Password Managers

PRAISETHESUN

debitcardmayhem said:

What if you use words from other languages e.g. senoramerdebahnoffbanana ?

I read something about this fairly recently, see here: https://passwordbits.com/mix-non-english-passwords-secure/

TLDR, it depends on the foreign words you choose. Many password crackers have lists of the most commonly used words in multiple languages so if you choose one of those words then it is likely to be fairly unsecure - the example given is:

The passphrase “cat gato chatte macska” is clever, but you are only saying “cat” in four different languages. This would be an incredibly easy password to guess.

victor2

The most common method I've heard is to have a difficult to guess "baseword" involving a mix of case, numbers and special charcters, then added to it is a couple of characters that are unique to the site being used, along the principle of AM = Amazon, but not that simple. That way, if they forget a password, they can usually work it out, but every password is unique.

RumRat

As the transition to Passkeys is ramping up the discussion around passwords seems a bit prehistoric.
Estimates are that to crack a Passkey would take around 300 Trillion years.....More than enough for me...
So, best to ditch passwords wherever possible and use Passkeys instead. Until the site you want moves to Passkey always make sure 2FA or MFA are implemented where possible.

km1500

victor2 said:

The most common method I've heard is to have a difficult to guess "baseword" involving a mix of case, numbers and special charcters, then added to it is a couple of characters that are unique to the site being used, along the principle of AM = Amazon, but not that simple. That way, if they forget a password, they can usually work it out, but every password is unique.

Your password or base word should really be 'random' letters and one way of generating them is to think of a piece of poetry or song or saying that is rare and (for example) use the first letter of each word in that verse or song

Simple example - tlawrtltydwnd

the long and winding road that leads to your door will never disappear

Put a special character or two at the end

Then as suggested if you want, put AM at the end for Amazon, EB for eBay etc

400ixl

RumRat said:

As the transition to Passkeys is ramping up the discussion around passwords seems a bit prehistoric.
Estimates are that to crack a Passkey would take around 300 Trillion years.....More than enough for me...
So, best to ditch passwords wherever possible and use Passkeys instead. Until the site you want moves to Passkey always make sure 2FA or MFA are implemented where possible.

Indeed, but where do you store the passkeys to be truly cross platform. You still need to secure that store with a master password.

Vitor

Passkeys really need a hardware device to protect them like a Yubikey which asking a lot of Joe User

flaneurs_lobster

Over half of the 40-odd financial institutions I have accounts with use SMS as their 2FA method when accessing them online. I don't see universal adoption of passkeys coming any time soon.

At least the institutions that have apps are using biometrics (in the main) for access control.

Vitor said:

Passkeys really need a hardware device to protect them like a Yubikey which asking a lot of Joe User

Is storing your passkeys on a secured mobile device a significant improvement over holding passwords? Bitwarden allow this, as does Google and MSoft. I've set them up but have not yet been brave enough to remove my passwords.

Vitor

 - Is storing your passkeys on a secured mobile device a significant improvement over holding passwords -

Passkeys are mostly a a mitigation against the web-site's database of account information being compromised and stolen, as there are simply no passwords to extract. In the event of a data breach, you don’t have to scramble to change passwords as the private key remains on your device.

For 99% of private users I'd say Passkeys on well-protected mobiles are good enough, but ultimately a mobile phone has more ways to be compromised than a hardware key holder.