But is it just a question of education, or also a question of usability? A nice, random sequence of alphanumerical characters that can not be connected to the user at all is, unsurprisingly, hard to remember for the user. Dumb stuff like reusing passwords and choosing pet names is a mistake from a security perspective of course, but also a mitigation of the poor usability of passwords. Don't expect the user to remember dozens and hundreds of strong passwords.

Rather, I would advocate password managers. For me personally, the simple usability of Firefox's integrated password manager (auto-suggests a strong password on account creation, auto-saves the credentials and syncs them across devices) has done more to improve my passwords than all education. I guess I am lazy, but many people are.

> hard to remember for the user

If the user has to remember any password aside from a single unique password used in only one place, they’re doing passwords horrendously wrong.

We have had at least twenty years of password managers by now (KeePass), a good ten of them with browser integrations of various degrees of effectiveness, and almost as long with some form of mobile phone support.

At this point, not using a password manager to save totally-random passwords that don’t need remembering is no different than not using a seatbelt. It’s stupidity and ignorance in action.

Laziness is one of the cardinal programmer virtues:

https://wiki.c2.com/?LazinessImpatienceHubris

Of course you're not lazy. You're just human. Our brain isn't designed to store and recall this kind of information.

It's not fair to blame users on this, because it's impossible to "teach" people to come up with and remember 100+ hard passwords and recall which service which password belongs to.

Passwords were the problem to begin with. Easy to implement, but extremely hard to remember and use correctly.

MFA is part of the solution to this problem.

MFA could have largely been unnoticed had there been large scale adoption of client side SSL/TLS certificates. This would have required a better UX on the browser side and an account creation process that made creating a CSR locally, transmitting it, receiving the cert and storing it transparent.

Then as long as both the username/password and certificate authentication were required, then password reuse wouldn't matter.

You could go one step further and just put a pin in with the cert or no pin at all and just have seamless logins everywhere. Assuming you are using a physical cert token.

Then you lose one factor which is the username/password. If someone managed to get your hardware token and was able to brute force the PIN (if there was a PIN set), then they could log into any of your accounts. By requiring both, an adversary would not be able to log in unless they had the certificate and the username/password. Using one of the two would not be sufficient.

That's how passwordless works with Yubikeys on Office 365 and Microsoft Accounts.

Point is people have to choose a password and supply an email (for the company to spam) just to comment on a news article or submit a bug report. Of course passwords are reused for all that type of website. 2FA is a PITA when you don't even care if your account is hacked. If money or reputation is concerned people take more care.

It is trivial to set a long random cookie on a machine that provides 2FA for all repeated use of a service until the user deletes tokens or changes device. No need for bad UX.

I just looked at my password manager and it has 421 entries plus a few secure notes and other things. I don't believe I have the capacity to remember that many 12 character random passwords with symbols, numbers, capitals, etc...

The symbols, numbers, and capitals are part of the problem. We should have been using passphrases all along.

https://xkcd.com/936/

I still remember the XKCD password.

> I still remember the XKCD password.

Now try remembering 436 different ones.

Exactly. And also remember which of those 436 easily-remembered passphrases go with which accounts.

Correct <url> horse battery staple

I have to disagree with the perceived security with this approach because it fails the requirement of not reusing your passwords.

In case you have this clever scheme and use it on some malicious or insecure website, your scheme could be leaked and then it's only marginally harder to break into your other accounts. Randomly generated passwords don't have this weakness.

Ideally, we shouldn't solely have to rely on unique username/password combinations to log into various accounts. As I mentioned in another comment, had websites and browser makers made it easier to use client-side TLS certificates as part of the authentication process, then both the certificate and a username/password would be needed to log into an account. Then even if someone decided to use the exact username/password combination across all their accounts, since they have a different client-side TLS cert for each account, it would not be practical to get into their accounts without access to the device that stored the private key and the associated certificates.

I think that's evidence that we just haven't done a good job when it comes to accounts and account security. Users choose simple passwords and reuse passwords because otherwise they need to remember a different complex password for every single goddamned thing they interact with, a number that has skyrocketed in the past decade or two.

I can't honestly say I know of a better way, though. Something involving identification using asymmetric keys would be a good start to replace username/password, but that doesn't really solve the problem of losing or compromised private key in a way that's any better than we have currently for passwords.

Hopefully one day we'll all stop using memorized passwords and switch to hardware authentication. So much of this will go away.

It's already happening.

No until hardware tokens are so expansive. They need to be dirt cheap.

Of course the real reason for 2fa over sms, is that companies want your phone number as well as your email address.

Sure, they may have nefarious purposes. But it's also because most people have a working recovery path when they drop their phone in the river.

2FA without a recovery path that people will actually prepare for is a recipie for locked out users, and that's going to mean your customer service gets all the sad stories and hopefully has no ability to do anything about them.

It's because just about everybody has a phone.

It's because, unlike email, phones are approximately 1:1 to humans.