Stop memorizing your passwords.

[terminaltilt@climatejustice.social]

@caten

Technically, yes, you are putting all your eggs into one basket. But right now, if you reuse passwords (which most people do), your "eggs" are scattered in 50 flimsy baskets that all open with the same key. A breach at one becomes a breach at all.

The mitigation for that single point of failure is hardware isolation. I would propose the best solution would be a FIDO2 key (Yubikey/Nitrokey) to protect the vault.

We are basically trading a memory problem for a physical possession problem. Even if the master password is compromised, the vault remains encrypted without the physical token present.

[kontrollierterwahnwitz@sueden.social]

@terminaltilt

a handwritten list in an actual file folder in a heavy vault is decent password management. Proof me wrong.

[caten@mathstodon.xyz]

@terminaltilt I just memorize dozens of completely distinct passwords lol. If people can't handle not reusing the same passwords they're gonna lose that key in no time.

[joernsmock@social.vivaldi.net]

@terminaltilt
> If you can remember your password, it is weak.

No, either my brain is strong or my passwords are memorable (or both).

Password Strength

xkcd (xkcd.com)

[terminaltilt@climatejustice.social]

@kontrollierterWahnwitz

I won't prove you wrong on security. You are right, a piece of paper in a safe has zero digital attack surface. Hackers can't phish a notebook.

But think of security as a triad: confidentiality, integrity, and availability. The password in the safe fails on availability. You can't access your accounts when you aren't home and you can't auto-fill 30+ character random passwords (inturn forces you to use shorter ones).

Paper is the ultimate backup for a Master Key. But for daily use It is a single point of failure that doesn't scale.

[mort@procial.tchncs.de]

@terminaltilt@climatejustice.social @kontrollierterWahnwitz@sueden.social
Now, if I wouldn't have to manually enter (at least twice a day) and regulary change the Windows password, which also includes Azure, OneCloud, ..., "for security reasons"...

[minus9@hachyderm.io]

@terminaltilt Locally encrypted using age https://github.com/FiloSottile/age Encrypted passwords in a local git repo.

[hcf@infosec.exchange]

@caten @terminaltilt yes, but...

That single weak password is only between you and a local app. It never leaves your device (if the app is designed correctly). Even its hash never hits the wild Internet, it might not even exist.

[rdnielsen@floss.social]

@caten @terminaltilt
My passwords are phrases in a language that nobody speaks. They are fairly long, memorable enough, and pretty much immune to dictionary attacks. And also backstopped in a password vault.

[sihaha@norden.social]

@terminaltilt

KeePass-DB in my NextCloud for sync. Secured by password AND local key.