How do you remember 70+ different password+username combinations?
Or do you just re-use passwords…
Comment on Passkeys might really kill passwords
0nekoneko7@lemmy.world 7 months ago
People are making things more complicated than they already are. I keep my passwords and passphrases inside my memory.
P.S. My password is not ‘Password123456’
Darkassassin07@lemmy.ca 7 months ago
0nekoneko7@lemmy.world 7 months ago
0nekoneko7@lemmy.world 7 months ago
I have a system of pattern for every new password. So I just have to remember the pattern of things (a pseudo algorithm) that use to generate new password.
Darkassassin07@lemmy.ca 7 months ago
The problem I have with a system like that is it doesn’t account for leaked passwords/data breaches.
When you find one of those services has had a data breach and your password was compromised; you’ve now gotta adjust your mental algorithm to make an entirely different pattern, either for every site, or you’ve gotta remember each of the changes you’ve made for specific sites.
Long term it turns into a mess.
ryathal@sh.itjust.works 7 months ago
The real solution is to only remember one or two passwords and have widespread oauth adoption. Instead of having to sign up with every possible website and app, I should only need a couple of google/Facebook/apple/steam/github/Amazon/PayPal/whatever.
wolfpack86@lemmy.world 7 months ago
But we need one that isn’t using our logins to track where/what we are doing.
LastYearsPumpkin@feddit.ch 7 months ago
There’s no way for the average person to keep up with remembering unique, strong passwords for all the sites that require them.
You either have to write it down, save it in a password manager, reuse passwords, or have simplified passwords or patterns.
RippleEffect@lemm.ee 7 months ago
My vote is password manager. You can use 1 really good password for it and as many stupidly good passwords anywhere else since youre likely auto filling or pasting it in.
Just if your using it locally, remember to take a backup.
leftzero@lemmynsfw.com 7 months ago
Passphrases with a simple formula to make them unique for each site.
You just have to remember the formula, you get a strong unique password for each site.
Easy and safe, and doesn’t tie you to a single point of failure like a specific device or a password manager.
Add two factor authentication on top (with multiple options, of course, otherwise you’ll get locked out once you inevitably lose the second authentication method), and you can even safely use it from third party devices which you don’t want to remember how to access your accounts.
subtext@lemmy.world 7 months ago
Except if your “formula” is to make your passwords
Twit–ter…it’ll be exceedingly obvious if someone were able to get your password from Twitter and then credential stuff at any other website. That’s not real security.
Also a password manager doesn’t have to be a single point of failure. First of all, they have like 3 or 4 points of failure before they actually lose anything, and you can always make an export or go back to a pen and paper password journal if you really want to to make an offline second point of failure.
UsernameIsTooLon@lemmy.world 7 months ago
Gladaed@feddit.de 7 months ago
You are not supposed to have relation between the words. This password is vulnerable to a dictionary attack. If you are not a high value target you should still be OK.
LastYearsPumpkin@feddit.ch 7 months ago
Then one password breech and your password everywhere is exposed to the world. That’s bad advice.
leftzero@lemmynsfw.com 7 months ago
Just use a simple formula to make the passphrase unique to each site. 🤷♂️
johannesvanderwhales@lemmy.world 7 months ago
Yeah password re-use is the main method of cracking passwords. That obscure site that you think “oh I don’t need a good password for this because it’s a site I don’t care about”? Guess what, they have shitty security practices, and now crackers have access to every site where you’ve used that same password.
Patches@sh.itjust.works 7 months ago
We’re supposed to take security advice from someone for freely gave their password out?
But in all seriousness yes phrases are better. You don’t need the money symbol 1234t67890 especially if it makes it harder to remember.
You can even have each phrase be the website. TargetSucksMonkeyDick, BestBuySucksMonkeyDick are secure passwords.
LastYearsPumpkin@feddit.ch 7 months ago
Which is KIND OF ok unless someone looks at a password breech list and figures out your super simple pattern. And I’m sure the rise of AI being used in password breech attacks will just make it more automated.
Real, true, random passwords/tokens is really the only way to actually be safe. Which means you have to use a password generator, AND something to save the password.
lando55@lemmy.world 7 months ago
BestBuySucksMonkeyDick is the password I use on my luggage!
butterflyattack@lemmy.world 7 months ago
Phrases are definitely more memorable than forcing people to use capitals, numbers, symbols, all that shit. But there are just so many passwords to remember.
Ookami38@sh.itjust.works 7 months ago
Assuming you have a strong base password you aren’t concerned with being broken, you can use that, followed by a unique identifier for what you’re logging into, so every password is essentially the same, but also unique. Something like, translate the lyrics to a song (say without me by Eminem) to first letters and punctuations, 2tpggrto,rto,rto, and add the identifier.
2tpggrto,rto,rto-goog 2tpggrto,rto,rto-faceb
This is essentially how I manage my passwords that I want to actually remember. And no, I don’t use that song lol.
KairuByte@lemmy.dbzer0.com 7 months ago
This is essentially the same thing as using the same password everywhere.
Yeah, they are unique. But if one is broken, they are all essentially broken.
blackbirdbiryani@lemmy.world 7 months ago
Only if you’re specifically targeted. I know enough regex to know that nobody is going to bother trying to parse known passwords to identify patterns like that when there’s a billion suckers who use ‘password123’ for their bank accounts.
As long as the pattern is not super predictable, and aren’t dictionary words, nobody is brute forcing that.