95
Maybe the lesson for children should be less about how to use tools to manage a password, and more about understanding why managing passwords is important?
Let them write their passwords in a notebook. Have fun with devising a method for obfuscation in case the notebook is lost. Teach them about backups- keeping a copy someplace safe. In my experience, kids ...
76
I have used a stateless password generator for years, and I think there are a lot of drawbacks:
If your master password is compromised, all of your passwords are. In comparison, standard password managers requires that the attacker both compromise the master key and gain access to the password store.
If a website has a password policy, you might not be able ...
42
Here are two less often mentioned problems.
Determining the website is hard. You want to use a different password for a.github.io and b.github.io, but you want the same password for microsoft.com and live.com, or wikipedia.org and wikimedia.org.
Changing anything breaks passwords. Once you've released your password manager and people start using it, you can'...
29
Memorising a really strong master password is probably a bit much to ask
I disagree! I have a daughter who, at around 7, was able to quickly memorize a very strong password using the Diceware method for use in a password manager. This method picks several random words from a dictionary (typically) composed of 7,776 words. A mere 9 words is log2(77769) ≈ 116 ...
18
1. Password managers provide additional options
A key difference between using a stateless password manager and a password manager is that password managers can store additional data such as
Security Questions
Credit/Debit card numbers
Id card numbers
Cryptographic keys
WiFi passwords
API keys, etc...
2. Existing passwords cannot be accommodated
Password ...
15
"Logging in from multiple devices" if you do not own them, is one habit that would need to be stopped for general security.
Once you own all the devices in the scenario, one method that I saw for young people that was useful is to avoid dealing with passwords altogether: use the "forgot password" process.
If the device is owned and access to email is on ...
14
If you have no master password set, then the login passwords are always available. If you do have a master password set, then opening the Saved Logins dialog will prompt you for the master password. Without the correct master password, the list of logins will be empty and thus there is no password to copy.
The bug only occurs in this specific condition:
A ...
14
Besides those already mentioned, one more problem is that you cannot change your master password. Switching to a new master password would require changing your password on all the web sites where you've used the generator.
8
The problem is that it doesn't add that much meaningful security.
Instead of using your password directly, you use a publicly available function instead of your password. Let's use the example on their website for a demonstration:
Login: andromeda
Website: milkyway.com
Secret Keyword: 2,52m light years away
Produces password: 3q_q(MFWaMGeao+[CX
...
7
One more I haven't seen mentioned explicitly (as of writing all existing answers also make good points):
If an attacker gets hold of one of your generated passwords, now they are able to try cracking your master password from it, gaining access to all your accounts.
It's relatively easy to get one low-value password, whether through phishing, plaintext ...
4
I assume you are asking if you (the user NH) should trust a browser's built-in password manager, or if you should install a third party plugin; and not whether or not Mozilla should develop another password manager.
Before I get started, keep in mind that security isn't just about vulnerabilities or architecture or protocols or passwords; it's an overall ...
2
What you are looking for is called a Key Check Value (KCV).
You create a KCV by encrypting a block of zero bytes in ECB mode (the same number of null bytes as your cipher’s block size), then saving the first three bytes of output as a six character hexadecimal string, such as A1B2C3.
In the future you can test a key by executing the same KCV algorithm; ...
1
KDBX4 can now use Argon2 which is the state-of-the-art in password derivation.
The difficulty to guess the password of a KDBX4 database depends on:
The chosen Argon2 parameters, which are poorly advised by Keepass, but still better than the previous AES-KDF. The parameters you describe are very poorly chosen, they will not strengthen by much the ...
1
You don't make clear exactly how you intend using Key-Vault.
As a general guide to encryption you should always ask the question, "Who has the keys?"
Many storage services offer to perform encryption for you, but if the encryption is not with your keys, it's not your protection.
1
You could ask for details about the actions the user has performed in your app.
Example: Show users a list of 3 popular merchants in the region out of which only one is used regularly by the user. Ask the user to select the merchant he has regularly paid using your app.
Options for trusted contacts like Facebook. The user can assign trusted friends or ...
1
Like many of the above I also recommend the use of stories and fear!
In particular you need to explain WHY its so bad to have the same password across different websites, as perhaps she doesn't understand the problem with this. I find this is often the case with those outside of the IT industry. They see it as just a best practice suggestion and maybe even ...
Only top voted, non community-wiki answers of a minimum length are eligible
