Enforcing Different Passwords for Different Sites
diegobasch.com
Enforcing Different Passwords for Different Sites
1–10 of 56 posts
Re: Enforcing Different Passwords for Different Sites
#2Dear god, please let me have the freedom to determine what degree of security I need on a site.
If you restrict my password options in anyway I will use your site less.
Re: Enforcing Different Passwords for Different Sites
#3So instead of having websites that require "upper, lower, numeric and special" characters, we'll have sites that require "randomly generated word from two years ago that we hope you remember". It's just another constraint that will never be standard and will be near impossible to remember.
Re: Enforcing Different Passwords for Different Sites
#4I agree this is a major issue, and in fact was specifically covered in an earlier xkcd (http://xkcd.com/792/) than the one cited (http://xkcd.com/936/).
It might be a good idea to enforce non-password reuse, but the proposed solutions seem fairly aggravating. In particular the 'webmaster' solution of requiring inclusion of a fixed string is extremely annoying (oops, sorry users who use cryptographically derived passwords (http://passwordmaker.org/)), and doesn't solve the problem since someone with your "main" password can probably guess the "derived" password (e.g., the main password with the mandatory substring appended to the end).
My solution as a user is to just use a password manager. I use clipperz(http://clipperz.com/), but there's plenty others out there.
* Edited to remove markdown-style links. Forgot it wasn't supported here.
Re: Enforcing Different Passwords for Different Sites
#5I'm no expert, but why does this have to be done on the password level? Why can't we just assign usernames to our own sites, and force people to login with those? I know that's incredibly annoying for a user, but it would at least guarantee the user credentials for your site are unique from any other site.
Re: Enforcing Different Passwords for Different Sites
#6So instead of having websites that require "upper, lower, numeric and special" characters, we'll have sites that require "randomly generated word from two years ago that we hope you remember". It's just another constraint that will never be standard and will be near impossible to remember.
If you use a different password for every site, it's a given that you won't be able to remember them. Storing your passwords securely is a different problem.
Re: Enforcing Different Passwords for Different Sites
#7This will never work for normal people.
For everyone else, there are programs like LastPass and 1Password that make this easy.
Re: Enforcing Different Passwords for Different Sites
#8I agree this is a major issue, and in fact was specifically covered in an earlier xkcd ( http://xkcd.com/792/ ) than the one cited ( http://xkcd.com/936/ ). It might be a good idea to enforce non-password reuse, but the proposed solutions seem fairly aggravating. In particular the 'webmaster' solution of requiring inclusion of a fixed string is extremely annoying (oops, sorry users who use cryptographically derived p…
The point is that the mandatory substring is random and unique to you. The problem with using a password manager is that it implies that you're already savvy enough about the issue. Most people have no idea such thing exists. How could you enforce the usage of a password manager?
Re: Enforcing Different Passwords for Different Sites
#9"Now, one fine day somecrappysite.com gets hacked. The next time you visit, the web page has malicious code that sends your password in plaintext to someone. There go your Paypal funds, your Facebook account, your online life."
What an optimist! somecrappysite.com was probably storing your password in plaintext to begin with and it probably got pulled from the database long before you logged in again.
Having said that, this is an absolutely terrible solution for real-world usage because it inhibits people who are already security savvy from using better solutions like Stanford pwdhash or similar methods.
Re: Enforcing Different Passwords for Different Sites
#10"Now, one fine day somecrappysite.com gets hacked. The next time you visit, the web page has malicious code that sends your password in plaintext to someone. There go your Paypal funds, your Facebook account, your online life." What an optimist! somecrappysite.com was probably storing your password in plaintext to begin with and it probably got pulled from the database long before you logged in again. Having said tha…
Right, but those people are the one percent. How do we help the vast majority?