Hacker News Reader

Comment by OskarS | Hacker News Reader

If you ever reuse that password anywhere else, then you should care A LOT. If you go "i only reuse passwords on low-consequence sites", then I have to ask you 1) why reuse at all? and 2) are you sure? I bet that that's not true, I bet you think that's true but it turns out that your Uber password is the same as your RandomSite password.

Just use a password manager. It's easier and it's safer, and you never have to think "is this a low consequence site?" ever again, because you'll have high quality passwords everywhere. It's really the only way to be sure you have unique and strong passwords everywhere.

View on HN

Yeah I do this. I also work in security.

>why reuse at all?

Because it's easy. There's many sites I create an account for once or twice and I never use again, mainly e-commerce. I don't care if someone logs in, at best they get an address and maybe a few card details. That's all practically public information.

>are you sure? I bet that that's not true

Yup, 100%. And even if a few get missed, anything super important has 2fa, on top of using semi-unique passwords that adhere to a format so I can guess them in <5 attempts if I don't have my password manager on hand. And I check them semi-frequently in haveibeenpwned.

>Just use a password manager.

I agree this is good advice in general but even with decently designed password managers, like dashlane and lastpass, people often don't like to use them for various reasons. My parents get confused by new software. I tell them "use a very strong password for google, amazon, ebay etc, and if any other site asks you for a password use a weaker one". If they used a password manager I guarantee they'd get overwhelmed when it comes to using it on different devices and give up, reverting to worse security than before.

Also in the end, people are astronomically more likely to fall for phishing emails than be the victim of a security breach from password re-use. Seriously the whole "use a password manager with a RNG upper/lower/symbol/number combination" trend is overhyped and honestly a distraction from more pressing security issues. Google estimated phishing victims are 400x more likely to have their accounts compromised than anything else[1]. And as someone who is currently dealing 90% with phishing attacks over any kind of password related incidents I'm very inclined to agree. If you're a public figure and therefore an actual individual target for motivated attackers then yes, use RNG passwords and a password manager with 2fa and only ever store the db on a memory stick which you keep on a chain around your neck, otherwise it's not really necessary.

[1] https://www.bleepingcomputer.com/news/security/google-ranks-...

I got into the habit of using a separate password for each site I use, except for the throwaway sites.

I have a method I use regardless if 2fa is an option or not.

I have a fairly secure password that I have memorized. Then for each site I pick something about it that I can remember to add on to the password.

For example if my current ebay password is: Pa$$w0rd the new one would be: Pa$$w0rdEb or EbPa$$w0rd Amazon would be: Pa$$w0rdam

That has helped a few people I know keep separate passwords for each site without having to go through a password manager. YMMV of course.

The way I look at it is if the sites DB gets dumped, at least the scripts will fail using the password on other sites, even if it's not the most secure password.

You're point about the phishing e-mails is spot on though. No amount of secure passwords will stop that

Exactly!! I have a scheme like this but more convoluted, low/medium/high consequence sites, different random 'main chunks' that I can remember, and a quasi-methodical per-site head/mid/tail chunk that is related to each site.

Never found any of even the main chunks in the PW lists, but I'm sometimes forced into stupid PWs by stupid rules as in above comments.

Unfortunately, OSs don't make it easy to use password managers, especially in mobile. A lot of my banking sites also defeat my password manager with bizarre UX like user name masking and multi step login screens.

I use keypassx on Mac, Windows, and Android. It is a minor pain to have to log into it to grab my username and password, but worth it. I sync the encrypted DB with Dropbox.

Or by disabling automated entry, or with disabling the password field until the username field is filled.

Reply on news.ycombinator.com