Hacker News new | ask | show | jobs
by dewey 992 days ago
I don't think you have to tell that to people on HN, but regular people will not be able to use most password managers. Not even 1Password is really user-friendly and it's the most mainstream one.

The included one on macOS is hidden in some setting panel.

For non-technical people the best authentication method is probably their phone (Passkeys, or tokens sent to their email address).
2 comments
alistairSH 992 days ago
The included one on macOS is hidden in some setting panel.

As long as you stay in the Mac/iOS walled garden, you really don’t need to access the Settings page/app. Safari and most apps will happily pull the user/pwd from the manager for you. I’ve used for a few years now (after tiring of the mediocre UX of several other managers).

link
randerson 992 days ago
Most (all?) major browsers now have built-in password managers which are intuitive enough for regular people and provide sufficient security against these attacks.
link
dewey 992 days ago
And yet, passwords get guessed, stolen, re-used all the time. If you talk to regular people they still use pet names + a number because they want to be able to type it in everywhere.

It's not a solved problem, even if a rudimentary password manager is in most browsers.

Personally I don't know a single person outside of my tech bubble that uses passwords that you can't keep in your head, or write down on a piece of paper on their desk.

link
hunter2_ 992 days ago
There's a simple trick to having a password that's easy to type, easy to remember, and is pretty darn secure: repetition. Just take your pet's name or whatever, type it several times, and then finish it off with a number or whatever. Should be resistant to typical dictionary and brute force attacks.
link
dewey 991 days ago
And you already identified the main problem with this strategy: "repetition".

As it's not possible to remember n passwords for n sites, if one of them gets hacked "darn secure" isn't so secure any more. The main point of password managers is that you don't have to remember your password and if it leaks out on one site, it doesn't matter as it's only used on that one site.

link