It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can't remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn't tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don't just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They're not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser's password storage is better than nothing. Don't reuse passwords, use long randomly generated ones.
It's free, it's convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I'm preaching to the choir, but if even one of you decides to use a password manager after this then it's an easy win.
Please, don't wait. If you aren't using a password manager right now, take a few minutes. You'll thank yourself later.
I don't even understand why I need to make a password for some sites anymore. They send a code to my phone everytime.to make.sure it's me so it seems like there's practically no point.
2FA really stands for
2 FUCKING ANNOYING !!!
Do you not understand how much 2FA helps you? That shit is cash money.
I don't think 2FA being effective needs to be mutually exclusive with being "fucking annoying" -It is a security measure after all, and the one thing security measures never are is convenient.
I mean, using password managers is both more convenient and more secure than 99% of things most user do to handle passwords so idk.
And some like Proton Pass also double as 2FA apps and make that trivially easy too by autofilling everything with a click
Good point. I guess it’s never really bothered me. It’s one of those things I’ve just come to expect nowadays.
I stand by it being cash money though. lmao
I've got a random username if the stupid website/app allows it. Most don't. It has to be your email address.
And a minimum random 20 char password for each website/app. Again if the stupid website/app allows it.
Secure your (I don't mean you personally) fucking website/app and credentials storage and stop making your weaknesses my problem.
Most places, and all of my stupid financial websites/apps, only have phone/SMS as the second factor. And yet there are plenty of horror stories about people 'losing' their phone numbers.
Oh wait. There is one financial site that has developed its own authenticator app. I really expect that to go about as well as storing passwords in cleartext.
Then there's all the shit websites/apps that I don't give a fuck about that now insist on having 2FA set up. They're not interested in the security, it's just to get your email and phone number to onsell your data to whoever.
It's fucking security theater.
“Then there's all the shit websites/apps that I don't give a fuck about that now insist on having 2FA set up. They're not interested in the security, it's just to get your email and phone number to onsell your data to whoever.”
Of everything you wrote, this one had my eyes wide. Hadn’t even crossed my mind that could be a problem. 🤦🏽♂️
It doesn't help everyone equally. It assumes you (a) re-use passwords, (b) don't protect them properly. That's the case for most people but not all.
It’s also a protection against people who get their hands on your credentials though. You don’t really have any control over a server with your data on it getting compromised, right?
If the password is unique, there's no risk!
Incidentally: not re-using passwords should be the only responsibility of the user. It's impossible to brute-force a password through a login form, you need full access to the disk. So when sites complain about poor password strength, effectively they are saying "We don't trust ourselves to keep our server safe". Pretty insulting to blame the user for that.
Hmm. Maybe I’m misunderstanding something fundamental about cyber security, but wouldn’t a server leak give you login credentials regardless of the uniqueness or amount of use a password has? And 2FA would still protect against that?
I might have thrown my hat into a ring I have no place in lmao
Unless the website is handled by complete morons it stores credentials in an hashed format. Usually to crack this we'd use rainbow tables or wordlists of known passwords, and essentially we use every word to generate the hash until it matches.
If your password is strong and hasn't been compromised (check regularly on haveibeenpwned) it will likely not be in any wordlists and it also won't be easy to crack. Now, password managers can generate the best passwords because they're completely random and very long by default so to crack them you'd have to try every possible character combination, this takes time, and specifically a time so long that statistically the andromeda galaxy and milky way will merge into one before the password is cracked (at least until quantum computers become a thing, then it's mere minutes).
2FA helps because even if they crack the password they then need the 2FA code, which you can't really guess or brute force and is seen on a third party app you don't control (unless you use sms, they can spoof SIMs ro view the sms you receive and therefore degeat 2FA). It also doubles as something that alerts you that someone is trying to access your account.
Yes this clarifies things. In summary, without 2FA:
So it's a trade-off. If everyone was in the first category, then the obvious inconvenience of 2FA would just not be worth the benefit.
Absolutely not. You should always use 2FA. Most decent password managers even make it easy for you.
While cracking a strong password is nigh impossible rn they are still vulnerable to data breaches and pass-the-hash attacks.
Literally "always", like every single time you open a website or app? No password manager can make SMS 2FA not a PITA. As for your second point, I addressed that. What if you literally don't care about keeping data in question private? Individuals have different threat models, different priorities and all of this is a trade-off. It's not absolute. That's all I was saying. Anyway, I'm done here.
2FA should always be enabled. Doesn't mean you always have to log out of a website. It's a massive important security feature: it saves your ass if your passwords are leaked/cracked/bypassed and it warns you that someone is trying to access your account. Apps like ProtonPass literally make it extremely trivial to fill it in, just push the button that pops up and it will autofill the 6 digit code (or copy it to your clipboard in the worst case), it's not SMS 2FA, so you're frankly stupid for not using it if you have that option.
You didn't address shit, strong passwords will still be vulnerable to certain attacks even if everyone used them. This isn't a privacy matter either it's a security one and regardless of what your threat model is 2FA should always be part of your security, there's a reason more and more websites and apps are pushing it, cause if you don't force idiots to adopt it they won't even if it's extremely important, same reason as why we need rules to make passwords more complicated. It may be an inconvenience (very tragic for the user I know, how dare they make something that autofills and takes a few seconds of my day away from watching useful shit like brainrot and some dumb comments on my favorite social media platform) but it's an extremely important and necessary measure.
Because different layers protect you against different things. It's like how you have anti-lock brakes, a seatbelt, an airbag, and crumple zones on your car. You don't just have one thing to protect you.
Password is necessary for two-factor authentication. The factors of authentication are something you know (like a password), something you have (like a cell phone), and something you are (like a biometric).
An example of three-factor authentication would be this—imagine a spy going into a secret bunker. They need to scan their iris, insert a key card, and then enter a passcode before the door opens. This has all three factors of authentication; the passcode is something they know, the key card is something they have, the iris scan is something they are.
If it just sends a code to your phone, that's one-factor authentication (something you have). Anyone with your phone can get into your account. Unless, of course, your phone hides its notifications and you have a screen lock. Then that's actually two-factor authentication because you also need to know the phone PIN or have the biometric.
If it just asks for a password, that's one-factor authentication (something you know).
If it asks for your password and then sends a code to your phone, which you need a fingerprint or face scan to unlock, you have achieved three-factor authentication.
Edit: Interesting tidbit—in the USA, you can rent a mailbox at the post office to receive mail when you don't want to give out your real address. Useful for privacy reasons. I'm sure they have similar things in other countries. These mailboxes come with a key. This is actually two-factor authentication, because the keys usually don't have the mailbox number written on them! So you have to have the key and also have to know which mailbox among the hundreds at the post office it opens.
Wow, the PO Box analogy is the best, most simple way I've ever seen anyone explain 2FA. Thanks, I'm stealing that for when I need to explain it to my tech-illiterate family members for the umpteen millionth time :')