The Personal Security Checklist

Individual words then are easily crackable.

But, take 3 long dictionary words chained together...easier to remember and more secure than a shorter randomly generated string.

E.g. postcriptaluminumengagement vs kug45l2wx

Or are there also dictionaries that contain combos of words?! (Would be rather a large dictionary).

3 words is not enough usually, but it technically depends on the dictionary size. Since the formula is dictsize^numwords, adding a word to your phrases is a lot better than adding a thousand words to your dictionary (also because of diminishing returns above ~5 thousand words).

Iirc 6 words is a good size for most dictionaries or 7 words for diceware, but might be off by one so please look around. I remember posting it on the security stackexchange site (I'm currently on mobile, not logged in or I'd look it up in my user) and I'm not the only one who's done this calculation. It also depends on what security level you need (e.g. should it prevent from offline brute force or only online brute force)

> Aaand we're down to single-factor authentication

We're not, not really. The only single password that can unlock 2FA is that for the password manager, but most phishing attacks I'm aware of target the specific services, not password managers, since it's usually way easier to fake a banking login. Good password managers will have dedicated apps, so entering that password on some janky website is not something victims will be used to, plus there should be something 2FA-ish as well (biometrics on an iPhone etc.), so that particular password should be considerably harder to get ahold of than most. That doesn't protect against a fully compromised device, but that's not something 2FA is very effective against anyway. I'd say it's good enough for now.

Perfect shouldn't be the enemy of the good; security is always a trade-off between less-than-perfect alternatives, and the obvious alternative for lots of people will be a .txt on their Desktop or in their Dropbox or even an email to themselves, or no 2FA at all. I've been told that no attacker would find one person's password list since they disguised it as an email draft, who'd think to look there? Putting backup codes in one's primay 1Password vault doesn't fare that badly against those.

> I do recommend a password manager, but not to keep would-be-two factors in one vault.

A separate vault means another password, where do you keep that? It'll be needed very infrequently, so it's easy to forget, especially under stress. Also, you'll want to make sure you have it when you're seven timezones away and just lost your phone, since vacation is prime phone-losing time and also a time when you might have to get at your emails really urgently, e.g. for travel documents; that's also a situation where printing out backup codes on paper might bite you if they stay behind at home. I'm not even sure how I'd set this up, afaik 1Password (Cloud) and LastPass don't support vault-level passwords.

This is a surprisingly little-discussed problem outside of corporate. And when it is discussed, many knowledgeable people view personal security through a corporate security lens, which isn't very practical, making this an IMO pretty underserved niche. I've discussed this with lots of people and I'm still not aware of any silver bullet solution, but the recommendation from TFA seems like a decent compromise for a sizable cohort, especially younger people who aren't comfortable with paper documents and/or are highly mobile.

Thats just no true, most pw managers allow setting up MFA.

By that logic the password itself is two-factor, because you need the database password as well as the database file to obtain the target password. I definitely see where you're coming from, but I'm not sure why you'd still bother setting up 2FA with backup codes then if you already consider the password itself 2FA?

A higher security level, which isn't needed for everyone indeed, would be to have these two things (where you have your password database unlocked, usually multiple times a day, and the second factor secret codes) in independent locations. This can also be two VMs if you keep the host encrypted and very secure for example. I assumed people with 2FA wanted to achieve a bit higher security level than all eggs in one basket. (None of these things beat a wrench attack of course.)