Just came up with my father again.
He blames me that mother forgot her phone’s and Google password because I recommended against it being a word.
I mentioned encryption, “not necessary unless you’re doing something illegal”.
When mentioning lack of privacy with targeted advertisements, he said that he actually really likes them, because he bought a couple of things he wanted for years.
I don’t really have good arguments.
I’m going to be real. I was part way through an explanation before I deleted it. What you are dealing with sounds like a situation where you simply won’t win by using logic. To continue to labor under the presumption that a good and logical reasoning will have an effect is just going to stress you out and achieve nothing.
IT nerds help me out here, but I’ve been under the impression that the best defense against brute force attacks is a very long password, and the idea of sprinkling in special characters or numbers is outdated. Something like “iwenttothestoreandboughtabirthdaycake” is a more secure password than “$6jds_*WghP6”.
edit: Also the mantra to never write down any passwords is more of a workplace piece of advice. I personally think, and this would probably be helpful for older people, that writing down passwords in a notebook which is kept secure in their home is pretty safe. Short of a home invasion, that notebook is safe, and having it can encourage them to diversify their passwords on different accounts. So, if you are going to keep at the issue, taking an angle of using something they are more comfortable with like a paper notebook is going to be accepted more easily than trying to sell them on a password manager or something.
It doesn’t even have to be that long. 12-16 characters and it’ll be infeasible to brute-force for the foreseeable future. But unless you’re talking a high-value target like government, military, or executive suite at a company, no one bothers to brute-force anyway because there’s easier ways to gain access.
The biggest issue with password security is reuse and sharing. The most secure password in the world doesn’t mean a damn thing if you use the same email/password combination across a hundred different websites, because all it takes is for just one of them to suffer a leak and now your credentials are in a dump with millions of others that can be bought for a song and a dance.
This is why it’s imperative to use 2FA for your most important accounts, because it can mean the difference between an attacker getting access and hitting an error page and trying the next poor fucker’s credentials instead.
But also, no one wants to try to remember a hundred different unique passwords so it’s also a good idea to use a password manager. Chrome and Firefox both have them built-in (note that Firefox stores passwords unencrypted on disk unless you set a master password!), but there’s also services like OnePass or Bitwarden that have stronger guarantees.
While being aware that leaking passwords and reusing them is a major risk, I was just asking about the construction of the password as it relates to being attacked directly.
Absolutely. I recommended the notebook approach only because I think people of a certain mindset would be more open to it than a password manager, even if it isn’t as elegant of a solution. At the end of the day it still diversifies passwords. I’m vividly picturing my mom throwing a fit any time a doctor or other office wants her to fill out a form on a tablet instead of paper.
Bitwarden sold keys recently. Chrome and firefox are the same product now and neither should be allowed to hold anything important.
If you can’t get keepass going, I second pen and paper.
Source?
Source?
https://xkcd.com/936/
deleted by creator
For my parents I save their passwords into my password manager whenever I set stuff up for them after learning the hard way several times.
Word based passwords are (typically) not more secure, but they’re easier to remember than random text, which makes them more secure than the lesser alternative, but not more than the better alternative: just as long, but fully random text stored and generated by a password manager. You’re right that substituting text with numbers or symbols is bad, those are easily cracked. But fully random text with symbols and numbers is the best.
Why? Badly remembered passwords are often reused and written down, sometimes even on the computer itself, in emails, chat software, text files. And any password created by a person inherently will fall victim to shortcuts, as humans are often just not as creative as you might hope, there’s patterns. Common words might be used, too little words might be used. With a dictionary attack that checks common words, the entropy of such passwords can become drastically smaller to the point they can be cracked very quickly, and you have to be aware of that constantly when using words. Using uncommon words or more difficult words can prevent that, but that’s typically not what people do, when “password123” is the best they come up with otherwise.
A notebook at home would suffice, but it’s not great for the same reason as word based passwords. A password manager can create passwords that are guaranteed to be entropically complex passwords that can’t be cracked basically ever. There’s no guessing, no shortcuts to take, no human laziness to slip in and curse the password to easy cracking. And it does so uniquely for every login you have. That’s essentially unbeatable.
I’m aware. I’ve explained it elsewhere, but having dealt with irrationally tech adverse older people myself, I’ve learned sometimes decent solutions they’ll actually use are better than great ones they’ll resist. I’ve found that any new software, like a password manager, no matter how user friendly and logical is treated with suspicion and disdain.
I gotcha, yeah then it’s probably better for them. As other people in the thread explained, it should save them from most crackers that just give up if the password isn’t cracked easily.