nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How many passwords do you have to remember?

Deise Vu

So yesterday I was brought to the brink of a nervous breakdown. First I tried to investigate a massive charge on a work mobile which required a login name, password, user PIN and a verification code before accessing a ‘dashboard’ of which I could make zero sense. Result: On-line billing now cancelled and it’s back to the 50’s. Hello reams of paper, bye bye forests.

What nearly tipped me over the edge though, was trying to cancel an auto-renew of Xbox Gold on a child’s Xbox. His friend emigrated two years ago and I was persuaded that they could keep in touch and have fun. Needless to say the friend is long forgotten but every year Bill Gates needs €60 from me to keep the wolf from the door so I decided to cancel. I won’t give the long version of what ensued. People who know Microsoft will already be familiar with the seven circles of hell you must visit to cancel a subscription and, people who do not, probably wouldn’t believe it. Trust me, at one stage I was actually speaking to my credit card company about cancelling my card and moving banks.

Eventually, thanks to my 11 year old being able to recall a password on a Microsoft account and a Gmail account he created two years ago I was able to cancel with the assistance of my new best friend, Matthew, at Microsoft Support Chat. Yes, I know I was stupid, thanks for reminding me.

It got me thinking, I am reasonably tech-savvy but will never, ever give my credit card details to any organisation ever again unless there is a human I can catch by the collar and tie and drag across a counter in order to emphasise my displeasure at their notion of Customer Service. So, is the world of e-commerce eventually going to collapse or are we all going to be bankrupted by long forgotten passwords and the small print of contracts we never read? Alternatively, will someone come up with a transferable biometric system that will allow us to live our lives without having a list of 100’s of different passwords that have to be changed regularly.

I am curious to know how many passwords people have and how they organise them. I have a spreadsheet with over 200 work passwords (plus subsets!) and between 50-100 private ones. If I forget the password to my password spreadsheet I will probably starve or be bankrupted and I will certainly be fired. This can’t be right. What do the rest of you do? Does your spouse know how to access all your banks, utilities, insurance, pension, even your phone (God forbid!) etc etc? Do you know how to stop standing orders / direct debits from your bank account?

Or did I just have a bad day.

I will try to add a poll but I haven't done that previously. hopefully it won't require a password.

Find more posts tagged with

Comments

maccored

isnt the idea of a password manager a bit silly? All anyone needs to know then is the password to your password manager.

Der Stier

I have about 3 basic passwords that I do little algoriths with in my head when I need to change them, fortunately I have a good memory for these things.

But I must check out that lastpass.

Send In The Robots

maccored wrote: »

isnt the idea of a password manager a bit silly? All anyone needs to know then is the password to your password manager.

Agree, and wasn't one of those major password site managers on the news as being hacked recently making it a null option.

Alun

maccored wrote: »

isnt the idea of a password manager a bit silly? All anyone needs to know then is the password to your password manager.

Not really. The master password isn't stored anywhere accessible to an attacker, it's used locally to scramble your passwords before uploading to the password manager server, and the password manager company themselves don't know your master password either. Plus any potential hacker has to log in to the password manager in the first place and there are all kinds of hurdles you can put in the way of that happening such as device restrictions, 2FA and geographic limits.

.......

This post has been deleted.

Alun

Send In The Robots wrote: »

Agree, and wasn't one of those major password site managers on the news as being hacked recently making it a null option.

If you're referring to Lastpass that was a vulnerability that was discovered in one of the browser extensions which AFAIK would require the attacker to have physical access to a computer running the extension and logged in under your user name. It was disclosed to Lastpass without being made publicly known and fixed pretty quickly anyway.

Send In The Robots

Can't link but 'OneLogin' was on the news recently, it suffered a serious data breach.

Alun

....... wrote: »

This post has been deleted.

Because the bad guys know that people do this. When, not if, one of your passwords makes it onto a list of hacked passwords through a security breach like the recent Yahoo breach, they'll try that password on a variety of other sites along with simple variations of the same with, say 2 digits at the end. Having the base password available gives them a better chance of striking lucky.

maccored

Alun wrote: »

Not really. The master password isn't stored anywhere accessible to an attacker, it's used locally to scramble your passwords before uploading to the password manager server, and the password manager company themselves don't know your master password either. Plus any potential hacker has to log in to the password manager in the first place and there are all kinds of hurdles you can put in the way of that happening such as device restrictions, 2FA and geographic limits.

a password you make up that can get hacked is also not 'stored anywhere accessible to an attacker'. A bad password is a bad password, so if you have a crap password for a password manager then the hacker has a list to all the other account passwords. how they get to the password manager etc etc is totally irrelevant

Alun

Send In The Robots wrote: »

Can't link but 'OneLogin' was on the news recently, it suffered a serious data breach.

Yes, I saw that. Information is a bit patchy but there's evidence that they may have stolen some encrypted password vault data along with other user information. They wouldn't have had access to master passwords though, so the only danger may be from weak master passwords, possibly based on user names which they may try to exploit.

Alun

maccored wrote: »

a password you make up that can get hacked is also not 'stored anywhere accessible to an attacker'. A bad password is a bad password, so if you have a crap password for a password manager then the hacker has a list to all the other account passwords. how they get to the password manager etc etc is totally irrelevant

But they still have to actually physically log on to the password manager website to access them. I have mine set up so that only the devices I've authorized (PC plus phone) have access to it, require a one off code from a 2FA device and are geographically limited to Irish IP's. I'll also get an immediate email and SMS if any attempt to log in to my account from any other device or country is even attempted.

spoonbadger

stimpson wrote: »

Not really true anymore https://diogomonica.com/2014/10/11/password-security-why-the-horse-battery-staple-is-not-correct/

If it hasn't been posted yet, this is an excellent resource https://haveibeenpwned.com/

Deise Vu

spoonbadger wrote: »

If I searched your hard drive for the username or email of an account of yours I wanted the password for, would I find that file

I don't really understand the question. My email user name, as an example, would be contained within the excel file which is password protected but it obviously wouldn't appear in the excel file name. Is it the case that forensic searches can bypass file encryption and drill into the files? (Genuine question again!). My email user name will also appear on a million emails going in and out but very few excel files I suppose.

citytillidie

I have a few email addresses that have different passwords.

One for Xbox
One for personal use
One for online sensitive use
One for online sign ups

.......

This post has been deleted.

spoonbadger

Deise Vu wrote: »

I don't really understand the question. My email user name, as an example, would be contained within the excel file which is password protected but it obviously wouldn't appear in the excel file name. Is it the case that forensic searches can bypass file encryption and drill into the files? (Genuine question again!). My email user name will also appear on a million emails going in and out but very few excel files I suppose.

Thought I'd edited that in time :P Sorry, I didn't fully read your post and didn't realize your file was encrypted. If it wasn't though, storing account names with passwords somewhere searchable is a bad idea. Search for the account name is a very easy, lazy way of trying to find account details on a site, hard drive etc. etc.

stimpson

Deise Vu wrote: »

I don't really understand the question. My email user name, as an example, would be contained within the excel file which is password protected but it obviously wouldn't appear in the excel file name. Is it the case that forensic searches can bypass file encryption and drill into the files? (Genuine question again!). My email user name will also appear on a million emails going in and out but very few excel files I suppose.

What version of Excel?

Gone Drinking

Don't understand password managers, you've one password then for all your passwords. What if someone looks over your shoulder and sees it, or puts a key logger on your machine? Just never understood it.

I've between 6-10 passwords. Only the weakest couple that I've been using since I was a kid contain a dictionary word, these are only used for sites i don't care about. I've a complex one that I use for my important secure sites (online banking, secure payment authentication, main email etc). I've lesser complex ones I use for sites that I'm not too bothered by (social media) and then I've a few for work related items.

The companys or services I use my main/important password with would never ever be saving my password in plain text. It's been encrypted since the day I registered. Even if they were to fall victim of a hack where the passwords are leaked, the likelihood of them encrypting my password is nil.

Would probably be the same sort of security on social media/boards but I use a couple of passwords for those accounts because there's a greater chance they'll fall victim to a security flaw or hack.

Deise Vu

stimpson wrote: »

What version of Excel?

Office 2010. Version 14.0.7128.500 (32Bit) I got fed up with the constant change for the sake of it and never upgraded since. Don't tell me I have to cave in now?

Hotblack Desiato

Deise Vu wrote: »

Someone would have to hack into our system, locate the file (which has a harmless sounding name),and break the encryption.

All very easily done and it only takes one phishing email sent to a user of an unpatched system to manage it - all your files can be sucked down to the attacker's system and examined at their leisure for juicy stuff. Although it's usually a lot more lucrative for them these days to just encrypt your files and look for a ransom...

Office encryption is not really encryption, think of it as one of those novelty 'padlocks' you get in a christmas cracker. Absolutely trivial to crack open.

Is that less safe than trusting some anonymous corporation in Cyber Space as most of the techies here seem to have done? (That's a genuine question, I'm not being smart assed, I consider myself tech-savvy but am most definitely not a tech).

Whatever about the others KeePass isn't an anonymous corporation, it's an open source project and you retain your password store yourself (although you could put it on a cloud service if you wanted.)

ALL software has flaws and ALL software must be patched promptly when flaws are discovered. Amateur admins who don't know what they are doing and don't like patching will sooner or later get caught out badly, and it only takes one bad cybercrime incident to destroy a business for good.

Deise Vu

Hotblack Desiato wrote: »

All very easily done and it only takes one phishing email sent to a user of an unpatched system to manage it - all your files can be sucked down to the attacker's system and examined at their leisure for juicy stuff. Although it's usually a lot more lucrative for them these days to just encrypt your files and look for a ransom...

Office encryption is not really encryption, think of it as one of those novelty 'padlocks' you get in a christmas cracker. Absolutely trivial to crack open.

I take the point but there is an accumulation of files since the year dot. Even if there was no encryption it would take a small army to look through every file.

Ransomware is straying off the point into general security. If we got hacked we would be exposed regardless of how we stored our passwords.I am assured our offsite backups will be protection enough. (Thats probably wrong too!)

Hotblack Desiato wrote: »

Whatever about the others KeePass isn't an anonymous corporation, it's an open source project and you retain your password store yourself (although you could put it on a cloud service if you wanted.)

ALL software has flaws and ALL software must be patched promptly when flaws are discovered. Amateur admins who don't know what they are doing and don't like patching will sooner or later get caught out badly, and it only takes one bad cybercrime incident to destroy a business for good.

To a techie I am sure the phrase 'open source' is 100% reassuring. To us non-techies I can only say :eek::eek::eek::eek:

Alun

Gone Drinking wrote: »

Don't understand password managers, you've one password then for all your passwords. What if someone looks over your shoulder and sees it, or puts a key logger on your machine? Just never understood it.

If anyone tries to use my master password on any device other than my main desktop PC or my phone, for a start they won't get access and secondly I'll be immediately alerted.

lawred2

I use password generator to create passwords...

and I store them all in an encrypted folder on dropbox

I must have hundreds at this stage

stimpson

Deise Vu wrote: »

Office 2010. Version 14.0.7128.500 (32Bit) I got fed up with the constant change for the sake of it and never upgraded since. Don't tell me I have to cave in now?

2010 passwords are fairly easy to crack iirc. Seriously, get a password manager and turn on 2 factor authentication and stop stressing over it all.

Fathom

Six passwords. Which change.

Permabear

This post has been deleted.

Deise Vu

Thanks for all the suggestions guys but at the end of the day, I am not looking for security solutions, my point is that for ordinary, every day people e-commerce in all it's various forms will collapse unless someone comes up with something unique and, preferably, biometric, that can be transferred across all technologies. Looking back on the thread I think it would be fair to say that Joe Soap has too many simple and exposed passwords while Joe Hacker is getting ever more sophisticated. That can only end one way and that's very, very badly.

stimpson

Deise Vu wrote: »

Thanks for all the suggestions guys but at the end of the day, I am not looking for security solutions, my point is that for ordinary, every day people e-commerce in all it's various forms will collapse unless someone comes up with something unique and, preferably, biometric, that can be transferred across all technologies. Looking back on the thread I think it would be fair to say that Joe Soap has too many simple and exposed passwords while Joe Hacker is getting ever more sophisticated. That can only end one way and that's very, very badly.

2FA is robust (if someone has your password it's no use to them) and fairly easy to use. LastPass will use the fingerprint scanner on an iPhone so for that use case there is already a biometric solution. It will even scan your passwords to ensure you haven't reused them and that they are hard to guess.

Solutions are there but you choose not to use them.

pickarooney

Who could be arsed having millions of complicated passwords. I simply don't care if anyone wants to read my emails or whatever and makes the effort to hack it. I'm not going to waste my time trying to outsmart people who do this for a living.

Mister Vain

I have 5 complex passwords that I use for my most important sites. Then I use one password for about 7 or 8 unimportant sites or sites I don't use very often.