Memes

The only good passwords are those you don't know yourself because they are randomly generated and all stored in your password manager of choice.

Imagine a site telling you "Sorry, you can't use asdf123 as your password: you've already used it on that other site".

Counterpoint: Password Manager = One point of failure

Multiple Strong Passwords that have to be changed every 3 months even to sign on to your cornerstore rewards program without a password manager? Guess you're never accessing any account older than 3 months because you've forgotten th3 b1lli0n$ oF s+r0ng p4s5w0rds Y0u h4Ve cr3atEd!

So your password is cardboard fort?

Just use a password manager, then you get the benefits of having a single password to remember without the security-related downsides.

Everyone talks about password managers these days, but isn't that telling the hackers exactly where to go to get all your passwords? Seems like a much higher chance of catastrophic failure to me if you have a single point of entry.

It was literally a battle for me to have a strong unique password for our baby monitor... Wife was not happy about that but I came out on top.

I've actually come up with a way to have a complex and unique password for each service which is also resilient againt forced password changes, doenst require a password manager, and if Im being tortured I still wont be able to tell them what it is because I dont know it unless Im at the login screen. If the service changes the layout of their login screen though, Im fucked.

I came up with a formula for my passwords - as easy to remember as a single password and makes a unique login for every site feasible without a password manager. Can be updated as often as you like and all you gotta do is remember the latest version of the formula. At the very least, the hashes will be different and it'd take someone having more than two of my passwords to figure out the pattern.

I also use over 100 email aliases with my own domain name so that my most important accounts have a separate login that isn't a common domain that wouldn't be easy for someone to guess.

It would take a lot of concentrated effort for someone to get at any of my important accounts, and even my less important ones would be pretty difficult to get into even if multiple accounts are compromised, due to using a smaller pool of aliases under common domains for less important accounts.

Someone got into half a dozen of my accounts a few years ago and I finally started taking security seriously.

At this time of day, in this part of the country, localized entirely in your accounts?

Not really though. Once the password has been leaked, it needs to be cracked. And that usually doesn't happen when the password is strong enough.

Except the password wasn't hashed but then the company belongs to get sued to bankruptcy