I just got married, and my wife and I are in the midst of combining finances, etc.

We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character password with LastPass.

No, don't do that! How can I access it if you use LastPass? Just make it something simple to remember!

We compromised on that one - I generated a password that we both agreed on that's reasonably long with a mix of characters, and yet it's something that she can remember off the top of her head. (Never mind that with LastPass you can share passwords to various accounts, without either person actually even knowing the password!)

My wife definitely fits into the "average user" category as opposed to the "power user" category. I've been able to convince her to turn on two-factor auth whenever possible, but for the most part she is unwilling to trade convenience for security.

Obviously, it doesn't need to be this way. I use LastPass religiously, and she sees me use it regularly to generate and use passwords. I'm in her ear fairly regularly about the importance of password security (see various institutions getting hacked - which I don't really believe were anything sophisticated, just poor IT infrastructure because of management thinking IT is not "value-added"), etc. She (and a lot of my other friends) are quite content with having the standard 4 passwords for all their websites. They don't really see what the point is of having more difficult passwords. For my wife, it's "I'll set up LastPass some other time, it's not really that important anyway." I think everyone on this SE would think that it truly is that important.

I really don't understand what the hang-up is with using a password manager, but then again it's so obvious to me why nobody should leave home without one. How can we computer-savvy folks educate/convince/etc the non-computer-savvy ones we care about to take their own security seriously?

  • 5
    You don't use a password manager because unless you have it with you all the time, there's a likelihood all your passwords will be compromised. On the other hand, if you have some kind of mnemonic that you can use, then you'll store all the passwords in your head.
    – munchkin
    Commented Apr 28, 2015 at 4:36
  • 1
    You need to scare her straight. Maybe start with some popular articles about horrible password choices. I googled for this one (I'm sure you can find scarier ones out there): gizmodo.com/…
    – hft
    Commented Apr 28, 2015 at 4:51
  • I now think the OP is ambiguous: Is this the online version of LastPass or the downloadable program?
    – user49075
    Commented Apr 28, 2015 at 6:39
  • 1
    @hft and if she has slightly better passwords she'll take this as confirmation that she does not need to change them, since she's not at risk. Truth is she's more at risk of passwords being incorrectly hashed by service providers than at risk of choosing too poor passwords so long as she doesn't pick stuff like "monkey" or "123456". Commented Apr 28, 2015 at 8:31
  • @RickyDemer I'm referring to the online version of LastPass, but it really doesn't matter for this discussion.
    – Dang Khoa
    Commented Apr 28, 2015 at 20:11

4 Answers 4


Your wife is not using LastPass because she has better things to do, not because she's incapable of realising its utility.

You would think that once people properly understand the risks they're exposed to (which requires a serious amount of education), they would automatically start to comply with whatever security advice is thrown their way. Well, this assumption has been proven wrong multiple times. See Herley's 'So long and no thanks for the externalities', which has a couple of examples of wasteful security, and Beautement and Sasse's 'Compliance Budget' for a general theory of how humans behave with regard to security.

In economics of information security, there are several examples of people willingly taking risks because it saves time they need for other tasks, or because they perceive potentially negative side-effects to complying (such as being locked out, or embarrassed in front of someone else).

Hence, rather than insisting on your wife doing what you think is good for her, identify her needs, her priorities, her worries and her actual problems. Then, deploy a tool that does work for her (if there's any) and work with her to make sure she knows how to use it and perceives its utility and limitations properly.

For instance, I don't use password managers because I use some of my accounts on so many devices that I have to know the passwords, because I have some passwords that have to comply to such silly policies and be changed every other day (and I hate having to resync my passwords on each device), I don't trust online password stores the least in the world, and because some of my devices are targeted often enough that I don't want them storing many passwords. Most of these problems I have are probably addressable one way or another, but I don't want to lose a day of work setting up processes that go against my habits. And yet, I'm a security engineer. In conclusion, most users will prefer appropriateness and value to security in most decision-making situations.

  • Selfishly, when it comes to joint accounts I really must insist on quality passwords. It seems kind of cold, but if something would be compromised I would rather it not be against something that would take us both down.
    – Dang Khoa
    Commented Apr 28, 2015 at 20:12
  • Then, choose your bank wisely and use two-factor authentication, or better yet, don't put all your money in the same bank! In any case, antagonising your wife by imposing on her your password choices is probably not your most effective path to good security! People tend to not comply to unusable policies, even when they want to stay secure. Commented Apr 28, 2015 at 20:26

Like many of the above I also recommend the use of stories and fear!

In particular you need to explain WHY its so bad to have the same password across different websites, as perhaps she doesn't understand the problem with this. I find this is often the case with those outside of the IT industry. They see it as just a best practice suggestion and maybe even paranoid.

You need to remind her about all the recent password leaks, which I'm sure she has heard about, ideally taking the example of a service she might actually have used. You explain that this means there might be databases on the dark web with her passwords from say LinkedIn, Yahoo, Marriott etc. If she uses the same password for banking, amazon, pizza delivery, uber etc. then a hacker can log onto those websites trying the password they stole from elsewhere and order services fraudulently on her account.

A really good way to demonstrate this is to check her email or even her passwords on https://haveibeenpwned.com/ I find that is really effective in convincing people!


Your problem is more a question of awareness and practice. The fact that as security specialists, we take our job very seriously (which is the right thing) and "expect" others to take security seriously as well. Since you are more closer to the world of the "bad cyberspace", you are well aware of the controls that need to be kept in place to prevent them. Your better half on the other hand isn't that aware of the effects that bad security practices have. I have the following suggestions for you:

  • Since you both have agreed on a password, let it be. Be sure to change it every 90 days. You can rotate a few characters/words/numbers/specials here and there and keep the basic outline the same. I am sure any reasonable person will agree on it. :D
  • I believe that information security is more in control of the "user" than in the "mechanisms".
  • Using Password Managers is, as you rightly said, more of a "power user" thing. The "average user" sees it as uncomfortable and more of a hassle rather than "something to keep them safe". Respect that fact. I'm sure in your long and happy years of marriage, she will become a "power user" too. :)

Hope it helps. And congratulations. :)

  • Changing your bank password every 90 days, reasonable? As long as it's not obviously bad, your bank would probably be liable for any unauthorised transfers from your account in many countries. And it'd probably be insured against that. Also, you might be unaware that some banks have excruciating processes in place for when users forget their passwords. I had to fly to another country to retrieve one of my bank accounts after the Shellshock panic, and ended up closing the account. Commented Apr 28, 2015 at 8:28
  • My colleagues had one participant who also closed her account because the authentication was too cumbersome (internetsociety.org/sites/default/files/01_1_4.pdf) Commented Apr 28, 2015 at 8:29
  • @SteveDL: I think it's reasonable. As long as the outline remains same, it shouldn't be an issue. Besides, forgetting passwords is a residual risk that one has to deal with. They can agree on "changing passwords regularly" as the basic security practice. :) Commented Apr 28, 2015 at 8:54
  • Actually, one of the difficulties of password authentication factor recall is what's called interference. The more similar-but-slightly-different passwords you'll have, the harder it'll be to remember which is correct/current. People often end up switching a single character or incrementing a number, which is so predictable it defeats the purpose of password changing. So you should go for a completely different password, both to avoid interference and because otherwise the ROI of change is negligible. If you do that for all email/bank accounts it starts being a strain. Commented Apr 28, 2015 at 10:31
  • Since you're likely to have insurance / second lines of defence (e.g. 2FA for transfers, risk assessments or extra procedures for transferring to new accounts) for banks that don't make you (the user) liable for defects, you're better off concentrating your compliance budget exclusively on your email accounts. Commented Apr 28, 2015 at 10:32


Yes it sound awful, but it's really the same thing that makes you choose strong passwords. Fear of someone stealing your money from your bank, fear of someonce accessing your private emails, etc.
It's not truly insane to want to educate her about her short-sightedness (no offence intended, but let's call it what it is).

You should probably mention how easily guessable passwords are. Articles of people with whom she can relate (eg: middle class, not-into-anything-obscure married wives) losing sensitive information/their-lives-photos/savings, etc will probably help her rethink her stance a bit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .