The only good passwords are those you don't know yourself because they are randomly generated and all stored in your password manager of choice.
Until some locked down tv/console type device asks me for a password.
Then you look up the random string of 36 characters once, think "why did I make this one 36 characters" as you painstakingly type it in with a TV remote, then immediately forget it as soon as you're logged in.
Then repeat this process every few months the device decides it needs to ask the password of you again. Not playing this game
Take the TV throw it out of the window.
Buy a minipc and plugin a cheap Monitor via hdmi.
Setup kodi or similar on your minipc and you won't even have ads anymore because you will of course install pihole too.
I use an off-line libre password manager for several bad designed goverment stuff that only accept numbers as passwords or don't allow to paste it.
It's not that hard and I easily get used to it. I read it, type it and forget it again.
it's all fun and games until you don't have access to your password manager
depends on the password manager....
also, the length of the password is WAY more important than it being randomly generated as long as it's not in a password dictionary somewhere. I use 20+ character passphrases that i can easily remember everywhere for instance
My strategy is to have a persistent short passphrase that's within every password I use, and pair it with a silly bastardization of the service I have an account for. So, for example, if my passphrase were hunter2 (lol) and I had an account on Netflix, my password for Netflix might be something like hunter2NutFlex. Because of this, I can manage my own passwords in basic text as "code NutFlex" because the "code" portion is encrypted in my own fucking brain. If Netflix gets hacked, somebody has a password that only works with Netflix, and they'd need my text file as a Rosetta Stone to acquire my other passwords. Not impossible, but who the fuck am I and why would anybody dig that deep to do that to me?
I'm no IT expert, so somebody tell me if this is a stupid and overly vulnerable strategy. I thought I was pretty brilliant for coming up with this and rolling it out several years ago.
i am an IT person (wouldnt say expert) and i do this. password cracking time is based on the number of characters, not the type of char so you can do "abcdefghijk" and it will be more secure than "_a;" (both are still weak but my point stands)
all of this can be broken if you just use common passwords or plain english words since those are broken with dictionary attacks
Imagine a site telling you "Sorry, you can't use asdf123 as your password: you've already used it on that other site".
Counterpoint: Password Manager = One point of failure
Multiple Strong Passwords that have to be changed every 3 months even to sign on to your cornerstore rewards program without a password manager? Guess you're never accessing any account older than 3 months because you've forgotten th3 b1lli0n$ oF s+r0ng p4s5w0rds Y0u h4Ve cr3atEd!
Actually you are the single point of failure
I mean yeah, the security benefit from being un-notable isnt negligible
That's...not a counterpoint.
You can have strong authentication on your central password manager, and have an encrypted container protecting it.
There is no logical argument against password vaults as a concept. There are bad implementations of specific password vaults, but a password vault is the answer for the highest possible password based security available in 2023.
Okay and now let's get into threat modelling and risk management.
What is the purpose of a password manager? What are the possible threats against them, and what are those against singular passwords for services? What is the risk of each of those?
So your password is cardboard fort?
hunter2
It's just *******
Just use a password manager, then you get the benefits of having a single password to remember without the security-related downsides.
I never got over the fact that I somehow need to trust to an absurdly high degree a proprietary software to store ALL my passwords. Is this really a good idea?
You can use KeePass, but you'll have to figure out a way to have your password vault available on other devices (can do it by using any cloud shares, i.e. GDrive). This way you'll be in charge of almost every aspect of your passwords. But you'll have to take care of backups and keep everything in sync.
KeePass
I'm sorry but no. I'm physically incapable of not moving the capital letter one space and I'm not entrusting my passwords to what I've irrationally decided IS named KeepAss. I just can't.
I like Vaultwarden. Open source rust server compatible with bitwarden.
Or simply can use, Bitwarden or Protonpass
There are libre off-line password managers. Variants of Keepass for example.
Indeed it's a bad idea to store passwords in a propietary system. Specially a cloud based one being hacked time to time, like 1password.
So all my passwords are locked behind a single password? Isnt this essentially the same as using the same password for every site. In that they only need to cracl o e password to have access to everything?
The danger of using the same password everywhere is from leaks caused by poor security in one of those sites.
Passwords getting leaked are almost always unrelated to how strong the passwords are and has more to do with how those password are stored, and what protection measures they have against unauthorized people accessing them.
No one is ever going to "crack" your single password for your password manager as long as it is a strong password, though you might write it down in your wallet and lose it in a busy station, just like some administrator of a website might forget to close outside access to their mysql database containing unencrypted plaintext passwords.
Everyone talks about password managers these days, but isn't that telling the hackers exactly where to go to get all your passwords? Seems like a much higher chance of catastrophic failure to me if you have a single point of entry.
Yes that's definitely a concern to keep in mind.
The problem is that if someone doesn't use a password manager they're morenlikely to reuse weak ones.
Using a password manager is a better path, as long as there is awareness on how to keep it secured.
Only if you're using a third-party password manager, rather than something stored/managed locally.
I just use a password manager for my password managers password manager. 2fa on all of em. Takes me forever to login
I dunno, doesn't sound like enough layers to me. We can go deeper
It was literally a battle for me to have a strong unique password for our baby monitor... Wife was not happy about that but I came out on top.
I've actually come up with a way to have a complex and unique password for each service which is also resilient againt forced password changes, doenst require a password manager, and if Im being tortured I still wont be able to tell them what it is because I dont know it unless Im at the login screen. If the service changes the layout of their login screen though, Im fucked.
How? 😂
It must be some sort of compression algorithm of the information presented at the log-in screen.
If they change/rebrand the login he's screwed. Just use a password manager people.
I came up with a formula for my passwords - as easy to remember as a single password and makes a unique login for every site feasible without a password manager. Can be updated as often as you like and all you gotta do is remember the latest version of the formula. At the very least, the hashes will be different and it'd take someone having more than two of my passwords to figure out the pattern.
I also use over 100 email aliases with my own domain name so that my most important accounts have a separate login that isn't a common domain that wouldn't be easy for someone to guess.
It would take a lot of concentrated effort for someone to get at any of my important accounts, and even my less important ones would be pretty difficult to get into even if multiple accounts are compromised, due to using a smaller pool of aliases under common domains for less important accounts.
Someone got into half a dozen of my accounts a few years ago and I finally started taking security seriously.
At this time of day, in this part of the country, localized entirely in your accounts?
Not really though. Once the password has been leaked, it needs to be cracked. And that usually doesn't happen when the password is strong enough.
Except the password wasn't hashed but then the company belongs to get sued to bankruptcy
That's also assuming they used proper salts and a strong hashing algorithm.
Also MITM and or phishing attacks are not super common but can also depreciate your common password very quickly.
Always layered defense. If it's not 1 thing, it could be another.
Unique passwords are just one facet on a multi-layered security defense.
Since you can never now for sure how a company handles hashing, always assume the worst. You will fare better.
