News for hackers. Stuff that matters.
Re:The 111M Record Pemiblanc Credential Stuffing List by soared on Monday July 09, 2018 @10:32PM (#17494997)
As someone technically literate but doesn't use a password manager: I sign up for a lot of services on one device (home laptop) and then need to use them on another device (work laptop, phone). How does a password manager work for this?

I currently have about ~15 different passwords I use. I know which to use based on how long I've been using the service. Why is this strategy ineffective?? At most a hacker could get 3-4 of the services I use, and even then they'd need to find each of those services out of the hundreds I use. I also have 4 different emails I use for logins.

Re:The 111M Record Pemiblanc Credential Stuffing List by pietroglyph on Monday July 09, 2018 @10:51PM (#17495072)
Most password managers provide apps and syncing, and are often integrated into your browser, so everything is a click away. Having to juggle 4 emails, remember which of 5 passwords a site uses, and figure out your exposure in case of a breach seems a lot harder than the above.
Re:The 111M Record Pemiblanc Credential Stuffing List by OliverJones on Tuesday July 10, 2018 @06:22AM (#17496807)
I happen to use the open source password manager from Keepass.info. It works on a local password file protected by strong crypto. Then, I use Dropbox to sync that file from device to device.

The problem with using the same password on multiple sites is this: if any one site gets pwnd, it gets a lot easier for the cybercreeps to pwn your account on other sites (says Obvious Man).

It doesn't take much technical skill to credential-stuff--to hammer a lot of sites with a list of credentials. So, keeping the list of sites you actually use a secret is not effective.

This whole deal sucks. But it's real.

Re:The 111M Record Pemiblanc Credential Stuffing List by cgoecknerwald on Monday July 09, 2018 @10:48PM (#17495059)
Personally, I use LastPass across browsers in multiple desktop accounts and my mobile browser, with no issue. You create a LastPass account, presumably with a very secure password, that you can log into elsewhere.

As for the password strategy, I imagine you could be vulnerable if any two important accounts - say, email and bank - both used the same password. Are you confident this is not the case?

I assume certain emails associate with certain types of accounts, which could flaw your strategy. If you're able to remember ~15 different passwords with random emails, congrats on your stellar memory!

Re:The 111M Record Pemiblanc Credential Stuffing List by markbnj on Monday July 09, 2018 @11:46PM (#17495283)
I use Google Smartlock, and it functions across all my (android) devices quite well. It does sort of rely on your being all-in on the Google ecosystem. At work we use LastPass, but since I only use it on the desktop in a browser I can't speak to how it works across devices.
Re:The 111M Record Pemiblanc Credential Stuffing List by cgoecknerwald on Tuesday July 10, 2018 @12:02AM (#17495345)
LastPass works for multiple devices, including mobile - you can sync to 1 LastPass account, too.
Re:The 111M Record Pemiblanc Credential Stuffing List by fjsolwmv on Tuesday July 10, 2018 @11:31AM (#17498946)
Does smartlock work with native mobile apps (which may or may not use magic webviee for auth), or is there a way to manually transfer password to log into an app?
Re:The 111M Record Pemiblanc Credential Stuffing List by dorfsmay on Tuesday July 10, 2018 @01:42AM (#17495730)
Password managers across devices:

Either use a service that syncs up to a server, or a standalone apps and save its encrypted database to a shared filesystem such as Dropbox or pcloud.

Re:The 111M Record Pemiblanc Credential Stuffing List by talaketu on Tuesday July 10, 2018 @12:50AM (#17495573)
As long as you don't care if at most 4 of your accounts get hacked, then you have an effective strategy, I guess.