• huquad@lemmy.ml
    link
    fedilink
    English
    arrow-up
    4
    ·
    19 hours ago

    Always two there are. No more, no less. The one they know, and the one they don’t.

    • mac@lemm.ee
      link
      fedilink
      arrow-up
      4
      ·
      20 hours ago

      Yeah I think I’ve got 600 distinct logins in my bitwarden at this point, lol.

      • flatbield@beehaw.org
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        8 hours ago

        This is a great example of how impossible it is not write down usernmes and passwords and how infeasible forcing changes is.

        The other thing people do not talk about enough is user names. They should be somewhat random too and not reused. Forcing people to use their email address is particularly stupid but very common.

        • mac@lemm.ee
          link
          fedilink
          arrow-up
          2
          ·
          3 hours ago

          Yep, before I switched to a password manager in college I had 3-4 passwords I would use across all accounts, and I would constantly need to recover accounts because I would forget the PW.

          I actually don’t remember the last time I needed to recover an account. Having a password manager has been a massive time savings for me.

  • flatbield@beehaw.org
    link
    fedilink
    English
    arrow-up
    36
    arrow-down
    2
    ·
    edit-2
    1 day ago

    I wonder how much of this stems from two stupid IT policies. For decades users have been told to not write down passwords and to change them regularly. The result of this policy is to use a small number of password variations that one reuses. Then IT complaims about it.

    The better plan has always been to use long random passwords that you never reuse and write them down by some method like a password manger and only change them rarely for example when they may be compromised,

    • psud@aussie.zone
      link
      fedilink
      English
      arrow-up
      3
      ·
      17 hours ago

      My workplace has finally gone to passphrases and 1 year password life, which is nice as it’s a password I often need to type, so I’d rather 20 easy to type and memorise chars than 16 random

      • flatbield@beehaw.org
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        8 hours ago

        The missleading thing about passphrases is that anything a human can remember is low entropy. That it has 20 charachers says nothing about how random.

        Edit: I also wonder how much randomness is really needed. Properly salted and hashed passwords shoud not need that much randomness. Lot of this is about users just choosing bad passwords, reusing, and IT not properly salting and hashingon their end.

    • HubertManne@piefed.social
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 day ago

      I remember asking my company if they have official password management software in my job before my last job. They did not. I can’t believe we have all this specific software to be used at the company but they don’t put some time to identify what they want employees to use for this. Funny thing is security teams are such big deals but I think they actually don’t want to get involved in case it does not work out.

  • ArtificialHoldings@lemmy.world
    link
    fedilink
    arrow-up
    8
    arrow-down
    2
    ·
    1 day ago

    I would do the word jumble suggested by xkcd, but so many websites require numbers, special characters, and disallow spaces that it would be impossible to remember unique passwords between those sites. Ironically I end up in a much weaker password ecosystem because I re-use the nearly-same password over and over again so I’m not constantly requesting a reset.

      • 4am@lemm.ee
        link
        fedilink
        arrow-up
        8
        arrow-down
        1
        ·
        1 day ago

        BitWarden now supports passkeys and has a free 2FA app.

        No excuses not to be as secure as possible anymore.

        • psud@aussie.zone
          link
          fedilink
          English
          arrow-up
          5
          ·
          17 hours ago

          KeePass doesn’t rely on any third party, and if you choose to use a third party file storage to hold your password vault, it’s encrypted

      • mnemonicmonkeys@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        6
        ·
        21 hours ago

        Single point of failure and a separate entity has all of your passwords and you have to continue paying them or lose access to everything. Sounds like a terrible idea to me

        • shadshack@sh.itjust.works
          link
          fedilink
          arrow-up
          4
          ·
          20 hours ago

          There are password managers you can self host. Bitwarden being one of them. Secure it as much as you want and keep off-site encrypted backups if you’re worried about a single point of failure.