[Retric]

Reading that you come off as an idiot who has no idea what there talking about. Password managers are banned from high security applications, because their not secure.

That said, the random part of randomly generating a password is an issue, but combining that with something you have is reasonably secure.

PS: Some places require a 20+ character password and will fire you on the spot if it's ever written down or stored on a device of any kind. 99% of the time it's overkill but real security is rarely convenient.

[tsotha]

Having worked in places with those kinds of rules I can tell you most of those passwords is written down. At one government shop we did an audit and found the longer and and better a password is (and the faster it expires), the more likely users will write it down. Not only that, 70% of them put the written down password in their top right desk drawer.

We also found a large percentage of our fancy two person authentication safes had both combinations written somewhere on the signout sheet.

You can't make peoples' lives too difficult with security directives. They'll start to ignore you no matter how much you threaten them.

[Retric]

No offence, but if your not going to fire people when you find their password written down then there going to write their password down. Written policies are practically irrelevant it's enforced policies people pay attention to.

One example of security. Someone (A) giving a breafing has someone (B) grabs at it so they can read the document. At which point (A) pulls his sidearm and threatens (B). Later (A) is given an intense debriefing to verify that he was willing to shoot (B) and simply wanted to clarify the situation vs being unwilling to shoot (B). (B) was later told he was lucky not to have been shot.

[tsotha]

It doesn't matter if you fire people. You're not going to catch the vast majority of them, and they know it.

[dllthomas]

From what you said earlier you can catch 70% of them pretty easy.

[tsotha]

Sure, if you go through all their stuff. And then what? Do we fire 70% of our staff?

[dllthomas]

Well, you could. Whether you should depends on the context, including importance of security, importance of institutional stability, other available mechanisms for punishment, &c...

But honestly, I mostly just thought the inconsistency between your two figures was amusing.

[morgante]

> Password managers are banned from high security applications, because their not secure.

Based on what? I've seen absolutely no evidence that good password managers (1Passoword and its ilk) are insecure.

[Retric]

One of the most common failure modes is screen captures which are often used for auditing. So there enabled even when everything is working correctly. For encrypted passwords that are sent directly to the clipboard you still get those files backed up which means you can brute force the password file without throwing up any red flags. Also, pasting passwords is disabled on many secure applications. For apps there stored on an unsecured device with a wide range of failure modes.