Comment on Passkeys might really kill passwords

• RippleEffect@lemm.ee ⁨4⁩ ⁨months⁩ ago

  My vote is password manager. You can use 1 really good password for it and as many stupidly good passwords anywhere else since youre likely auto filling or pasting it in.

  Just if your using it locally, remember to take a backup.

  source
• leftzero@lemmynsfw.com ⁨4⁩ ⁨months⁩ ago

  There’s no way for the average person to keep up with remembering unique, strong passwords for all the sites that require them.

  Passphrases with a simple formula to make them unique for each site.

  You just have to remember the formula, you get a strong unique password for each site.

  Easy and safe, and doesn’t tie you to a single point of failure like a specific device or a password manager.

  Add two factor authentication on top (with multiple options, of course, otherwise you’ll get locked out once you inevitably lose the second authentication method), and you can even safely use it from third party devices which you don’t want to remember how to access your accounts.

  source

  • subtext@lemmy.world ⁨4⁩ ⁨months⁩ ago

    Except if your “formula” is to make your passwords

    Twit–ter

    …it’ll be exceedingly obvious if someone were able to get your password from Twitter and then credential stuff at any other website. That’s not real security.

    Also a password manager doesn’t have to be a single point of failure. First of all, they have like 3 or 4 points of failure before they actually lose anything, and you can always make an export or go back to a pen and paper password journal if you really want to to make an offline second point of failure.

    source
• UsernameIsTooLon@lemmy.world ⁨4⁩ ⁨months⁩ ago

  [deleted]

  source

  • Gladaed@feddit.de ⁨4⁩ ⁨months⁩ ago

    You are not supposed to have relation between the words. This password is vulnerable to a dictionary attack. If you are not a high value target you should still be OK.

    source
  • LastYearsPumpkin@feddit.ch ⁨4⁩ ⁨months⁩ ago

    Then one password breech and your password everywhere is exposed to the world. That’s bad advice.

    source

    • leftzero@lemmynsfw.com ⁨4⁩ ⁨months⁩ ago

      Just use a simple formula to make the passphrase unique to each site. 🤷‍♂️

      source
    • johannesvanderwhales@lemmy.world ⁨4⁩ ⁨months⁩ ago

      Yeah password re-use is the main method of cracking passwords. That obscure site that you think “oh I don’t need a good password for this because it’s a site I don’t care about”? Guess what, they have shitty security practices, and now crackers have access to every site where you’ve used that same password.

      source
  • Patches@sh.itjust.works ⁨4⁩ ⁨months⁩ ago

    We’re supposed to take security advice from someone for freely gave their password out?

    But in all seriousness yes phrases are better. You don’t need the money symbol 1234t67890 especially if it makes it harder to remember.

    You can even have each phrase be the website. TargetSucksMonkeyDick, BestBuySucksMonkeyDick are secure passwords.

    source

    • LastYearsPumpkin@feddit.ch ⁨4⁩ ⁨months⁩ ago

      Which is KIND OF ok unless someone looks at a password breech list and figures out your super simple pattern. And I’m sure the rise of AI being used in password breech attacks will just make it more automated.

      Real, true, random passwords/tokens is really the only way to actually be safe. Which means you have to use a password generator, AND something to save the password.

      source

      • leftzero@lemmynsfw.com ⁨4⁩ ⁨months⁩ ago

        unless someone looks at a password breech list and figures out your super simple pattern.

        Don’t simply put the site’s name there. Put a similar sounding easy to remember word, a synonym, rhyming slang, the first and last letters of the site’s name plus the number of letters in the domain name, whatever.

        source
    • lando55@lemmy.world ⁨4⁩ ⁨months⁩ ago

      BestBuySucksMonkeyDick is the password I use on my luggage!

      source
  • butterflyattack@lemmy.world ⁨4⁩ ⁨months⁩ ago

    Phrases are definitely more memorable than forcing people to use capitals, numbers, symbols, all that shit. But there are just so many passwords to remember.

    source
• Ookami38@sh.itjust.works ⁨4⁩ ⁨months⁩ ago

  Assuming you have a strong base password you aren’t concerned with being broken, you can use that, followed by a unique identifier for what you’re logging into, so every password is essentially the same, but also unique. Something like, translate the lyrics to a song (say without me by Eminem) to first letters and punctuations, 2tpggrto,rto,rto, and add the identifier.

  2tpggrto,rto,rto-goog 2tpggrto,rto,rto-faceb

  This is essentially how I manage my passwords that I want to actually remember. And no, I don’t use that song lol.

  source

  • KairuByte@lemmy.dbzer0.com ⁨4⁩ ⁨months⁩ ago

    This is essentially the same thing as using the same password everywhere.

    Yeah, they are unique. But if one is broken, they are all essentially broken.

    source

    • blackbirdbiryani@lemmy.world ⁨4⁩ ⁨months⁩ ago

      Only if you’re specifically targeted. I know enough regex to know that nobody is going to bother trying to parse known passwords to identify patterns like that when there’s a billion suckers who use ‘password123’ for their bank accounts.

      As long as the pattern is not super predictable, and aren’t dictionary words, nobody is brute forcing that.

      source

      • subtext@lemmy.world ⁨4⁩ ⁨months⁩ ago

        Even a minute mental load at everything you need to log into in a day is still more than the zero mental load I have when using a password manager.

        It’s not just more secure, it’s far more convenient. Plus once you start to share a life with someone, you can share all your accounts and passwords effortlessly as well.

        source
      • KairuByte@lemmy.dbzer0.com ⁨4⁩ ⁨months⁩ ago

        These would be extremely easy to detect with regex. Just look for the service name in a password, including common keep speak conversion.

        Password123-Facebook then easily becomes Password123-GitHub or Password123-Walgreens.

        I can assure you, if I was a bad actor that got my hands on a password dump, I’m checking for these kinds of passwords pretty early on.

        source