npub1q5l4y898qvhzghc665jrqj6kcw4p89gha56azkt7j0jm9299wzcqt7ywp3 (npub1q5l…ywp3)
> The only password that needs memorizing is the password manager. All others should be auto-typed.
You also need to decrypt the disk if you're using FDE, log into the machine, then decrypt your password manager. Those are three passwords that should be memorised and can't be auto-typed.
> they should never be typed in the first place let alone memorized
I disagree on both counts.
Memorising a password is perfectly fine and even desirable in some situations. However infeasible, password managers can be cracked. Unless you're tortured or drugged, odds are good that your brain can't be.
Manually typing passwords is 100% necessary when you're logging into many machines often, like we have to do because we set machines up for internal use and for clients. It's also necessary when logging into things on machines that don't have an installed password manager.
> All others should be auto-typed. Do not use clipboards either.
I wish these were feasible, but they're not. Bitwarden is the password manager I always recommend because it's open source, the cryptography is very strong, and the free tier is perfectly sufficient for the vast majority of people. Their desktop app is electron 🤮 and doesn't support any form of auto-type and likely never will because electron 🤮. Many other password managers are exactly the same. The only one I know of that has auto-type off the top of my head is KeePassXC and shell scripts that use xdotool/ydotool with pass or gopass or one of the other implementations.
Manually typing passwords is only a problem if there's a physical keylogger between your keyboard and the password field. If it's a software-based keylogger, auto-type from your password manager is exactly the same as manually typing them. I agree that it's always best to avoid using a clipboard, but imo that's just not a feasible mandate in the real world.
Amolith /
npub1aa…ztfh7
2023-09-17 17:49:53
in reply to nevent1q…qcrj
Author Public Key
npub1aal5r6kgsqc5nrewnzqdgzujuv3kqfaxxjqpwv4x98wgqgyzv7yq9ztfh7Published at
2023-09-17 17:49:53Event JSON
{
"id": "4cc325c7fd5e671cb45a3c69903d843b512e759ad898df601ca7ae2ba45ee5e5",
"pubkey": "ef7f41eac88031498f2e9880d40b92e3236027a634801732a629dc8020826788",
"created_at": 1694972993,
"kind": 1,
"tags": [
[
"p",
"053f521ca7032e245f1ad524304b56c3aa139517ed35d1597e93e5b2a8a570b0",
"wss://relay.mostr.pub"
],
[
"p",
"f4cd659fcfa7c5ed3cb28e3ecd3479420fd6b367f3dfad0d5a6b3b4dbcbcdbb0",
"wss://relay.mostr.pub"
],
[
"e",
"ba19d21573926ae6757c838a0572255ecc2e1b68d98d98e43aedc6dc9b2faf6f",
"wss://relay.mostr.pub",
"reply"
],
[
"proxy",
"https://nixnet.social/objects/be6c0ed7-bf5e-420b-bbb4-923dc6f7ada6",
"activitypub"
]
],
"content": "nostr:npub1q5l4y898qvhzghc665jrqj6kcw4p89gha56azkt7j0jm9299wzcqt7ywp3 \n\u003e The only password that needs memorizing is the password manager. All others should be auto-typed.\nYou also need to decrypt the disk if you're using FDE, log into the machine, then decrypt your password manager. Those are three passwords that should be memorised and can't be auto-typed.\n\n\u003e they should never be typed in the first place let alone memorized\nI disagree on both counts. \n\nMemorising a password is perfectly fine and even desirable in some situations. However infeasible, password managers can be cracked. Unless you're tortured or drugged, odds are good that your brain can't be.\n\nManually typing passwords is 100% necessary when you're logging into many machines often, like we have to do because we set machines up for internal use and for clients. It's also necessary when logging into things on machines that don't have an installed password manager.\n\n\u003e All others should be auto-typed. Do not use clipboards either.\nI wish these were feasible, but they're not. Bitwarden is the password manager I always recommend because it's open source, the cryptography is very strong, and the free tier is perfectly sufficient for the vast majority of people. Their desktop app is electron 🤮 and doesn't support any form of auto-type and likely never will because electron 🤮. Many other password managers are exactly the same. The only one I know of that has auto-type off the top of my head is KeePassXC and shell scripts that use xdotool/ydotool with pass or gopass or one of the other implementations.\n\nManually typing passwords is only a problem if there's a physical keylogger between your keyboard and the password field. If it's a software-based keylogger, auto-type from your password manager is exactly the same as manually typing them. I agree that it's always best to avoid using a clipboard, but imo that's just not a feasible mandate in the real world.",
"sig": "b734a45147550014e3a848b44e1383e2d839910e4ff05ee47d788421f5448f1488c4dac58dc5b701e0f59974976c2b0a40f09ae1ccc981359639399e08f40b63"
}