For what it's worth, the horse battery staple is completely correct for the problem it's trying to solve. This article is about another (arguably more important) problem.
Yeah, I get why he was trying to tie his point to something well-known. But I found the title maddening. If he had said, say, "Why horse battery staple is solving the wrong problem," I would have read his article with interest. But my increasing irritation as I waited for him to deliver on the promise in the title kept me from properly appreciating his point.
Reading that you come off as an idiot who has no idea what there talking about. Password managers are banned from high security applications, because their not secure.
That said, the random part of randomly generating a password is an issue, but combining that with something you have is reasonably secure.
PS: Some places require a 20+ character password and will fire you on the spot if it's ever written down or stored on a device of any kind. 99% of the time it's overkill but real security is rarely convenient.
Having worked in places with those kinds of rules I can tell you most of those passwords is written down. At one government shop we did an audit and found the longer and and better a password is (and the faster it expires), the more likely users will write it down. Not only that, 70% of them put the written down password in their top right desk drawer.
We also found a large percentage of our fancy two person authentication safes had both combinations written somewhere on the signout sheet.
You can't make peoples' lives too difficult with security directives. They'll start to ignore you no matter how much you threaten them.
No offence, but if your not going to fire people when you find their password written down then there going to write their password down. Written policies are practically irrelevant it's enforced policies people pay attention to.
One example of security. Someone (A) giving a breafing has someone (B) grabs at it so they can read the document. At which point (A) pulls his sidearm and threatens (B). Later (A) is given an intense debriefing to verify that he was willing to shoot (B) and simply wanted to clarify the situation vs being unwilling to shoot (B). (B) was later told he was lucky not to have been shot.
One of the most common failure modes is screen captures which are often used for auditing. So there enabled even when everything is working correctly. For encrypted passwords that are sent directly to the clipboard you still get those files backed up which means you can brute force the password file without throwing up any red flags. Also, pasting passwords is disabled on many secure applications. For apps there stored on an unsecured device with a wide range of failure modes.
Exactly. Ironically it's good advice for master passwords too.
I use a password manager, but we should recognise there is one prominent issue with them, in that they create a single point of failure. The article suggests that the strength of algorithms like scrypt will keep you safe, but that doesn't stop low tech hacking methods (key loggers, shoulder surfing, etc...). We should be looking at using master passwords in conjunction with hardware dongles, if we really care about maximising security.
And possibly a handful of master passwords (and handful of dongles) of various levels of security. I'd rather not unlock my bank info every time I want to log into facebook.
This is a good point, and one I've wondered about since using LastPass. Having a segmented password safe would be nice for more secure accounts you use less often. I definitely wouldn't like to leave my password safe open in, say, a library.