Password Rules Are Bullshit

Re:Password Rules Are Bullshit by x1798DE on Friday March 10, 2017 @10:01AM (#13839049)

You really shouldn't be re-using passwords across sites anyway, since all your accounts are compromised if any of them are compromised. Since re-using passwords is a problem solved by using a password manager, I'm assuming you're not using one, in which case you likely won't even remember the list of sites where you have accounts that have a shared password if you need to change it when any of the other sites are compromised.

Best to just use a password manager and keep unique per-site passwords.

[ Parent | on HN ]

Re:Password Rules Are Bullshit by blauditore on Friday March 10, 2017 @11:58AM (#13839985)

I'm quite hesitant towards using a password manager. All secrets are protected by only one single password, and to make the tool useful, it should be accessible from anywhere and I would use it quite often too, increasing the limit of my master PW being stolen (whatever way, keyloggers, shoulder surfers, cameras...). Thus, I rather memorize a handful of unique high-security passwords for important services and one or two low-security ones for all the rest I don't care about.

Of course, it's a different situation when e.g. managing many sensitive servers which you only access from work or so.

[ Parent | on HN ]

Re:Password Rules Are Bullshit by quacker on Friday March 10, 2017 @08:35PM (#13843624)

All secrets are protected by only one single password, and to make the tool useful, it should be accessible from anywhere and I would use it quite often too, increasing the limit of my master PW being stolen (whatever way, keyloggers, shoulder surfers, cameras...)

True, though your handful of passwords can be stolen in the same way.

With a password manager, you:

- ensure your master password is not transmitted over a network

- ensure you never reuse passwords

- ensure you have long, strong passwords everywhere

- never forget login details and never worry about remembering yet another password

On the other hand,

- you _need_ access your password manager in order to login

- you now have a single point of failure

- cloud-based password managers are very attractive targets for hackers

I don't like these aspects of it.

Still, a password manger is incredibly convenient and I do feel a greater sense of security/confidence when I copy a big old 64 character password to log in. As it is, I use so many different services (gmail, github, slack, aws, steam, dropbox, reddit, etc, etc) and that number is only going to increase. I think a password manager is a practical, scalable solution to both remembering login information and improving my security.

[ Parent | on HN ]

Re:Password Rules Are Bullshit by xtracto on Friday March 10, 2017 @03:41PM (#13841936)

The security process that has really worked for me is using the "forget password" as means to get a "login token" into my mail, which is protected with 2-factor auth.

I don't have to deal with password managers, maintaining their files. Or deal with multiple passwords.

[ Parent | on HN ]

Re:Password Rules Are Bullshit by jondubois on Friday March 10, 2017 @10:09AM (#13839122)

Most of my accounts use my low-security password, I don't care much if they all get compromised. I only use my high-security password on 1 site.

Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

[ Parent | on HN ]

Re:Password Rules Are Bullshit by TillE on Friday March 10, 2017 @12:33PM (#13840310)

> I certainly don't want to store my passwords in the cloud

But you're not. You're storing an encrypted blob in the cloud. You just need a good master password and a password manager that isn't broken.

[ Parent | on HN ]

Re:Password Rules Are Bullshit by relaytheurgency on Friday March 10, 2017 @04:33PM (#13842318)

I wonder why people still think that their passwords are stored on the external site. It's explained on the "how this works" or whatever for most services like LastPass.

[ Parent | on HN ]

Re:Password Rules Are Bullshit by jonknee on Friday March 10, 2017 @11:40AM (#13839858)

> Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

1Password can sync locally which is a nice plus:

https://support.1password.com/wlan-server/

[ Parent | on HN ]

Re:Password Rules Are Bullshit by drdeadringer on Friday March 10, 2017 @02:13PM (#13841166)

Why not use a password manager on a USB stick?

[ Parent | on HN ]