Author Topic: Do one thing today to improve your privacy and security, online or off  (Read 2382 times)

SmashYourSmartPhone

  • Bristles
  • ***
  • Posts: 252
Using a password keeper strikes me as being extremely insecure.  Kinda keeping all your eggs in one basket there.

Then use a paper notebook with them.  Telling people to never do that was one of the worst chunks of computing advice from the early days of computing.

But you have to look at the threats faced, and what you can/can't control.

In modern computing, if an attacker has control over your endpoint (your phone, your computer, whatever...), they have everything they need.  If they want a password of yours, it's no particular problem to keylog it when being entered, or to pull it from a password database, or just to swipe the login cookies and inject them into their browser to be logged in "as you" (and proxy through your connection, should they need to).  I don't find "storing passwords on your endpoint, which if compromised, gets an attacker the keys to the kingdom anyway..." to shift the risks much.

On the other hand, you have no control over how websites store your passwords, or what security they have around it.  For a long time, far too many sites stored password in plaintext, so when their database was dumped, you had a pile of username/email/passwords.  Many other sites used weak hashing algorithms, such that it was easy to reverse most common password constructs out of the hash, at great speed.  This has gotten somewhat better, but the biggest risk for most people, IMO, is "credential stuffing" attacks, in which an attacker will obtain a list of usernames and passwords, and then try them on some other list of sites.  I'm pretty sure I know people who have lost long lived social media accounts from exactly this, as they admit they've used the same password a range of other places.  To defend against this, you need unique per-site passwords - but also, not of some common construct.  If your PayPal password is !!PayPalP@$5!!, and your eBay password is !!eBayP@$5!!, I can probably guess your Facebook password.  So you can't use an easily memorized pattern.

And most humans are really, really bad at remembering hundreds of totally random strings.  Enter password managers.

Also, this is why endpoint security matters.  Chromebooks are pretty darn good.