The password thread: managers, passkeys, and the accounts you forgot you were risking

[TristanFenwick]

Following the backup sermon, here is the security one, structured as tips first and open surgery after. If you take one action from this thread, it is this, your email account is the master key to every other account via password resets, so it gets your strongest unique password and two factor authentication before anything else does

The standard advice stack in order of impact, a password manager so every site gets a long unique password you never memorise, two factor on email, banking and anything with your card stored, and passkeys where offered since they cannot be phished or reused. None of this requires technical skill anymore, only the one annoying setup afternoon

The traps worth naming, reusing one good password everywhere means one site's breach unlocks your life, SMS two factor beats nothing but authenticator apps beat SMS, and the security questions asking your mother's maiden name are answerable from your own social media, treat them as extra passwords and fill them with nonsense the manager remembers

Open surgery is now in session. Post your setup or your excuse and the board will be gentle but honest, and if you know your excuse is I would forget the master password, say so, because that one has a proper answer

[CosmicRay17]

The excuse is I would forget the master password, as prophesied. What is the proper answer then?

[KeyboardWarrior47]

A long passphrase of random words you write on paper and keep where you keep your passport. Paper in your house beats weak passwords on the internet every day of the week

[Hollow Ronan]

Can confirm the email account point from bitter experience, one old webmail with a 2009 password got popped and the reset emails for everything else started flowing within the hour

[SašaJelenič]

Passkey convert here, the phishing immunity is the underrated part. There is no password to type into the fake site, the fake site simply does not work, my dad cannot be tricked out of what he does not have

[Inland Renegade]

Devil's advocate, does a password manager not create a single point of failure? One breach and everything goes at once

[Kieron83]

The vault is encrypted with your master passphrase, a breached provider leaks blobs they cannot read. The single point of failure framing sounds smart and dies on contact with how the crypto works

[Dom66]

The security questions tip deserves its own thread, my bank thinks my first pet was a 24 character string of gibberish and I sleep beautifully

[StayReadyKev91]

SMS two factor slander is slightly overdone for normal threat models, sim swapping targets people worth targeting. For most of us SMS on the bank beats the nothing it usually replaces

[Arty Kayla]

Agreed it beats nothing, the order matters though, if the account OFFERS an authenticator app there is no reason to choose SMS. Take the better lock when both are free

[Neil57]

Setup afternoon completed as instructed, 147 accounts, 31 shared the same password including a takeaway app and my actual bank. Posting my shame so the next lurker does their afternoon too

[Nina81]

31 including the bank is the most normal terrible result there is, welcome to the other side, the water is unique and randomly generated