Hacker News Reader

Comment by BiteCode_dev | Hacker News Reader

Agreed.

I introduced several times password managers to my friends and family, and more often than not, it was a disaster.

Because eventually, either they set a very simple master password they reused elsewhere, defeating the entire purpose of the whole exercise, or they lost the master password.

The latter meant they lost a lot of accesses (unless they have backup discipline, which of course they can't have by nature) because there is no recovery.

So the alternative was for me to hold the backup passwords or recovery passphrase/seed. So much for making them independent.

Bottom lines: security sucks and ergonomics sucks because most users are not tech saavy enough to handle complicated cases.

Making E2EE even an option is nice, and the best you can do for now.

View on HN

> they lose the master password

The threat model for every lambda user having a password manager does not cover breaking and entering[0]: they should write down their master password and keep it at home in their bedroom drawer.

Use biometrics where possible (e.g. bitwarden on Android has that option)

[0] maybe it does for you, working on some DoD-confidential docs, but your computer-illiterate aunt doesn't.

I did that for my mother.

She lost it anyway. TWICE.

As for bio-metrics they are not possible on all devices, and some software will require you to enter the master password once in a while even if it's activated.

But even if it was not the case, if you loose your device, you need to setup the new one, and for that, you need the master password or have backups.

Back to square one.

I've given some family members small paper pads and encouraged them to write down important passwords, and keep them in their home office. This way they can at least have a chance with semi-reasonable unique passwords, vs falling back to using the same trivial password for everything, and still needing to reset it twice a year ...

For the few keys I need to remember (external drive bitlocker key, windows password, etc) I do reuse a few passwords but I used passwords that have never been used on the internet, so I should be preventing the password reuse risk from breaches. Is there something I’m missing in this strategy?

Depends of what problem you are trying to prevent.

If you are trying to prevent most attacks from the internet, this is perfectly fine.

If you are trying to prevent a close person to gain access to your whole system, this could be improved.

Yeah my concern is theft or hacking more so than evil maid. I’ll keep it in mind if that changes.

The way I've done it with close family is that I kept a copy of their master password in my own vault (or the shared family one) to remind them when they inevitably forgot.

It's not ideal, but it's better than the alternative of them reusing extremely easy to guess passwords.

Reply on news.ycombinator.com