1179
Passwords (lemmy.world)
submitted 3 years ago by to c/technology@lemmy.world
240 comments fedilink hide all child comments
 

We've all been there.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 3 years ago (1 child)

You are not supposed to have to remember anything but your master password. :)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -2 points 3 years ago (1 child)

    I'd rather try and remember than have a single point of failure for all my accounts' security.

    If the passwords are stored offline then I can't get at them if I'm away from where they're stored. If they're stored online they're not secure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 3 years ago* (last edited 3 years ago) (1 child)

    Some are online, but encrypted, with options to export the passwords in case the service goes down.

    "Why should I trust them?"

    Well, the software is open source, and regularly audited by people using it. Many password managers, such as Bitwarden (not sponsored, although I'd like to get a sponsorship) uses end-to-end encryption to secure the passwords so someone hacking the servers or a rogue employee can't access anything, It would just look like random noise. You don't have to know coding, you just have to trust that someone in the world will have the knowledge to inspect the code and report any suspicious code. Just regularly back up the passwords to a local file so you still have them in case they shut down.

    Trying to remember passwords made me constantly stressed trying to remember them. A password made life much easier. Better than a single point of failure like your brain. One password is much easier to remember, and that one password can be as complex as you want, because that's the only one you'd have to worry about.

    Sincerely,

    Someone who's depressed af and constantly forget passwords

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 3 years ago (1 child)

    Encryption can be decrypted. A password manager encrypting your passwords is like saying your car has working brakes. It's totally unsafe to even consider operating without but it doesn't say much when it is there.

    It's not a matter of "why should I trust them" but "why should I trust them more than the system that already exists". I get the appeal, but the hole is big.

    If I forget a password I reset it. If I forget my manager's password can it be reset? Is the reset option, if extent, susceptible to attack?

    If an account gets compromised it could have moderate repercussions, but probably minimal depending on the account, with maybe a couple exceptions. If managed passwords get compromised that's potentially everything. There has not, and likely never will be, an impenetrable system, so it is a possibility if not a concern.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] 2 points 3 years ago* (last edited 3 years ago) (1 child)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 3 years ago (1 child)

    By "emergency sheet" are you suggesting writing the access-to-everything password down somewhere? If so I'm hard pressed to think of many things less secure. If not I'm genuinely curious what it is.

    I can't imagine a scenario in which I wouldn't have backups, but I appreciate the mention.

    I also am generally not concerned with someone pickpocketing my house keys, but that's not to say it isn't a possibility. Awareness is the first step to mitigation.

    Email has to be the most protected, I absolutely agree. But I definitely wouldn't be comfortable with the possibility of needing to reset everything else if I lost my master password. But I don't know that I'm more comfortable with the ability to reset. It really kinda feels lose-lose to me.

    I don't think we'll move to passkeys any quicker or easier than we moved to 2FA. I'm glad we're getting better options but we're bound by the weakest links and they don't like change.

    Thanks for the answers

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •