Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't think this is true. That just seems like marketing spin for your average consumer who doesn't understand security.

The main motivation is having a different password per service. So if your password is compromised in one place, you're not universally compromised.



> The main motivation is having a different password per service. So if your password is compromised in one place, you're not universally compromised.

Yes, exactly. But how many logins does the average user have? Dozens at least. What's a secure password? 12+ elements (alphanumeric and specials). That is impossible to keep in your head. The only way the average person can make use of complex, secure passwords is by having a single one and reusing that. This is where password managers come into play. You simply create unique passwords, with strong security to each. Again, these will be impossible to remember. So the entire point of passphrases is moot: you are not supposed to remember them, let alone know them. Yes, not even know them. It's the password manager's job!

The only exception (I know of) is passwords that need to be entered regularly, offline, like the operating system's login screen. Those better be passphrases: they can be remembered, but can also be made secure enough by modern standards. The master password to my password manager is such a passphrase, with some modifications. So is the login to my AD user (here, and only here, I used the passphrase generator). That's it. The rest are very long, randomly generated passwords (not phrases), of which I know none.

This is, to my knowledge, the "idiomatic" and "correct" way of using password managers today.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: