• bdonvrA
    link
    fedilink
    arrow-up
    23
    ·
    5 months ago

    Use a password manager. Every account gets a different (and strong) password.

    • zaphod@lemmy.ca
      link
      fedilink
      English
      arrow-up
      19
      ·
      5 months ago

      Obviously any reputable password manager is better than none at all, but I strongly recommend using KeepassXC on the desktop and a suitable mobile client for phones and tablets, and syncing the database across devices with an encrypted peer to peer sync tool like Synching.

      I’ve always been nervous about being part of a large, juicy cloud hosted target, and LastPass was the proof that those concerns are well-founded.

      • bdonvrA
        link
        fedilink
        arrow-up
        15
        ·
        5 months ago

        Yep. If you’ve got the technical knowledge and a server, self hosting Bitwarden is quite easy. And your vault is end to end encrypted.

      • esaru@beehaw.org
        link
        fedilink
        arrow-up
        2
        ·
        5 months ago

        KeepassDX for mobile is on F-Droid and can use the same file as accessed from KeepassXC from Laptop, synced by Syncthing.

        • zaphod@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          ·
          5 months ago

          I can also recommend Keepass2Android, which I’ve been using for years.

      • falsemirror@beehaw.org
        link
        fedilink
        arrow-up
        12
        ·
        5 months ago

        Many PW managers let you generate passphrases, which are all around better than random strings. Length is the most important factor so

        finance-caffeine-utopia-redress-unseen

        Is way stronger and easier to remember (and type) than

        Fl7$j4FWw)&5O

        • Myaa@beehaw.org
          link
          fedilink
          arrow-up
          3
          ·
          5 months ago

          Huh, TIL. I had no idea that was an option but that’s super useful for things I need to type in on a device with no keyboard, or even things I can’t access my password manager for. Thanks for the protip there!

        • Murkhat@feddit.de
          link
          fedilink
          arrow-up
          2
          ·
          5 months ago

          Is it really safer? I mean when trying to bruteforce a password, one would have to make a guess whether it’s a passphrase or not. But if you decided to check for pass phrases, wouldn’t the one you posted be cracked in 5 times the amount of words in that dictionary? I’m not sure how large the vocabularies of the generators are, but I would guess a random 17 char password might be safer than a 5 phrases password?

          • Scary le Poo@beehaw.org
            link
            fedilink
            arrow-up
            5
            ·
            5 months ago

            but I would guess a random 17 char password might be safer than a 5 phrases password

            And you would be very wrong about that. A 5 phrase password has entropy. “finance-caffeine-utopia-redress-unseen” is 28 characters. If you add in a different symbol between the words and add a number somewhere, this password becomes incredibly difficult to brute force.

            I’ll let xkcd explain it better.

            • Murkhat@feddit.de
              link
              fedilink
              arrow-up
              1
              ·
              5 months ago

              Youre right,different separators, numbers and even capital letters change my theory alot

        • esaru@beehaw.org
          link
          fedilink
          arrow-up
          2
          ·
          edit-2
          5 months ago

          And pass phrases are faster to type and with less typos even though they need more characters than passwords to be the same secure.

      • bdonvrA
        link
        fedilink
        arrow-up
        8
        ·
        edit-2
        5 months ago

        You don’t need to make it that long.

        And also most TVs or whatever you’re streaming with has a way to type from your phone nowadays. Apple TV, Chromecast, Android TV, heck I think even Xbox.

        It’s kinda nice on Apple TV your phone will suggest autofill passwords for the TV, even from theirs party password managers like Bitwarden.

        • abbadon420@lemm.ee
          link
          fedilink
          arrow-up
          4
          ·
          5 months ago

          Android tv’s arent that old. 10 years max. 5 years since it’s affordable for most people. Is it unreasonable to own a 5 year old non-smart tv? I think not. I think it’s weird that so many people assume everyone owns a smart tv.

          • Evkob@lemmy.ca
            link
            fedilink
            arrow-up
            6
            ·
            5 months ago

            In what scenario would you need to type in a password on a non-smart TV though? Parental lock?

          • bdonvrA
            link
            fedilink
            arrow-up
            4
            ·
            edit-2
            5 months ago

            You’re not wrong but in what context would you be putting in passwords on a non-smart device

            Also it’s not just smart TVs. You can hook up streaming sticks and boxes and game consoles to anything with an HDMI port

      • parpol@programming.dev
        link
        fedilink
        arrow-up
        3
        ·
        5 months ago

        As long as you generate the PW with numbers and special characters included, a 14 character password will take over a hundred years to crack.

        50 is so unnecessarily large, it closes in on the age of the universe amount of time needed to brute force.

        • jarfil@beehaw.org
          link
          fedilink
          arrow-up
          4
          ·
          edit-2
          5 months ago

          For symmetric keys, since they cannot be weakened using quantum computing, their strength can be assessed by their bit-equivalent amount of entropy:

          • 40 bit or less - easily breakable
          • 64 bit - not so easy, but doable
          • 128 bit or more - basically unbreakable

          Those are equivalent to, respectively:

          • 0-9 - 12, 19, 38 characters
          • a-z - 9, 14, 28 characters
          • a-z0-9 - 8, 12, 25 characters
          • A-Za-z0-9 - 7, 11, 22 characters
          • A-Za-z0-9+special - 7, 10, 21 characters

          Moral of the story: drop the special characters, and even the numbers… and even the uppercase. A 30+ character long all-lowercase pass phrase, is already unbreakable.

          Check @[email protected]:

          finance-caffeine-utopia-redress -unseen

          …is already over 128 bits.

          PS: Correct horse battery staple