I came up with a formula for my passwords - as easy to remember as a single password and makes a unique login for every site feasible without a password manager. Can be updated as often as you like and all you gotta do is remember the latest version of the formula. At the very least, the hashes will be different and it’d take someone having more than two of my passwords to figure out the pattern.
I also use over 100 email aliases with my own domain name so that my most important accounts have a separate login that isn’t a common domain that wouldn’t be easy for someone to guess.
It would take a lot of concentrated effort for someone to get at any of my important accounts, and even my less important ones would be pretty difficult to get into even if multiple accounts are compromised, due to using a smaller pool of aliases under common domains for less important accounts.
Someone got into half a dozen of my accounts a few years ago and I finally started taking security seriously.
Counterpoint: Password Manager = One point of failure
Multiple Strong Passwords that have to be changed every 3 months even to sign on to your cornerstore rewards program without a password manager? Guess you’re never accessing any account older than 3 months because you’ve forgotten th3 b1lli0n$ oF s+r0ng p4s5w0rds Y0u h4Ve cr3atEd!
You can have strong authentication on your central password manager, and have an encrypted container protecting it.
There is no logical argument against password vaults as a concept. There are bad implementations of specific password vaults, but a password vault is the answer for the highest possible password based security available in 2023.
I have no idea about how to protect a password manager with an encrypted container.
And to be honest with you, it’s not something I’m likely to do even if you do attempt to explain the 60 minute long $10 18-step process to me. Or however long it takes and whatever it costs.
And really, for all my ignorant ass knows you could’ve just as well been encouraging me to get malware and I’d be none the wiser.
What makes it completely unusable for me is that I don’t have a single work computer I use. I have to bounce around computers at work, my personal phone, computer, work iPad, etc.
Okay and now let’s get into threat modelling and risk management.
What is the purpose of a password manager? What are the possible threats against them, and what are those against singular passwords for services? What is the risk of each of those?
Guys, before you argue with me, password security is something that EVERYONE in the 1st world has to deal with, not just tech nerds. If you need to grow up around computers or take a class for it to be a good form of security, its a shit form of security for the general public
Password managers really are not hard to use. Also there’s stuff like the password manager built into iOS, for example, which you don’t even have to think about.
My comment about threat modelling was that you do not seem to understand the purpose of password managers. A way bigger problem for the average person online is password reuse, not targeted attacks against password vaults. That is the problem they solve.
The weird trope I’ve seen now is “don’t use the password manager in your browser”. For the life of me, I can’t think why some think a browser plugin to a commercial password manager is safer than the built in version.
They probably think it’s safer somehow. But I don’t really get how.
Most built-in password managers allow for you to setup a master password of sorts if you try to sync everything to a new device, and most also require you to use your computer’s native verification to view a single password in plaintext or export all of them as plaintext. (For browsers on Windows, they use Windows Hello; for browsers on Android, they use the fingerprint scanner or the lock screen pin.)
I just use engine model codes and body series# with special characters. Most of them are not even from the same vehicle so I doubt any one can remember. Shit sometimes I even forget what engine I coded with a certain vehicle. And then I get the you “can’t used the same password” which was enter previously to login.
Everyone talks about password managers these days, but isn’t that telling the hackers exactly where to go to get all your passwords? Seems like a much higher chance of catastrophic failure to me if you have a single point of entry.
Security and convenience are opposites. You have to decide if you want a local-only manager that is more secure, a sync service like syncthing that you can set up yourself, or a third-party cloud app like LastPass (which has been compromised at least once that I know of).
Personally I just do all my email and banking on my desktop at home, and it’s actually only inconvenienced me a few times over the years.
the only thing that gets less secure is more devices potentially compromised, but the act of syncing shouldn’t make it more dangerous by itself (if using a key file or a master password too long to be reasonably cracked), right?
I store mine in a selfhosted Nextcloud instance accessible only via a Nebula overlay network (alternative to tailscale) and it’s both convenient and secure.
I’m using KeepassXC, which has a browser integration that is quite good, and a local database. I synchronize it to my devices (using Syncthing, so it’s p2p). The database is encrypted with a pretty good password, and a key file. the key file has never and will hopefully never be transported via internet. The database is synced to a server I’ve rented as well, but never the key.
It’s not perfect, but potential attackers would need to
a) have access to one of my daily devices (the server won’t be enough, since they need the key file)
b) crack my password
Obviously, for someone dedicated this is still quite reasonable, but then again, I don’t think that’s my threat profile. The chance of getting caught up in a larger breach is a basically zero once you use your own solution, and it should be reasonably safe, if you don’t do anything stupid.
But yeah, I’m quite happy with it. KeepassXC is a local password manager, and Syncthing lets you synchronize files and folders across devices, and it uses Peer-to-Peer (p2p) technology, so unlike something like Google drive you’re not relying on some could server, it just transfers between your devices directly.
It’s not plug and play to install, but not that hard either. But still, I can see that commercial options are a lot easier for many people c:
I store mine in a selfhosted Nextcloud instance, KeepassDX on Android supports accessing it directly. Works perfectly and even provides an autofill service for Android. Very easy and very convenient.
I use the same password for every site, but I put the name of the site at the end of the password.
For example:
NotmypassB3ta.
NotmypassGoogle.
NotnypassLemmy. Etc.
I figure it might stop the most lazy of attacks.
It will stop a lot of attacks but if someone figures it out, you’re screwed. So I don’t recommend it.
But years ago I used the same password everywhere except with a few differences due to different requirements (like special characters) and the weakest passwords I used got leaked on pastebin (or similar). And sure enough many accounts got compromised, not a huge deal and I didn’t lose anything I cared about.
The interesting part is that no-one seemed to try the leaked password + 1234 or a capital letter in the beginning.
That sounds not ya I’m sure it stops a , as long as the actual password is also strong. IMO there’s still some vulnerability. If someone finds out your password and notices thepattern ‘pass+Site’, then they mighttryyon another site.
Also why it’s a good idea to have a few emails yo use across multiple sites.
That annoys me so much. Especially when the randomly generated line noise password I’m using doesn’t happen to include one of the three punctuation characters they need to be “secure”.
you literally described the exact use case for password managers. in security, it’s not about IF you get breached, it’s WHEN and how to recover from it. this includes cloud password managers. you can hack all the data you want from these companies but any reputable password manager company will employ a Zero Trust model where your data is stored encrypted. they can completely upend the company and destroy their whole infrastructure, but they still can’t do shit unless they have your master pass or a time machine.
The main argument to use password managers to prevent password leaks to all of your services (that you use with the same login/email). You can’t trust any service to store your password securely, therefore you should use different ones everywhere.
Using a password manager gives you the convenience of using one, strong password that’s being used very securely, and mitigating risk of password leaks spreading further.
If you abstract it that way, it by no means eliminates the risk of someone breaking into your database, but makes it harder and from a single entry point, instead of any service that uses your password.
Plus many of those password managers give you an option to use YubiKey for additional security.
Oh and also you won’t ever need to press “forgot password” ever again due to the arbitrary requirements that your password doesn’t pass, so you modify it slightly so it would.
The greatest threat is password databases being leaked from the services you use. Not your phone or laptop. Physical access to a device is a pretty high security bar.
If you don’t let people make notes of passwords they use one crap memorable password for everything. Let them store it, and advise them to do it somewhere encrypted. Ta da! Password manager.
It would be better if you had a local tool telling you that - one that you control and only exists on your personal devices, kind of like secure messaging platforms such as Signal.
Another great later would be for all compromised passwords found in breaches to never be usable anywhere ever again, thus helping to thwart the most common form of breach we see today: credential stuffing.
That’s not as far fetched as it sounds. Any website worth its salt will store your password as a hash, so if they started sharing the hashes with each other they could prevent you from reusing passwords without changing much security-wise
If you’re alright with an online password manager Bitwarden is the best one there is. If you prefer having an offline password manager KeePassXC is a great option as well :)
I’m sure I’ll get shredded for this, but I keep my passwords in a notebook. Every once in a while I go through and change them all into other random nonsense and reorganize to keep it neat. I am a bit of a notebook fanatic and a have a whole shelf full of them. If someone ever broke into my house there’s no way they’re going through all of them to find anything like that. If the house burned down, maybe a bit of a problem, but as long as I have my phone I can get my email back, and between my phone and email I can get any of the important ones back as well.
If I had corporate or government secrets and was the target of espionage I’d probably rethink, but the danger of anything is so minuscule.
Yeah, if you use your own password cipher, you never have to memorize a password again. Just derive it based on some common input value, like the company name or url. Makes password rotation tricky, though, and it’s a pain when a website won’t allow a special character you generally use, creating “one offs” that are hard to track.
I did this for years. Yep, it works enoughish, but I’m so much happier on a password manager now, and it’s pretty fun to see the managed passwords having so much more entropy than even the most obscure things I was algorithmically generating. Also, the speed of using a manager is great. Somehow I ended up with multiple Ticketmaster accounts (from using a different email address for some one-off season tickets that migrated into TM later). I think the moment I realized I wanted to change to a manager was when I was walking up to a concert and realized I hadn’t downloaded my ticket. I got into TM and realized I needed to switch accounts. So then I’m trying to walk and type my big fucky nerd-assed brain-generated password on mobile, fat-fingering the touchscreen keyboard, almost locking myself out of the account when I just want to get into the venue and relax. Later, that first moment trying an integrated pass manager and effortlessly switching between accounts, each with far stronger passes than I would have remembered, limited only by the loading speed of the site and with virtually zero chance of locking myself out… that really made me feel like fancy Pooh meme.
I’ve done this and it has been convenient, but using a password manager is still the way to go IMO. The personal password algorithm approach starts to be a pain when you need to follow a different set of character rules or change a password. With a password manager there’s no hesitation or friction when considering a password change.
I’ve actually come up with a way to have a complex and unique password for each service which is also resilient againt forced password changes, doenst require a password manager, and if Im being tortured I still wont be able to tell them what it is because I dont know it unless Im at the login screen. If the service changes the layout of their login screen though, Im fucked.
I’ve been thinking of starting to use one more and more, is there any you would recommend? Are all the good ones a paid service? And my biggest concern is someone getting into the password manager itself, is that something that I should worry about?
I’ll second the other comment suggesting KeePass, but the biggest issue I had with it was syncing the database across devices. Ultimately I stored it in OneDrive, but it occurred to me that at that point it wasn’t much different to a cloud password manager, which I especially didn’t trust.
I now self host a Vaultwarden instance from my Raspberry Pi, and that works perfectly for me, but it does require a bit of Linux experience and a spare device to run the server.
I’m using KeepassXC and sync with Syncthing (which is P2P), and I’m quite happy with it. Seems like you got your setup figured out, but this is a bit simpler for someone looking into password managers
Bitwarden has been working well for me, and it’s open source and free to use. I started using it when it was clear that using LastPass was not a long term solution.
I think phishing is by far the most common way to get passwords.
I saw a guy at work fall victim to one. Looks like it’s from some customer he knows, links to document on Office365 or similar, enter username and password and swearing because it’s “lost them”.
The meme is expressing that a strong password is a lot worse when reused.
Even if one agrees with your take, the meme is accurate.
But your take is really bad because “it needs to be leaked and cracked” ignores so many alternative ways to steal passwords. Xxs keylogger, mitm, phishing… And some of these attacks are making it really difficult or unlikely to succeed. E.g. the chance of a phishing email for your bank or apple icloud is much more likely than a phishing email about e.g. your babyphone. Segregation of accounts is also important because obviously if you use the same password 30 times, then there are 30 places to leak your password and some might use md5.
But a strong password doesn’t help you with phishing attacks and such attacks. It really only protects you against database breaches and direct password Bruteforce.
Reusing a password doesn’t destroy the whole security aspect you get from a strong password like the meme implies. Just some of it.
Of course you should both not reuse passwords and use strong passwords
You have successfully missed my point, and apparently your own???
I am not saying strong passwords are protecting you from phishing. I never did.
The meme is saying reusing the password “ruins” a lot of the security benefits of a strong password. And it does. Like you agree.
So for you, reusing passwords… That is what I am taking about, as you expressed the reusing passwords is fine because it has to be cracked and with strong password that is difficult. So I was criticizing your statement. I don’t know how you manage to understand anything else from it honestly. And yes!!! Reusing passwords makes phishing attacks easier and more successful.
Add comment