Hacker News Reader

Comment by x1798DE | Hacker News Reader

You really shouldn't be re-using passwords across sites anyway, since all your accounts are compromised if any of them are compromised. Since re-using passwords is a problem solved by using a password manager, I'm assuming you're not using one, in which case you likely won't even remember the list of sites where you have accounts that have a shared password if you need to change it when any of the other sites are compromised.

Best to just use a password manager and keep unique per-site passwords.

View on HN

I'm quite hesitant towards using a password manager. All secrets are protected by only one single password, and to make the tool useful, it should be accessible from anywhere and I would use it quite often too, increasing the limit of my master PW being stolen (whatever way, keyloggers, shoulder surfers, cameras...). Thus, I rather memorize a handful of unique high-security passwords for important services and one or two low-security ones for all the rest I don't care about.

Of course, it's a different situation when e.g. managing many sensitive servers which you only access from work or so.

All secrets are protected by only one single password, and to make the tool useful, it should be accessible from anywhere and I would use it quite often too, increasing the limit of my master PW being stolen (whatever way, keyloggers, shoulder surfers, cameras...)

True, though your handful of passwords can be stolen in the same way.

With a password manager, you:

- ensure your master password is not transmitted over a network

- ensure you never reuse passwords

- ensure you have long, strong passwords everywhere

- never forget login details and never worry about remembering yet another password

On the other hand,

- you _need_ access your password manager in order to login

- you now have a single point of failure

- cloud-based password managers are very attractive targets for hackers

I don't like these aspects of it.

Still, a password manger is incredibly convenient and I do feel a greater sense of security/confidence when I copy a big old 64 character password to log in. As it is, I use so many different services (gmail, github, slack, aws, steam, dropbox, reddit, etc, etc) and that number is only going to increase. I think a password manager is a practical, scalable solution to both remembering login information and improving my security.

The security process that has really worked for me is using the "forget password" as means to get a "login token" into my mail, which is protected with 2-factor auth.

I don't have to deal with password managers, maintaining their files. Or deal with multiple passwords.

Most of my accounts use my low-security password, I don't care much if they all get compromised. I only use my high-security password on 1 site.

Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

> Password managers are horrible - Whenever I change machines, I could never remember all my passwords and I certainly don't want to store my passwords in the cloud.

1Password can sync locally which is a nice plus:

https://support.1password.com/wlan-server/

> I certainly don't want to store my passwords in the cloud

But you're not. You're storing an encrypted blob in the cloud. You just need a good master password and a password manager that isn't broken.

I wonder why people still think that their passwords are stored on the external site. It's explained on the "how this works" or whatever for most services like LastPass.

Why not use a password manager on a USB stick?

Reply on news.ycombinator.com