Best to just use a password manager and keep unique per-site passwords.
Of course, it's a different situation when e.g. managing many sensitive servers which you only access from work or so.
True, though your handful of passwords can be stolen in the same way.
With a password manager, you:
- ensure your master password is not transmitted over a network
- ensure you never reuse passwords
- ensure you have long, strong passwords everywhere
- never forget login details and never worry about remembering yet another password
On the other hand,
- you _need_ access your password manager in order to login
- you now have a single point of failure
- cloud-based password managers are very attractive targets for hackers
I don't like these aspects of it.
Still, a password manger is incredibly convenient and I do feel a greater sense of security/confidence when I copy a big old 64 character password to log in. As it is, I use so many different services (gmail, github, slack, aws, steam, dropbox, reddit, etc, etc) and that number is only going to increase. I think a password manager is a practical, scalable solution to both remembering login information and improving my security.
I don't have to deal with password managers, maintaining their files. Or deal with multiple passwords.
Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.
But you're not. You're storing an encrypted blob in the cloud. You just need a good master password and a password manager that isn't broken.
1Password can sync locally which is a nice plus:
Indeed and then one's email potentially becomes the weakest link in one's password security.
This was exactly my point yes :)
I think the future will be passwordless with biometric as a added layer of safety.
1) Forgot the password, start the recovery process.
2) Get to the "create a new password" phase, look at the rules.
3) Rules require special characters, caps, etc. So I make one.
4) I get the "This password has been used before" error.
5) Now I have to think up a new random one.
If that password 'that was used before' was the current one, why can't I just continue to use it??? Now I remember the password (usually because of the silly special character requirements), so we're good, right? Wrong.
* Go to some service A.
* Get redirected to SSO and authenticate.
* SSO confirms your identity and A issues you a session token.
* You log out using your SSO.
* Go back to A where you're still logged in with your session token.
At a certain point I would not be willing to commit to maintaining lots of patches to every product we host and just tell our users to close their browser.
They force you to come up with a new password that you probably haven't used before and so you will probably forget it.
There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with an overly creative password.
I think most people have two or three passwords for all their apps/services; one very secure one, one medium security one and one low security one (where you literally don't care if you get hacked). It's not the company's business to tell you which of those classes of passwords it deserves for its website.