263
Passkeys might really kill passwords
(www.theverge.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 14 Feb 2024
263 points (88.8% liked)
Technology
59419 readers
2897 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
People are making things more complicated than they already are. I simply keep my passwords and passphrases inside my memory.
P.S. My password is not 'Password123456'
There's no way for the average person to keep up with remembering unique, strong passwords for all the sites that require them.
You either have to write it down, save it in a password manager, reuse passwords, or have simplified passwords or patterns.
My vote is password manager. You can use 1 really good password for it and as many stupidly good passwords anywhere else since youre likely auto filling or pasting it in.
Just if your using it locally, remember to take a backup.
You are not supposed to have relation between the words. This password is vulnerable to a dictionary attack. If you are not a high value target you should still be OK.
We're supposed to take security advice from someone for freely gave their password out?
But in all seriousness yes phrases are better. You don't need the money symbol 1234t67890 especially if it makes it harder to remember.
You can even have each phrase be the website. TargetSucksMonkeyDick, BestBuySucksMonkeyDick are secure passwords.
Which is KIND OF ok unless someone looks at a password breech list and figures out your super simple pattern. And I'm sure the rise of AI being used in password breech attacks will just make it more automated.
Real, true, random passwords/tokens is really the only way to actually be safe. Which means you have to use a password generator, AND something to save the password.
Don't simply put the site's name there. Put a similar sounding easy to remember word, a synonym, rhyming slang, the first and last letters of the site's name plus the number of letters in the domain name, whatever.
BestBuySucksMonkeyDick is the password I use on my luggage!
Then one password breech and your password everywhere is exposed to the world. That's bad advice.
Yeah password re-use is the main method of cracking passwords. That obscure site that you think "oh I don't need a good password for this because it's a site I don't care about"? Guess what, they have shitty security practices, and now crackers have access to every site where you've used that same password.
Just use a simple formula to make the passphrase unique to each site. 🤷♂️
Phrases are definitely more memorable than forcing people to use capitals, numbers, symbols, all that shit. But there are just so many passwords to remember.
Passphrases with a simple formula to make them unique for each site.
You just have to remember the formula, you get a strong unique password for each site.
Easy and safe, and doesn't tie you to a single point of failure like a specific device or a password manager.
Add two factor authentication on top (with multiple options, of course, otherwise you'll get locked out once you inevitably lose the second authentication method), and you can even safely use it from third party devices which you don't want to remember how to access your accounts.
Except if your “formula” is to make your passwords
Twit-(password)-ter…it’ll be exceedingly obvious if someone were able to get your password from Twitter and then credential stuff at any other website. That’s not real security.
Also a password manager doesn’t have to be a single point of failure. First of all, they have like 3 or 4 points of failure before they actually lose anything, and you can always make an export or go back to a pen and paper password journal if you really want to to make an offline second point of failure.
Assuming you have a strong base password you aren't concerned with being broken, you can use that, followed by a unique identifier for what you're logging into, so every password is essentially the same, but also unique. Something like, translate the lyrics to a song (say without me by Eminem) to first letters and punctuations, 2tpggrto,rto,rto, and add the identifier.
2tpggrto,rto,rto-goog 2tpggrto,rto,rto-faceb
This is essentially how I manage my passwords that I want to actually remember. Just make sure you're not SUPER obvious with how you make the identifier, perhaps -g0og or -f4c3b0ok. And no, I don't use that song lol.
This is essentially the same thing as using the same password everywhere.
Yeah, they are unique. But if one is broken, they are all essentially broken.
Only if you're specifically targeted. I know enough regex to know that nobody is going to bother trying to parse known passwords to identify patterns like that when there's a billion suckers who use 'password123' for their bank accounts.
As long as the pattern is not super predictable, and aren't dictionary words, nobody is brute forcing that.
Even a minute mental load at everything you need to log into in a day is still more than the zero mental load I have when using a password manager.
It’s not just more secure, it’s far more convenient. Plus once you start to share a life with someone, you can share all your accounts and passwords effortlessly as well.
These would be extremely easy to detect with regex. Just look for the service name in a password, including common leet speak conversion.
Password123-Facebookthen easily becomesPassword123-GitHuborPassword123-Walgreens.I can assure you, if I was a bad actor that got my hands on a password dump, I’m checking for these kinds of passwords pretty early on.
Edit: A word.
How do you remember 70+ different password+username combinations?
Or do you just re-use passwords....
I have a system of pattern for every new password. So I just have to remember the pattern of things (a pseudo algorithm) that I use to generate new password. I won't say that it's uncrackable. But, works for me. And I don't think anyone care enough to go after my passwords.
The problem I have with a system like that is it doesn't account for leaked passwords/data breaches.
When you find one of those services has had a data breach and your password was compromised; you've now gotta adjust your mental algorithm to make an entirely different pattern, either for every site, or you've gotta remember each of the changes you've made for specific sites.
Long term it turns into a mess.
The real solution is to only remember one or two passwords and have widespread oauth adoption. Instead of having to sign up with every possible website and app, I should only need a couple of google/Facebook/apple/steam/github/Amazon/PayPal/whatever.
But we need one that isn't using our logins to track where/what we are doing.