Hacker News Reader

Comment by Orangeair | Hacker News Reader

I would love to switch to a different password manager, but nothing else I've tried has quite managed to nail the usability aspect. Specifically, Lastpass's app fill functionality on Android is a huge benefit that I haven't seen in others. It also has a browser extension that works without a separate program running on your computer; I didn't even realize that was a plus until I started trying to use other apps that did that.

I guess for now I'll just turn off all of the automatic features like this I can find.

View on HN

Usability is great, but we're talking about our passwords. Security needs to be put ahead of usability in this case.

If you can get both that's great, but poor usability beats having your banking and systems owned.

It's still more secure than not using a password manager. And I've found that whenever I'm in a situation where I can't use lastpass for whatever reason, I just fall back to using a password I've used many times before. Anything else I would just immediately forget.

Why would people put their bank and other important passwords like this in a password manager?

I use lastpass for over 5 years and I memorize my lastpass and my bank account passwords.

Why wouldn't the average user? The entire idea is that you'll just have to remember two passwords: your computer account, and your password manager. At least for most users, the idea that some password shouldn't be stored just opens the door to bad practices and password reuse.

For someone working on a password manager, I think the default assumption has to be that a screwup on your part will--literally--impact pretty much every aspect of a user's life. You can't assume that some passwords won't be stored.

Well my wife believes that reusing the same password with variations is more secure then a password manager. Most average users distrust a manager and won't use it.

And my imaginary uncle believes that locks attract burglars ...

My email accounts' passwords are far more important than that of my bank account, and there's no way I could put up with typing them in every 15 minutes.

On top of that, chances are that a bank login saved in a password database, which has 2FA and other sensible precautions, is probably kept safer for any one individual than the bank's systems themselves, what with the huge legacy cruft they suffer from. No-one would be able to walk into my computer, or call it, with some faked documents and social engineer themselves into my password database.

Uh, because otherwise my bank account password would be the equivalent of 1234abcd. That's what my password basically way prior to using a password manager. Now my bank password is the maximum length allowed and is what is basically a random mix of upper lower case letters, numbers, special characters.

After reading this I'm seriously considering dropping my password manager and going back to something I can remember and type in in a reasonable amount of time like 1234abcd.

I hope the new Auto Fill API [0] in Android O will make it a lot easier for other apps to add this feature.

[0] https://developer.android.com/preview/features/autofill.html

Reply on news.ycombinator.com