Every time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit random string.
But in exchange, my security answers are no longer compromisable online. I think overall it’s a positive trade off, but that’s just my hunch.
KeepassXC already has this feature [1][2]. It can also store and generate OTP codes and works with YubiKeys (similar to Bitwarden Premium).
There's also a popular Python script called xkcdpass [3] which does the same from the command-line.
[1] https://keepassxc.org/images/screenshots/windows/screen_006....
In practice, I’ve never actually had to quote such a string to anything but a machine, so it is mere optimism on my part.
"That's correct, my childhood pet's name was 1xs3^&szx!@!24"
If the attacker knows it looks like gibberish, they can try "Heh, whoops, I just put in random characters at the time. Can we try something else?"
I think a false, convincing, and unlikely answer is reasonable. "My childhood dog's name was Alexander Hamilton."
The passwords weren't horrible, brute-forcing them would have taken a while, but if you have the same user name and password in many services, then it just takes for one of those services to get compromised to have many of your accounts be compromisable.
And generally speaking, unless you're a high-ranking target, it's far more likely for a service to get compromised than for someone to even bother attacking your device.
And yeah, sure, I could have just remembered more different passwords and user names, but I'm a human and that requires effort.
Now when using a password manager, I can easily choose different user names, e-mail addresses, passwords and far more complicated passwords as well. And all of that with basically no effort.
This also improves privacy, as with different user names it's much harder to link up my different accounts' postings. And I can now easily maintain multiple accounts for the same service, too, allowing me to spread out postings across those, so that you can't follow back my post history for all eternity to link up all kinds of information that I've posted over time.
I have to use HUNDREDS of passwords every few weeks. HUNDREDS! Some for work, some for personal. Occasionally a service gets broken into so I can't have all of them be the same password and I can't have a system where I add, say "FB" to the end of the password to denote a service as that makes it pretty vulnerable.
So I am forced to use a password manager. I hate it and I'm terrified it'll get broken into one day. But what alternative do I have? I enable 2 auth on everything that I can but those are a very, very small handful compared to all of the usernames and passwords I have to use.
How do you not use a password manager is my question.
I only have internet banking enabled for my secondary account (which has 2fa) which never has more than £100 in it and I only did that so I could xfer money to my p2p account.
Yes, that makes the physical devices a vulnerability, but the attacker would still need to guess or brute-force the master password to decrypt the vault. It's also a much less juicy target than a million customers of a cloud service.
And as someone else pointed out, using the same password everywhere is a non-starter. Nor is memorizing the passwords for more than a tiny fraction of the roughly 1000 entries in my password manager.
Birth city: Octopus Mainframe Z7X
"No thanks, that information is private and I'd rather not share it over the phone. I know, you're probably going to say that you can't help me without this information and you're doing this to help prevent identity theft but I stand by my choice to not partake in answering your question. Can I speak with a manager?"
That should make for a fun conversation.