Your password manager is the most sensitive piece of software in your tech stack. It holds everything - your email, banking, work credentials, health records, crypto, and more. Here’s how 12 of the…
Your password manager is the most sensitive piece of software in your tech stack. It holds everything - your email, banking, work credentials, health records, crypto, and more. Here’s how 12 of the…
You remember your master password? Or your singular password you use for all the services and once any internet service gets hashing and salting wrong, or gets compromised like the two or so big internet platform that get breached every year, you want to experience that tingly feeling that all of your digital life could be accessed by some hackers?
Edit: In case it’s the latter and you don’t change your password every week: Try https://haveibeenpwned.com/ enter your eMail address and if it comes up with anything, up your security. At least for the important stuff. It’s worth it.
You should be using multiple passwords and you should be changing them periodically multiple times per years, yes. How many and how often will likely depend on the memorization skills of the individual.
Or on their cleverness. There’s tools to do that job, no effort or memorization needed. And I’d say changing them is further down the list. Makes sense to do it proactively. But it’s the least important thing to do.
Sure, you could also use a nailgun instead of a hammer. That doesn’t mean you need to nor does it invalidate a hammer.
Yeah, though if you re-do your roof, you kinda want to use the nailgun, or your wrist will be sore after two days. Or you’re skipping half the nails to make it work and the next big storm will take away your home.
Skill Issue, I’ve done plenty of roofing jobs. TBH I think the hammer makes more sense there because I find it easier to align the hammer and nail while keeping your body held to the incline.
I’m not going to kill my wrist by typing in my password, either.
I think the issue will be, you’ll likely be using too few passwords because you don’t really use any tool designed for the job. At least your suggestion reads a bit to me like you’re suggesting one nail will hold the roof if it’s a really good one. And that’s doable with bare hands.
And? What next?
The major counter-argument I’ve heard is that passwords can get exposed in leaks, but even if you only have a few passwords the odds of somebody hacking a social media account and then that same password working for your bank is slim to none if you’ve been smart about it AND
as I mentioned
use 2FA but not SMS. Something that really grinds my gears is when services don’t allow you to disable certain 2FA options such as email or SMS, those services are the ones that are actually vulnerable, compared to a non-google auth code generator.
TBH I trust password managers less than I trust these institutions and I don’t trust these institutions AT ALL. If ever somebody finds a vulnerability in the password manages you lose EVERYTHING.
Yeah, what next is either a storm comes and your roof comes off in one piece. Or there’s no storm where you live and you’re fine.
If you make sure to always(!) combine the password with a second factor, you should be safe. It’s usually some relatively secure design. The keys should be locked away in some hardware backed storage. Or at least encrypted by some other password. That’ll be very good protection.
Though I wonder… You probably store your 2FA tokens in some app? What makes you trust that app but not the other one which does the same thing? (Store an authentication factor.) It’s literally the same thing as a password manager. Just that it does some clever trickery so every password is just valid for 30s. And it forces you to have a different authentication token for each service. (Which is a bit like using many different passwords.)
And you’re right of course. Losing a password manager isn’t an option. That’ll compromise everything. And if you forget your master password and didn’t take care of it, you’ll be logged out of your digital life. It needs to to the job properly. I think as of now we have a few options with a pretty much spotless track record. Same for 2FA algorithms. Just phishing is hard either way.