At the risk of going a bit on a tangent, what password manager would you recommend for my grandma?
It’s not as good as, say, 1Password but it’s more likely to get used. Combine it with the browser or OS level password manager. It’s good enough for grandma, definitely better than “kitten4” that she’s currently using everywhere.
On a tangent, stereotyping this as “grandma” is a bit unfair. Most of my colleagues are college educated males in their 20s, some of them developers. And their passwords are rubbish, with no password manager, and no 2fa.
(And re: the grandma thing: it's nothing specific to grandmas, it's because the moment you suggest your audience is "college educated developers in their twenties" as in your case, people throw the notion of UI/UX out the window and recommend you suggest they compile their own kernel first. It seems you just can't win.)
For most people, writing (good and unique) passwords down in a notepad is a way more secure system than having the same bad password for every account.
Having a botnet guessing the random "kitten4" password for a random user account, is as likely as having your purse stolen for the passwords on that note. FWIW "m" is almost a secure password on a root account with an SSH that allows password authentication, even if you allow brute force attacks. Imperically speaking, obvisouly it's going to fail in the end but I hope you get my drift.
This is very counter-intuitive. Is the idea that guessing both the username and the password together is much harder than guessing the password when you already know the username?
In the kitten4 example, I would guess most botnets are working from a list of usernames/email addresses that they got from leaks.
> Is the idea that guessing both the username and the password together is much harder than guessing the password when you already know the username?
No, to be clearer no one in the last 6 years has ever tried "m" as a password on my root accounts.
I feel very strongly that there is too much stigma around passwords, kitten4 is a nice password if you use it only once.
I can assure you that the average user wouldn't get above 15 - 20 bits with self selected words. That's often worse than most current passwords.
That's what my grandpa does. After failing to find his gmail address in it, he went through the "forgotten password" process. Then, after needing it the third time, we found the old password in the notebook, which was now wrong...
Is she a Visual Studio Code developer? Does she need to manage Docker containers?
Security does require new hardware because iOS is leaps-and-bounds better than any other system.
There is no other option. Nothing else comes close.
Were you expecting security in broken systems like Android? Instead of forcing security onto a broken system, just avoid that system?
The fist step of security: stop using Android.
And you haven't explained why your grandma is tied to an ecosystem. I'm honestly asking if she's a developer or not?
What is her use case? Why does she need to be on a specific platform?
(Wouldn't the question only make much sense in just one of those cases...? Not sure if I'm missing anything.)
If you're on Android, Keepass2Android [1] is an excellent app that implements the input with a special keyboard. This avoids risking your password via the clipboard. It even comes with a no-network-permission version!
[1] https://play.google.com/store/apps/details?id=keepass2androi...
I tried using Google Drive to sync it up, but Drive is useless for this - it doesn't open the file using the right intent on Android ("file type not recognised" or something similar it says, this used to work as well) and the Drive website makes it a pain to upload an updated file even from the desktop using Chrome.
In my case, I use KeePass 2 and KeePass2Android with Google Sync and it works decently well (I would recommend you try this). I would never recommend it to non-technically-minded folks though.
Sync looks to be for Google-domains/business only. In fact Wikipedia says it has been discontinued! I used to sync over owncloud and that worked pretty well, but the provider shut down and I haven't gotten round to setting another up.