• locuester@lemmy.zip
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    I use a different password for every site tho. Using same pw for every site, that’s another extreme entirely.

    • 📛Maven@lemmy.sdf.org
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      Most people do not. The average user has one or two passwords, and maybe swaps out letters for numbers when the site forces them to. Because remembering dozens of passwords is hard. If you, personally, can remember dozens of secure passwords, you’re some kind of prodigy and the use-case for a password manager doesn’t apply to you, but it still applies to the majority.

      • locuester@lemmy.zip
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        1 year ago

        One doesn’t have to remember dozens. Just a basic algorithm for deriving it from the name of the site. Complex enough that it’s not obvious looking at a couple passwords but easy to remember.

        This method works for me. I understand its dangers (can still correlate. Dozen passwords and figure out the algo). But it’s my current approach. I hate even discussing it since obscurity helps.

        • Amju Wolf@pawb.social
          link
          fedilink
          arrow-up
          4
          ·
          1 year ago

          Your system is most likely way less secure than you think. I mean, possibly not since you’re here, but most schemes are trivial to solve even automatically.

          …and that doesn’t really matter either, because so many people have such shitty passwords (and use the same ones everywhere) that noone really bothers checking for permutations when they have thousands of valid accounts.

          But if truly enough people are convinced to be more secure your scheme may eventually become a target, too.

          With passkeys (and password managers in general) the security gets so good that the vast majority of current attacks on passeord protection get obsolete.

          • locuester@lemmy.zip
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            I agree 100%. As mentioned, I rarely share my approach and I’ll be deleting that comment in a bit. It works well for me.

            No hacker is attempting to decode the password algorithm because they don’t know of its existence on my logins, and they have thousands of better ways to go - as you said.

        • 📛Maven@lemmy.sdf.org
          link
          fedilink
          English
          arrow-up
          4
          ·
          1 year ago

          Okay, I’m glad you have a system, but it’s not really relevant? I didn’t say you should use a password manager. I said it’s good for the majority of people who can only remember one or two passwords.

          • locuester@lemmy.zip
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            I’m of the mindset that locally stored keys and/or social solutions are better than throwing all passwords in a single place.

            All passwords for large amounts of people in a single place is begging for a break-in.

            I spend a lot of time studying solutions in this space as I’m a long time crypto solutions dev. Lots of ideas and discussions to be had.

            I’m not disagreeing with you, just having a dialogue.

            • 📛Maven@lemmy.sdf.org
              link
              fedilink
              English
              arrow-up
              3
              ·
              1 year ago

              That’s probably true, but perfect can’t be the enemy of good. Getting everyone who currently uses the worst method (a single global password) to use a better method means that better method has to be easier than that, and as things lie right now, most security researchers agree that the method most likely to succeed is removing roadblocks, both client-side and server-side, to make password mangers even easier and more secure (whether you want to store it locally or not is really up to you, and again, it is already an option). We’re not talking about people who already try to stay secure, or care about the exact details. You and I already know we care about security and do our best, presumably. The crucial thing is to onramp Bob Q. Public, the middle manager whose password on everything is rover73 because he loves his dog, and any solution more complicated than remembering one password and clicking one button is going to be too much change for him to get around to doing it

              • locuester@lemmy.zip
                link
                fedilink
                English
                arrow-up
                3
                ·
                edit-2
                1 year ago

                Onboarding new users securely is in the forefront of most minds in my industry because the current standard is a 12 word phrase written on paper, which most users throw in a cloud solution or screenshot.

                The stakes are even higher in crypto where you’re protecting, without recourse, large sums of value. Passkeys are a critically needed solution for my industry. But they need coupled with a social or offline storage recovery mechanism.