you are viewing a single comment's thread
view the rest of the comments
[–] -3 points 2 years ago (14 children)

just use a password manager

I will never do that, I have a system instead. I never understood why people would want to use a password manager. To me it seems it ads an attack vector, where you could lose EVERYTHING!

  • source
  • parent
  • hideshow 14 child comments
  • [–] 1 point 2 years ago (11 children)

    Passwords suck as an authentication system in general. Your own system is probably worse than what password managers do. Yes, there are problems, but so does every other solution to this, and password managers win out in the comparison.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 0 points 2 years ago (10 children)

    Your own system is probably worse than what password managers do.

    How so? If you use a password manager across 3 platforms, that makes for 3 attack vectors.
    My personal system has guaranteed no vulnerabilities. So how do you conclude my system is worse?

  • source
  • parent
  • hideshow 10 child comments
  • [–] 0 points 2 years ago (9 children)

    My personal system has guaranteed no vulnerabilities

    If you think that's true, then you don't have the experience to make a secure system.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 0 points 2 years ago (8 children)

    What? What kind of system do you think I have? The only vulnerability is if they can hack my brain.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 0 points 2 years ago (7 children)

    Yeah, that's going to be a terrible system. The human brain isn't capable of keeping track of enough entropy to create a secure password system.

    More generally, it's a big red flag when anybody thinks they can make a better system than publicly available and verified systems. You're not capable of that, I'm not capable of that, Bruce Schneier is not capable of that. No matter how smart you are, you missed something. That's why I didn't need to know a single detail.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 0 points 2 years ago* (last edited 2 years ago) (6 children)

    he human brain isn’t capable of keeping track of enough entropy to create a secure password system.

    What an idiotic argument, the level of entropy comes from the rules first and foremost, putting a 1 and an A together is the exact same entropy as using 2 and B. Randomizing it one way instead of another doesn't change entropy much.

    More generally, it’s a big red flag when anybody thinks they can make a better system than publicly available and verified systems.

    You completely fail to understand the argument. I'm not arguing my passwords are stronger, I'm arguing they are SAFER! because they are not stored on any system, much less 3 different systems, one of which could theoretically have a vulnerability.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 2 years ago (5 children)

    What an idiotic argument, the level of entropy comes from the rules first and foremost, putting a 1 and an A together is the exact same entropy as using 2 and B.

    Oh dear, no. You cannot match a cryptographic (P)RNG for generating passwords. Not even close.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 2 years ago (4 children)

    True, my argument is that in practice it doesn't matter. How many passwords of REASONABLE strength are brute forced? Opposed to how many are lifted from services with lacking security?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 2 years ago (3 children)

    Quite a few. Data dumps of passwords from sites can be from sites that used full hashing. If you used a fully random password of at least 20 characters, even unsalted md5 storage would be unbreakable.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 2 years ago (2 children)

    That's true. But how does a randomized password generated by a password manager work when the service is accessed from 3 platforms? Like for instance Windows, Linux and Android?
    Seems to me that you need 3 different pieces of software, and just 1 getting compromised would compromise everything.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 2 years ago (1 child)

    It's generally one piece of software, a browser extension, that works for all. Even mobile apps are often just webpages with extra steps, so the code base is the same.

    The underlying storage must be encrypted the same way on each.

    Yes, there are still potentially issues. I'll come back to what I said at the start: passwords are a bad system in general, all methods for handling them are flawed, but password managers have the fewest flaws.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 years ago

    Yes, there are still potentially issues. I’ll come back to what I said at the start: passwords are a bad system in general, all methods for handling them are flawed, but password managers have the fewest flaws.

    Well that I can actually mostly agree on, IDK how we got into a disagreement on that in principle? For me personally though, I trust myself more, than a software manager. I'm pretty sure my passwords are strong enough, even if a software manager can make even stronger passwords.

  • source
  • parent