Hacker News Reader

Comment by t-3 | Hacker News Reader

It's a convenience vs. security tradeoff. The fact is, most people can afford to adopt a flawed security model to give themselves greater convenience, because most people aren't being specifically targeted and attacked. I doubt many people realize that they are making such a tradeoff, but that's more about dishonest advertising...

View on HN

It's less flawed than relying on a low-strength memorable password that's reused across all services. Having a uniquely generated, random password for each service that gets autofilled by the password manager is much more secure.

I guess password managers seem like one of those few decisions that made my life both more convenient and more secure (after the initial adoption).

Out of curiosity, what could one use instead of a password manager that would be closer to the “more secure” side of things in your opinion?

> what could one use instead of a password manager

The comment you're replying to mentions "dishonest advertising", which suggests "password manager service".

I'd think using e.g. KeepassXC would be more secure (but less convenient) than this, since I manage where the password database is stored/accessed.

You could use a different password for each service and just write them in a paper notebook.

Paper is generally not susceptible to malware or other ways passwords can leak from a local or hosted password manager.

But now your password manager (notebook) is vulnerable to fire and water damage, with no backup or recovery options.

And also if you ever need to access anything on-the-go, you either can't or have to keep the notebook with you and make it susceptible to the things you mentioned + theft or snooping.

I use a copy machine to back up my password list. The pages go in my fire safe with other important papers, and a second copy off-site.

I guess you could just take pictures of the pages and save them to a thumbdrive or an SDcard, but I prefer the lower-tech solution.

You can't possibly believe that this is a viable alternative.

For some people (when paired with storing the notebook in a physical safe), it is. My parents were using Lastpass but somehow managed to lock themselves out completely and none of the recovery options worked.

For their use case and technical skill, a safely-stored notepad is best.

Reply on news.ycombinator.com