For the critical services, is it safer to have different complex passwords and a password manager or the same password for every service and a two-factor authentication?
The password manager is risky if it gets compromised. On the other hand, is it really unsafe to have a unique password when we use a two-factor authentication? After all, a two-factor authentication is really hard to bypass for the serious websites. We can change this password every 6 months for example. Assuming that having both of them is too much for our use.

  • 2
    What do you mean by double authentication? Do you mean Two-factor authentication?
    – arif
    Jun 19 '17 at 18:11
  • @Muhammad : Yes sorry, that's what I mean.
    – KB303
    Jun 19 '17 at 18:15
  • 1
    The part about same password for multi factor authentication is answered here: security.stackexchange.com/questions/57532/…
    – Limit
    Jun 19 '17 at 18:50
  • OR you could use a password manager AND enable two-factor authentication to get both. Bonus points if your password manager also supports two-factor authentication in some form to unlock.
    – Ben
    Jun 20 '17 at 13:45

According to Edward Snowden,

Shift your thinking from passwords to passphrases

  • Using Passphrase:

    Using passphrase is best practice rather than using passwords. Because password can be guessed or brute-force. But if you like Charles Dickens then your passphrase can be something like this,

    @a@l0v!ng@heart@!s@the@truest@w!sd0m@-by@C.D!ck4fb.c0m @a@l0v!ng@heart@!s@the@truest@w!sd0m@-by@C.D!ck4gma!l.c0m

    Or you can use a specific command you often use like the following as a passphrase,

    $ awk-F":"'{print$1}'/var/log/random|grep'nothing'

    and nobody can possibly guess or (somebody can) brute-force this. You can always develop your own logic for building passphrase.

    If are paranoid like me you can add some randomly generated digits in your password which makes it more difficult to crack.

  • Using Password Manager:

    Using password manager is not a bad idea but not a paranoid idea either. Though nowadays password manager like LastPass/onelogin etc are very secure but not totally unhackable. They can be compromised using a vulnerability (Lastpass vulnerability) or anyhow as I believe any method is compromisable. So I do not trust them neither should you.

  • Two-factor authentication:

    These days most of the application supports two-factor authentication which is good. But if you want to use same password for two factor authentication, I don't think that's a very good idea. You just can add some different words like faceb00k#c0m (for facebook.com), ma!l.g00gle#c0m (for gmail.com) etc. of the same passphrase which will make it different.

  • Changing after 6 months:

    Changing passphrase after 6 months is a very good idea. It reduces the attack surface. Suppose an attacker made some reconnaissance about you on last 6 months and came up with your exact password but when you change it after 6 months, you just nip the efforts of the attacker in the bud.

  • Very interesting. I just find the advice to use the same passphrase with different addings (facebook,gmail,...) very surprising. Indeed, if the passphrase faceb00k#c0m/var/log/random|grep'nothing is discovered, the attack can easily guess that it has been reused with a different beginning on other sites and try. Is it really more secure that having different very complex passwords for every sites with a password manager ?
    – KB303
    Jun 19 '17 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.