync, or the Chrome equivalent, you have your browser remember the password, every other browser you use syncs with that so it has the password, and you never need to have it memorized. The only thing that's missing for better usability is a built-in "generate and use a random secure password" mechanism.
- amelius 12y ago
  I think mostly the industry is to blame here. We could have had a universal secure 2fa ages ago. I hope that with the advent of smart watches, 2fa could become more sexy, and hence could get more attention from the industry.
- falcolas 12y ago
  The problem I have with browser password managers is how simple they are to crack. Master passwords are disabled by default (if available at all), and even with a master password, many browsers still don't encrypt them in the password store.
- marssaxman 12y ago
  If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised. If it doesn't sync, that means I can only get in from one computer, which is occasionally inconvenient. So I keep my passwords in my brain, which is always with me, or at least with me at all the times when I might need to use a password.
  - JoshTriplett 12y ago
    > If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised. For Firefox Sync, that entire list is encrypted using a client-side key in your browser, and the server has no access to the cleartext.
heydonovan 12y ago
I thought I was the only that did this! Only two passwords of mine need to be memorized. Dropbox and Gmail. 1Password for everything else, with a dedicated Dropbox account solely for keeping the 1Password vault backed up (I've had my laptop stolen before, and being locked out because you don't know any password makes for a terrible afternoon).
jhildings 12y ago
A good way could be to have a "base" password you then concatenate with the first 4 letters or so in the service So for Facebook it can be "MYPASS" + "FACE" And then it's easy to remember. Also you can substitute the first letter which allows it to a number or so
- breakall 12y ago
  This helps when your password is lost along with thousands / millions of other passwords in a breach -- attackers would be trying to re-use passwords programmatically in bulk and wouldn't detect your algorithm. But if you were individually targeted i.e. a human attacker is looking at your password, your algorithm would provide access to many of your accounts with little effort. I used to use this solution, btw, but have now gone to a unique, complex password per site with a password manager.
  - fapjacks 12y ago
    I also used to use this solution about ten or fifteen years ago and have since moved on to password managers and long passphrases for accounts whose passwords I do not want to store in the password manager.

mey 12y ago

KeePass plus multiple supported clients have allowed me (and my wife) to manage a unique password per account without too much effort. My eyes really opened when my linkedin leak happened and I realised how many accounts shared that same password.

arjie 12y ago

I use LastPass and I can't recommend it enough. It's fantastic and I have different passwords for everything simply because I never bother making passwords. I just hit the random function on it. I still have my email passwords memorized, though. This is honestly the best service I've ever paid for. It has never failed me, and it substantially improves my life.

seanwilson 12y ago
I use LastPass and think it's great as well. I've tried to recommend it to others though and the common reply is "that doesn't sound secure enough for company policy". They don't seem to realise though that their usual approach of sharing passwords over email, using the same password for several logins so it's easy to remember and using easy to remember passwords in general is much more insecure. Services like LastPass make it practical for you to use impossible to guess passwords, different passwords for every site and let you share passwords securely.
- dikaiosune 12y ago
  My key argument when I've convinced past employers to implement it: you already outsource all of the hard parts of your security. Antivirus, firewall, AD permissions, server config, all of it. They either bought a product to fit the need or hired a consultant to do the advanced stuff. $12/year is pretty cheap to hire a dedicated team of security wonks to safeguard your passwords, IMO.
  - seanwilson 12y ago
    It's not the cost that's the issue though, people don't like the idea of passwords being stored in a single place on a internet connected computer. I mention that you can secure password access behind two factor authentication but it doesn't get around the knee-jerk reaction often. Sharing lots of passwords when working with a team remotely is especially painful when password managers are not allowed...
walterbell 12y ago
Strip (https://www.zetetic.net/blog/ https://www.zetetic.net/blog/) is a mature and multi-platform local password manager that does not need a cloud connection, and can optionally sync from mobile to a local desktop. Made by the developers of open-source SQLCipher for SQLite, https://github.com/sqlcipher/sqlcipher https://github.com/sqlcipher/sqlcipher I wish they would integrate with iOS8 Safari as an extension.
nostromo 12y ago
That's all built in on Safari now. It's dead simple to use. But obviously it only works inside the Apple ecosystem. I'm surprised Google hasn't built it in to Chrome yet.
- deadhead 12y ago
  Chrome does have a password generator and password syncing though I think the generator is hidden behind a flag still.
emn13 12y ago
Lastpass is surprisingly slow however - and that affects general browsing performance.
kristiandupont 12y ago
I use LastPass too and I am happy with it but I really wish they would do something about that UI. Not a very good experience, IMO.
sleepychu 12y ago
My issue with lastpass is that it's basically unusable when you don't use it as an extension. I'm not willing to load a proprietary blob that actively manipulates the dom and passwords every time I visit a page.

seanwilson 12y ago

That's what I recommend as well. Once someone has access to your email, the attacker can then use the "forgot your password?" of most sites to get further passwords and access.

x0x0 12y ago

I think the best tips for non-savvy people are: 1 - use an iphone for all banking. It's the single hardest system for someone to install spyware on: they are more careful about which apps are in their store than android, and the apps are more isolated. Android apps often have spyware; android install prompts on websites are super sketchy (and cover 1/4 of the screen, perfect to trick older or unfamiliar users into installation), and the permissions are far less granular. Windows is a disaster for secure computing, from viruses to "install this to get 500 smiley faces" to flash with monthly zero-days to fake software installs advertised via google sem. 2 - use gmail, and use 2fa 3 - pay the $30 for the hardware login tokens for your brokerage (and ideally, banking) account 4 - don't use any wifi except home wifi; just use wireless 5 - NO, your friend/cousin/grandchild is not stranded in an airport in Europe

semi-extrinsic 12y ago
You have to pay for hardware login tokens? In most of Europe, they're not only free, but mandatory. And, depending on how un-savvy you're talking about, I'd recommend just doing internet banking at your local bank. Just set all regular bills on auto, and configure your account to text you if something unusual happens (like your current account is running low). Then you should only really need internet banking a handful of times a year.
- cantrevealname 12y ago
  > Just set all regular bills on auto I realize that opinions on this differ, but I think that automatic bill payment is a horrible security practice. Just last week I was paying with credit card in which the merchant punched in $5504 by accident instead of $504. Had I not noticed it right away, at least I'd get another chance to correct the error when my credit card bill arrived. With auto-pay, my bank account would have been emptied. What would you do if some sort of auto pay error emptied your bank account? These things take time to resolve. What if it's a weekend, or a holiday, or you're traveling overseas, or the entity that caused the problem is on strike, or they want a written dispute from you?
  - 12y ago

hyh1048576 12y ago

Alipay differentiates login password and "payment password", and it always asks SMS verification code if one tries to login via VPN, from new device, or from new location. I think that's good practice for websites.

JoshTriplett 12y ago

> You should have different passwords for every site, and you should use strong passwords and a manager, but you don't because you're a normal person. I'm amazed that people favor remembering passwords over using a password manager. With Firefox Sync, or the Chrome equivalent, you have your browser remember the password, every other browser you use syncs with that so it has the password, and you never need to have it memorized. The only thing that's missing for better usability is a built-in "generate and use a random secure password" mechanism.

amelius 12y ago
I think mostly the industry is to blame here. We could have had a universal secure 2fa ages ago. I hope that with the advent of smart watches, 2fa could become more sexy, and hence could get more attention from the industry.
falcolas 12y ago
The problem I have with browser password managers is how simple they are to crack. Master passwords are disabled by default (if available at all), and even with a master password, many browsers still don't encrypt them in the password store.
marssaxman 12y ago
If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised. If it doesn't sync, that means I can only get in from one computer, which is occasionally inconvenient. So I keep my passwords in my brain, which is always with me, or at least with me at all the times when I might need to use a password.
- JoshTriplett 12y ago
  > If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised. For Firefox Sync, that entire list is encrypted using a client-side key in your browser, and the server has no access to the cleartext.

heydonovan 12y ago

I thought I was the only that did this! Only two passwords of mine need to be memorized. Dropbox and Gmail. 1Password for everything else, with a dedicated Dropbox account solely for keeping the 1Password vault backed up (I've had my laptop stolen before, and being locked out because you don't know any password makes for a terrible afternoon).

jhildings 12y ago

A good way could be to have a "base" password you then concatenate with the first 4 letters or so in the service So for Facebook it can be "MYPASS" + "FACE" And then it's easy to remember. Also you can substitute the first letter which allows it to a number or so

breakall 12y ago
This helps when your password is lost along with thousands / millions of other passwords in a breach -- attackers would be trying to re-use passwords programmatically in bulk and wouldn't detect your algorithm. But if you were individually targeted i.e. a human attacker is looking at your password, your algorithm would provide access to many of your accounts with little effort. I used to use this solution, btw, but have now gone to a unique, complex password per site with a password manager.
- fapjacks 12y ago
  I also used to use this solution about ten or fifteen years ago and have since moved on to password managers and long passphrases for accounts whose passwords I do not want to store in the password manager.