Hacker News Reader

Comment by xbryanx | Hacker News Reader

It's always worth remembering that using something like LastPass should be compared with the status quo that it often fixes (same password for everything, post-it notes, teams emailing passwords around).

View on HN

Sure. Which is why Last Pass makes you safer if you use it for the long tail of rarely used non-critical passwords. The problem is once you are using Last Pass for those, it becomes more and more tempting to use it for passwords that actually matter, and for those you really really don't want to be using an online password manager.

In fact, for the average person, I am not sure a post-it note full of passwords in their home is a bigger risk than an online password manager. Sure, if someone breaks into their house they are screwed, and that is a relatively easy attack. But on the other hand, any bulk breach leaves them unaffected. A notebook full of plain text passwords in a drawer in your home and a shared memorized prefix that must be combined with the passwords on the list to get the full password seems strictly more secure than a password manager (although slightly less convenient).

> A notebook full of plain text passwords in a drawer in your home and a shared memorized prefix that must be combined with the passwords on the list to get the full password seems strictly more secure than a password manager (although slightly less convenient).

This actually sounds pretty good; I might start recommending this to non-technical friends and family.

EDIT: phone auto-completed "non-technical" to "non-profit technical"

Why is that a relevant comparison for anyone interested in their own security? It seems to me that the comparison that matters is with my own status quo and with other options that I might consider, not with some average status quo.

Reply on news.ycombinator.com