7

I just got married, and my wife and I are in the midst of combining finances, etc.

We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character password with LastPass.

No, don't do that! How can I access it if you use LastPass? Just make it something simple to remember!

We compromised on that one - I generated a password that we both agreed on that's reasonably long with a mix of characters, and yet it's something that she can remember off the top of her head. (Never mind that with LastPass you can share passwords to various accounts, without either person actually even knowing the password!)

My wife definitely fits into the "average user" category as opposed to the "power user" category. I've been able to convince her to turn on two-factor auth whenever possible, but for the most part she is unwilling to trade convenience for security.

Obviously, it doesn't need to be this way. I use LastPass religiously, and she sees me use it regularly to generate and use passwords. I'm in her ear fairly regularly about the importance of password security (see various institutions getting hacked - which I don't really believe were anything sophisticated, just poor IT infrastructure because of management thinking IT is not "value-added"), etc. She (and a lot of my other friends) are quite content with having the standard 4 passwords for all their websites. They don't really see what the point is of having more difficult passwords. For my wife, it's "I'll set up LastPass some other time, it's not really that important anyway." I think everyone on this SE would think that it truly is that important.

I really don't understand what the hang-up is with using a password manager, but then again it's so obvious to me why nobody should leave home without one. How can we computer-savvy folks educate/convince/etc the non-computer-savvy ones we care about to take their own security seriously?

  • 3
    You don't use a password manager because unless you have it with you all the time, there's a likelihood all your passwords will be compromised. On the other hand, if you have some kind of mnemonic that you can use, then you'll store all the passwords in your head. – munchkin Apr 28 '15 at 4:36
  • 1
    You need to scare her straight. Maybe start with some popular articles about horrible password choices. I googled for this one (I'm sure you can find scarier ones out there): gizmodo.com/… – hft Apr 28 '15 at 4:51
  • I now think the OP is ambiguous: Is this the online version of LastPass or the downloadable program? – user49075 Apr 28 '15 at 6:39
  • 1
    @hft and if she has slightly better passwords she'll take this as confirmation that she does not need to change them, since she's not at risk. Truth is she's more at risk of passwords being incorrectly hashed by service providers than at risk of choosing too poor passwords so long as she doesn't pick stuff like "monkey" or "123456". – Steve Dodier-Lazaro Apr 28 '15 at 8:31
  • @RickyDemer I'm referring to the online version of LastPass, but it really doesn't matter for this discussion. – Dang Khoa Apr 28 '15 at 20:11
6

Your wife is not using LastPass because she has better things to do, not because she's incapable of realising its utility.

You would think that once people properly understand the risks they're exposed to (which requires a serious amount of education), they would automatically start to comply with whatever security advice is thrown their way. Well, this assumption has been proven wrong multiple times. See Herley's 'So long and no thanks for the externalities', which has a couple of examples of wasteful security, and Beautement and Sasse's 'Compliance Budget' for a general theory of how humans behave with regard to security.

In economics of information security, there are several examples of people willingly taking risks because it saves time they need for other tasks, or because they perceive potentially negative side-effects to complying (such as being locked out, or embarrassed in front of someone else).

Hence, rather than insisting on your wife doing what you think is good for her, identify her needs, her priorities, her worries and her actual problems. Then, deploy a tool that does work for her (if there's any) and work with her to make sure she knows how to use it and perceives its utility and limitations properly.

For instance, I don't use password managers because I use some of my accounts on so many devices that I have to know the passwords, because I have some passwords that have to comply to such silly policies and be changed every other day (and I hate having to resync my passwords on each device), I don't trust online password stores the least in the world, and because some of my devices are targeted often enough that I don't want them storing many passwords. Most of these problems I have are probably addressable one way or another, but I don't want to lose a day of work setting up processes that go against my habits. And yet, I'm a security engineer. In conclusion, most users will prefer appropriateness and value to security in most decision-making situations.

  • Selfishly, when it comes to joint accounts I really must insist on quality passwords. It seems kind of cold, but if something would be compromised I would rather it not be against something that would take us both down. – Dang Khoa Apr 28 '15 at 20:12
  • Then, choose your bank wisely and use two-factor authentication, or better yet, don't put all your money in the same bank! In any case, antagonising your wife by imposing on her your password choices is probably not your most effective path to good security! People tend to not comply to unusable policies, even when they want to stay secure. – Steve Dodier-Lazaro Apr 28 '15 at 20:26
0

Your problem is more a question of awareness and practice. The fact that as security specialists, we take our job very seriously (which is the right thing) and "expect" others to take security seriously as well. Since you are more closer to the world of the "bad cyberspace", you are well aware of the controls that need to be kept in place to prevent them. Your better half on the other hand isn't that aware of the effects that bad security practices have. I have the following suggestions for you:

  • Since you both have agreed on a password, let it be. Be sure to change it every 90 days. You can rotate a few characters/words/numbers/specials here and there and keep the basic outline the same. I am sure any reasonable person will agree on it. :D
  • I believe that information security is more in control of the "user" than in the "mechanisms".
  • Using Password Managers is, as you rightly said, more of a "power user" thing. The "average user" sees it as uncomfortable and more of a hassle rather than "something to keep them safe". Respect that fact. I'm sure in your long and happy years of marriage, she will become a "power user" too. :)

Hope it helps. And congratulations. :)

  • Changing your bank password every 90 days, reasonable? As long as it's not obviously bad, your bank would probably be liable for any unauthorised transfers from your account in many countries. And it'd probably be insured against that. Also, you might be unaware that some banks have excruciating processes in place for when users forget their passwords. I had to fly to another country to retrieve one of my bank accounts after the Shellshock panic, and ended up closing the account. – Steve Dodier-Lazaro Apr 28 '15 at 8:28
  • My colleagues had one participant who also closed her account because the authentication was too cumbersome (internetsociety.org/sites/default/files/01_1_4.pdf) – Steve Dodier-Lazaro Apr 28 '15 at 8:29
  • @SteveDL: I think it's reasonable. As long as the outline remains same, it shouldn't be an issue. Besides, forgetting passwords is a residual risk that one has to deal with. They can agree on "changing passwords regularly" as the basic security practice. :) – user2339071 Apr 28 '15 at 8:54
  • Actually, one of the difficulties of password authentication factor recall is what's called interference. The more similar-but-slightly-different passwords you'll have, the harder it'll be to remember which is correct/current. People often end up switching a single character or incrementing a number, which is so predictable it defeats the purpose of password changing. So you should go for a completely different password, both to avoid interference and because otherwise the ROI of change is negligible. If you do that for all email/bank accounts it starts being a strain. – Steve Dodier-Lazaro Apr 28 '15 at 10:31
  • Since you're likely to have insurance / second lines of defence (e.g. 2FA for transfers, risk assessments or extra procedures for transferring to new accounts) for banks that don't make you (the user) liable for defects, you're better off concentrating your compliance budget exclusively on your email accounts. – Steve Dodier-Lazaro Apr 28 '15 at 10:32
0

Fear

Yes it sound awful, but it's really the same thing that makes you choose strong passwords. Fear of someone stealing your money from your bank, fear of someonce accessing your private emails, etc.
It's not truly insane to want to educate her about her short-sightedness (no offence intended, but let's call it what it is).

You should probably mention how easily guessable passwords are. Articles of people with whom she can relate (eg: middle class, not-into-anything-obscure married wives) losing sensitive information/their-lives-photos/savings, etc will probably help her rethink her stance a bit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.