MSE Poll: How many passwords do you have?

I'm finding it increasingly hard to remember all the different password requirements for accounts and have recently locked myself out of a couple of important accounts (partly because of a post migraine fog). I've resorted to keeping a little notebook at home with usernames etc and clues to my password that should only mean anything to me. I use an asterisk system to indicate how many characters there are and make a note of special password requirements for that account (e.g. caps and special characters) and the clue is often written in shorthand as well.

The link in the OP leads to a poll about spending on wedding gifts!

:huh:

While not scientific, the results of this poll seem to back up my own experience. The more passwords you have to manage, the more likely you are to be an IT professional or power user, and the more likely you are to use best practice techniques for managing them and limiting the potential fallout if one is compromised.

Password re-use is the riskiest behaviour as demonstrated by the recent escalation in "credential stuffing" attacks, where login details stolen from one website are automatically tried against dozens if not hundreds of others.

The risks seem obvious to some, yet others don't seem to get it. Every time you give credentials to a site or service you are trusting them to maintain control of those credentials. If you re-use passwords you are effectively trusting every site to maintain control over the credentials for every other site. The risk goes up every time you do this, and probability is not on your side.

One of my younger relatives simply cannot understand the difference between using a Password Manager with a strong master password, and using that same password on every site. "If they steal your master password they have everything," she says, "So what's the difference?"

The difference is that the Password Manager is a single point of failure that could compromise your entire online life if breached, but which has (hopefully) robust security. But the sites with the re-used password represent hundreds of potential points of failure, any of which would compromise your entire online life if breached and many of which will have terrible security.

It's simply a numbers game, and you need to keep the number as low as possible.