> “Years ago, you had one password to keep up with at work,” she said. “Now people are being asked to remember 25 or 30. We haven’t really thought about cybersecurity expanding and what it has done to people.”
So why not switch to using password managers and hardware tokens then?
All credentials under one master password? Single point of failure. You could use more passwords, but we are heading back to square one then.
Next you have to decide where to make your passwords accessible for yourself. Do you also want them on the phone? Because if you don't, it can get kinda inconvenient. On the other hand, I'm quite positive my phone has more exploitable security issues than my laptop. Same for all other devices you might use. What about devices that are shared by other people? You lock yourself out of the things for which you've opted to use the password manager, or you expose it to the security issues on the said devices.
I'd rather just have less stupid passwords to begin with. Why do most stores require an account for me to place an order? Not for my security. Forums, boards, other places.. anonymous posting without accounts works just fine, and there are ways to create a persistent identity for those who want it, without requiring it from everybody. Yet most "social" sites require accounts. Mostly not for my security.
True, that. It seems many sites insist on user accounts more for their benefit than yours - they want your email address so they can nag you towards their "funnels" for further profit opportunities, along with whatever personal and/or demographic information they can scrounge for their analytics, etc. They require you to make an account, not for your security, but merely as a premise to part you with your juicy monetisable data.
And while you are at it, tell them to use a long passphrase as a master password, ignoring upper case, numbers and special characters.
I recommend them to everyone I can but still people are afraid.
At home I have a gpg-encrypted file that's my password manager. I don't particularly trust third party password managers with my roots of trust. :-)
- Be rotated every 90 days
- Can never be re-used
- Be greater than 8 characters
- Be less than 15 characters
- Contain at least one letter
- Contain at least one number
- Contain at least one special character
- Cannot contain the same character more than three times in a row
- Cannot contain any piece of the username anywhere in the password
- Must have a gematria value that is divisible by 12.
- Cannot contain an even number of consonants or vowels in months of Saturn ascending
- Have paste disabled so you need to type it.
- Disable the password manager in your browser.