A notebook in a locked safe is the most secure datastore for 90 - 98% of the population - depending of how deeply you distrust NSA.

If someone breaks into my house I’d rather they just got my TV and some belongings rather than my life savings.

Does it make sense to also keep some decoy items, like an old MacBook in plain sight?

I hope so. I always leave an old Macbook and iPhone in sight when leaving the house.

"Unfortunately, large swaths of the security community are fixated on avant garde horrors such as the fact that, during solar eclipses, pacemakers can be remotely controlled with a garage door opener and a Pringles can. It’s definitely unfor- tunate that Pringles cans are the gateway to an obscure set of Sith-like powers that can be used against the 0.002% of the population that has both a pacemaker and bitter enemies in the electronics hobbyist community. However, if someone is motivated enough to kill you by focusing electromagnetic energy through a Pringles can, you probably did something to deserve that. I am not saying that I want you dead, but I am saying that you may have to die so that researchers who study per-photon HMACs for pacemaker transmitters can instead work on making it easier for people to generate good passwords."

My point being if someone's motivated enough to break into your house to steal your passwords in order to steal your life savings, that's probably an outside scenario, given most B&Es are junkies looking to score enough for their next high.

I think this is very unlikely. For one, the notebook does not contain all the information - say "Bank1 Password" - which bank is that? What's the username? What about 2FA?

Secondly, surely the whole point if a safe is that it's bolted down and hard to burgle / steal?

they exist but uh. most people just have portable fire-safe boxes as far as I've seen. or nothing.

Nobody’s arguing that passwords/phrases should only be remembered and never written down or stored in a password manager. That ship sailed a long time ago.

Your father does use a password manager: a slow, very inconvenient one. If you could teach him to reach for ctrl-c/ctrl-v instead of a pencil, it would be easier for him.

Your notebook will look markedly different from a website that tries to imitate your notebook. Your password manager will only look markedly different from a website imitating your password manager if you have a certain level of awareness and acuity of what happens on-screen and what it means. I think GP's father doesn't have that awareness, and never will, by choice. They choose to spend their energy elsewhere.

Younger generations had no choice and will have spent that energy already by the time they're 12 years old, and have these problems less.

This! I mention password managers, two factor or just try and get him to improve his passwords and his eyes glaze over and can see him begging to nod off. Probably somewhat my fault for always bring them up after a meal when he's probably already half way to napping...

I'm getting close to 60, but I've been programming and working with computers since in was in 6th grade. When I was in my 30s, paying my bills meant sitting down at the table once a month with my checkbook, stack of bills, and book of stamps. Open a bill, write a check, put a stamp on the envelope, repeat. It took maybe 15 minutes and was very easy. Compare that to opening a different website, with a different username and password and maybe TOTP code or SMS code, for each bill I need to pay. It's slower and more complicated.

There is no online payment method I've seen that seems easier to me than just writing a check. Of course I rarely write checks these days, so I use the apps and websites and feel annoyed every time I do.

Though you are also correct that dealing with "technology" today requires a certain level of pain tolerance. Good UX exists but is rare, and authentication is still a mess basically everywhere if you don't want to do OAuth and centralise it to the behemoths. "Poweruser apps" can be extremely empowering, but always have a steep learning curve, sometimes very steep; they can help making your dayjob much easier, but typically help nought with, say, filing your taxes or paying your bills.

Disclaimer: am 25 years old.

and immediately you write this:

> Though you are also correct that dealing with "technology" today requires a certain level of pain tolerance. Good UX exists but is rare

So it's not just 40+ year olds who feel this way

EDIT: you are correct I didn't word my original message correctly. Perhaps you have a point.

Autopay. I only pay one bill manually, twice a year, because they don't allow autopay (property taxes). Otherwise I just don't think about it.

Sure, you may not like autopay for whatever reason, but that's a choice. The option is there.

It's not comfortable, but every time you write a check you're doing exactly this.

They are correct aren't they? None of the modern software is made to serve and help the user. It's made to serve advertisers and be promotion vehicles for product managers.

I am a computer guy. I am constantly and continuously irritated by all the crap in software. I see how my non-techie mom struggles, and it's several orders of magnitude worse for her.

So I totally agree with you.

How I paid bills in Thailand:

    1. Bill comes in the mail, with a QR code. Bill says I owe 413 ฿ for power.
    2. I scan the QR code with my phone.
    3. Message comes up from my bank saying, "You want to pay 413 ฿ for your power?"
    4. I tap yes. Bill is paid.

It might reasonably be argued that it's less secure, since it's pretty hard to hack an air-gapped sheet of paper. But it's not harder to use.

>Your father does use a password manager: a slow, very inconvenient one

Writing down certain passwords can be very convenient. No hacker on the internet is going to access the piece of paper on my desk.

I consider myself computer savvy and I still write down some passwords on paper instead of having them stored on an internet connected computer. (I believe burglars really don't care about passwords. And it is very easy to obscure the written passwords.)

There's a cost to society to carrying over such a technological deadweight loss and these people are free riders.

Technology is for people, not the other way around.

The fact is, anti-human attitudes to both housing and technology are harmful everywhere. Nobody has to "win" at the other side's expense here.

Leveling down on everyone's security in exchange for usability for a segment of the population is not a realistic long-term strategy.

As for the rest, is there any actual evidence of widespread interception of SMS 2fa actually being a problem?

Yet akin to the article, because of the overly sensitive, everyone's expressive creativity must be dulled down. Who's the intolerant one?

I can agree that people are often over-sensitive but I wouldn’t expect that calling a person deadweight is likely to garner their thoughtful attention, precisely because it is disrespectful. Indeed, it would be foolish of me to expect them to start (or continue) listening to my words.

Maybe you have better luck in New York but I bet you could find people (read: strangers whom you’ve never met or spoken to) there who are personally offended when you call them deadweight. If you’re walking somewhere and you see someone whom you think is homeless, do you let them know they’re deadweight to society? Do you think one is being over-sensitive if they become offended after they are simply called “stupid”? It might be worth explaining an opinion more instead of using such terminating cliches.

Maybe because the one commenter used the phrase “insensitive opinion” there is a misunderstanding. I’m not trying to suggest that the opinion is insensitive, only the way it’s expressed. This opinion can be presented in a friendlier way, despite the topic. (It may also be worth pointing to four words in my initial comment: “regardless of the veracity”.) One can be tolerant of opinions while being intolerant of name-calling in a way that is compatible with not being the “tyrannical minority”.

That's simply incorrect. Everyone gets to decide.

Technology is not for people. It ought to be, but it is not.

Technology exists so that the aristocracy can line their pockets and control the populace more efficiently.

People and technology and aristocracy are for the memes. It's just one huge anthill where the ideas evolve, living on biological (and then technological) foundations.

Power hubs (be it aristocracy or any other form of government) is just a convenient mechanism for spreading ideas - politicians and millionaries are just superspreaders (in their respective ages, but they're losing it to the technological platforms - and of course there's a struggle). So is technology. So are people. It's all an evolutionary process - just notice how designed systems rarely win, nearly always giving to chaotic blind evolution - whatever catches more brainspace truly matters, not what works best. If the memetic winds will blow in a certain direction, LLMs may make us obsolete, but not in the way we think they would.

This comment is sponsored by "You think the moon is real?" meme. Sorry (not sorry).

I also have no password requirements (other than non-blank)

I do this because I see it as user centric. I have never had a problem.

One environment requires no privacy expectation. That environment we use simple nouns all in the same category.

All the environments are full SSO they only need to login.

In all seriousness, tech must adapt to humans. Engineers are at their best when they aren’t dictators

The same capitalistic analysis can be said for fetuses, infants, and children up to working age.

Is your proposal for infanticide the same as your gerontocide?

Some people will just never change a behaviour.

I usually avoid analogies of HN as you are often called out on the technicalities of them. And you are right that can often damage an argument.

However, I have argued that changing peoples behaviour, even when their current behaviour is bad for them, is often impossible despite all evidence, from the beginning.

This is still case 1.

I actually agree with you that some people with bad security habits will never change their behavior, but do you really feel that someone using passwords in a notebook because that's what they're comfortable with is in the same class of behavior as someone addicted to nicotine?

Feel free to have the last word here. 1 on 1 HN threads more than 3 deep rarely result in productive conversation. Cheers

Fwiw I think you're actually right that HN tends to spend way too much time on semantics, and I'm certainly guilty of that myself sometimes

* to respond to something you don't agree with, in this case a metaphor, perhaps just write "I don't agree with that metaphor" or "let's stick to realistic examples"

* try not to dissect motives unless necessary. The person you responded to made a good point that people will do things against their interests out of habit or convenience -- why does use of a completely legitimate tactic need to be singled out?

* technical people who work with non-technical people (or even who deal with non-technical families and friends and children) are highly accustomed to describing things in simple metaphors

I realize that I have been uncordial and somewhat aggressive with you in this instance, but it made me particularly irked to see someone profess such an amount of self-awareness while showing a profound lack of it.

Either you are (a) just not in your groove mentally at that moment, (b) not as centered as you like to think you are, or (c) playing some kind of game, either consciously or unconsciously. Either way I figured my approach would get a response and hopefully a correction.

I look forward to our next encounter and genuinely hope it starts off on a better footing because you seem like an interesting person.

So do I for some passwords, physical security is way easier.

Have you tried the “passkey” integration on Apple devices? If so, do you think your father would be able to use that?

To me, it seems such a simple UX that I can’t imagine even the most technically illiterate being unable to use it. In the Apple ecosystem, there is literally no configuration for the “password manager” it’s just integrated into the Apple Account. You’d go from a notebook of passwords to just one (the main Apple ID password, for recovery etc).

Obviously “passkey” is not available in most sites yet, but I imagine that once it is, the switch might be pretty painless for the non-tech savvy. Assuming the other device manufacturers can provide similar seamless integration.