you are viewing a single comment's thread
view the rest of the comments
[–] 98 points 1 day ago (25 children)

Meanwhile, half of the people at every company I've ever worked at:

  • source
  • hideshow 25 child comments
  • [–] 40 points 19 hours ago (3 children)

    If the computer is in even a marginally secure place, storing passwords on physical paper is better than what a lot of people do.

    Of all the proverbial bullets I've been hit with, none had my name on them; they were all addressed "To whom it may concern". The times my identity has been stolen or my accounts compromised it was because somebody attacked some fairly large entity, like Alphabet or Equifax or Microsoft or Visa. Nobody's going to walk into my house looking for my passwords. They might walk into my house looking for my television, but that hasn't happened to this house longer than I've been alive.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 12 points 14 hours ago (2 children)

    Yep, there's a reason 2FA recovery keys are usually printed and stored safely.

    With that said, one way to avoid someone compromising service A due to somebody breaking into service B is to have different passwords everywhere, so a Password Manager is more convenient anyway.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 hour ago* (last edited 1 hour ago) (1 child)

    Which is why I use a password manager. There are some passwords that I do keep human readable and typeable, like my home wi-fi password, because...enter a password like ghQ953mGh0hY0eo5vgnj;lse%tp[n9a36 into my niece's Switch Lite when she comes to visit. For that I do the CorrectHorseBatteryStaple thing. But for most passwords for services that aren't in my physical control I use my PM's random string generator.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 minutes ago

    For home Wi-Fi I use a strong password, but that's because it's something I input once in a blue moon. For guests I have a guest Wi-Fi with a simpler* (still reasonably secure and random, but shorter and without special characters) password and a QR code for simple use, though they are rate limited and have no access to any other network clients.

  • source
  • parent
  • [–] 18 points 23 hours ago (12 children)

    The worst part of the left one is the implication they have only two passwords. The "under the keyboard" part at least requires physical access and (hopefully) means its not something stupid or short like "p@ssw0rd".

  • source
  • parent
  • hideshow 12 child comments
  • [–] 4 points 12 hours ago (2 children)

    The “under the keyboard” part at least requires physical access

    That's fine at home. Not so great in an office, though

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 23 hours ago (8 children)

    I have yet to see a sticky note password that was anywhere near NIST compliant lol.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 11 points 22 hours ago (7 children)

    NIST compliance is 15 characters. That's it. No stupid cycling every three months. No stupid special characters.

    Somebody finally read the XKCD comic.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 14 points 21 hours ago (2 children)

    my workplace makes us change passwords every 3 months and I don't respect them so its the same password with the same number at the end -1 because I can't be bothered. If I get hacked oh no ive dealt damage to a multi billion dollar corporation woe.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 17 hours ago (2 children)

    I wonder why passphrases fell out of style? If you remembered a series of random words like you were activating the freaking Winter Soldier, boom, 40+ characters!

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 13 hours ago*

    If we take the EFF wordlist commonly used to generate passphrases, we have 7776 words. If we take ASCII alphanumerics and special characters we have about 92. Assuming we generate a NIST compliant password of 15 characters in length we get 92^15=2.8*10^29 of combinations. To get the same level of security (same number of combinations) using the EFF wordlist we need (log(2.8)+29)/log(7776)=29.45/3.9=7.6 around 8 words. If we assume the words are 7 characters long on average, plus the separators, we get 7*8+6=62 characters long. If we start to also include Unicode characters like other scripts or emojis (something I've recommended to others) the required number of words grows even more. I don't know about you, but I can't be bothered to type that all out every time, a password manager works for me.

  • source
  • parent
  • [–] 3 points 12 hours ago*

    Did they ever get into style? I use them, but I don't know anyone else who does. And some sites make diceware passphrases harder to use by e.g. requiring you to add numbers, special characters or capital letters, or by banning spaces. Or by banning non-ASCII, which makes it harder to use diceware passphrases in other languagess than English.

  • source
  • parent
  • [–] 7 points 21 hours ago (3 children)

    Woah now what about changing 1 to !

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 11 hours ago*

    I will take a stanza from a song, use the first letter from each word, switch the S to 5 or $ as an example, and make sure I have two uppercase, two lower, two numbers. and two special characters, 8 minimum, although now it runs about 13.

    I hum as I type in my password. All I have to remember is how I typed it out.

    Come at me, dictionary cracks. The result is bonkers as fuck, but I loved that stanza. I have passwords I have used for 20+ years.

    My coworker who sits next to me recently commented to me that I always hum the same tune when I log into my computer. Then he mentioned I hum a different tune when I log into the proxmox.

    My sticky note would be like:

    computer - Local H

    proxmox - Sonic Youth

    mail server - Future of the Left

    NAS - Faith No More

    Inventory - Slothrust

    etc.

  • source
  • parent