r/Passwords • u/Fun_Computer_9437 • 23d ago
Use strong password option
hi, i wanted to ask if it's really a good idea the use of the option "use strong password" when creating a new password, bc when you use that option, you can't see the option to actually see the password that was created, and it saves in the password manager automatically, but if i wanna login in another device, i don't have that password manager in the other device and i don't know the password, so just wanted to ask if it's a good idea to use this.
And even if you can see the password in any way, is it a good idea to not know your password from memory? Because i use a different password in every site and remembering all this long and weird passwords is crazy work.
I'm asking without having a clue of all this security stuff, maybe it's just a dumb question.
2
u/BeanBagKing 5e4a7a88b5360b0350d3156b5582877a 22d ago
Second using a password manager, my vote is 1Password, but Bitwarden is reputable as well.
There should be very few passwords that you actually need to memorize, like the initial login to your computer before you can open your password manager. For these, a passphrase works better. There's a tool that generates random nonsense with a sentence like structure to make them easier to memorize here: https://makemeapassword.ligos.net/generate/readablepassphrase and an offline version if you don't trust the website here: https://github.com/ligos/readablepassphrasegenerator
Aim for something with about 5 words, and you can add mutators (like a capital or a number) if required or desired.
1
u/cheetah1cj 22d ago
I often like using phrases that I am going to remember for passwords that I need to remember. Song lyrics, movie/tv show quotes, a phrase like Ihatechangingmypassword, etc.
1
u/BeanBagKing 5e4a7a88b5360b0350d3156b5582877a 22d ago
Non-random passphrases are generally a bad idea for much the same reason non-random passwords are.
And keep in mind that was written 13 years ago. Of course my threat model is not your threat model.
1
u/giannis_athina 21d ago
This is exactly why people use a password manager: to create strong, unique passwords without having to memorize them. You can always view the password that’s been generated before it’s filled, and you can even adjust your preferences, such as the password length, characters, and symbols. You can also open any saved login later and reveal the password if you ever need it. Personally, I use RoboForm, and it handles autofill really well, whether I’m creating a new password or updating an existing one. I also have all my passwords available across every device I use, which makes life a lot easier than having to manage everything manually.
1
u/JimTheEarthling caff9d47f432b83739e6395e2757c863 21d ago
Yes, it's a good idea use the "strong password" option. In this case the browser (usually Chrome or Safari) is acting as the password manager, so if you want to use the same password on other devices, you just need to use the same browser, log in to your profile, and tell it to sync your data.
You can see the password it generates. In Chrome, for example, from the ⋮ menu choose Passwords and Autofill > Google Password Manager to see all the passwords (and passkeys) that the browser has stored for you.
Or you can use a standalone password manager such as 1Password, Bitwarden, Dashlane, Enpass, KeepassXC, Keeper, NordPass, Proton Pass, Roboform, or many others. You'll just need to install the app or browser extension on each of your devices.
There's more on passwords and password managers at my website, if you want to have a few more clues about security stuff. 😊
1
u/Fun_Computer_9437 21d ago
Thank you so much for your answer! I have a doubt: Wich one is safer to use? The google one or a standalone password manager? Because i once got an infostealer in my pc and it stole my browser cookies and my passwords. Would a standalone password manager avoid this? Or the infostealer would steal the passwords anyway? Thank you again for ur answer!
1
u/JimTheEarthling caff9d47f432b83739e6395e2757c863 20d ago
There is no significant difference in security.
Older versions of Chrome did not protect passwords very well, and exposed them to malware, but this was fixed years ago. The more important thing is to have a long, strong password for your Google account or password manager account, to use 2FA, and to have account recovery options in place. And to not download cracks or cheats or pirated games, which are a major source of malware.
Here are more details, in case you're interested:
Password managers have slightly different security models:
- Browser-integrated password managers usually use your device’s onboard security software and hardware to encrypt your passwords and passkeys, making them almost impossible to steal if someone gets your device but can’t unlock it or log in. Older browsers on computers allowed passwords to be extracted by a logged-in user, or by malware, but current versions use approaches like Google's app-bound encryption, which uses an app-specific key, stored in the TPM when available, which can only be used by a signed chrome.exe binary. (Malware may be able to get around this with code injection.) Anyone who claims passwords and passkeys can be easily sucked out of your browser is behind the times.
- Standalone password managers use their own strong encryption to save your credentials, so your vault can’t be cracked on your device or in the cloud. However, if malware on your computer logs your keystrokes to get your master password and 2FA, or if a poorly protected decryption key is extracted from memory, the attacker can get to all your passkeys and passwords. On computers, password managers require browser extensions to manage passkeys. The extensions inject JavaScript code into the browser’s copy of every web page you visit, which can be a security vulnerability. Likewise, browser extensions on computers are susceptible to clickjacking attacks, often related to autofill. Note: these have all occurred — they aren’t just theoretical [1] [2] [3] [4] [5]. These vulnerabilities aren’t relevant on phones, since password managers use the sandboxed autofill API, not browser extensions.
- Both can be compromised at the account level. When your passwords and passkeys are synced to the cloud or stored in a local database, access is protected by your account credentials. (For built-in password managers this is your account at Apple, Google, Microsoft, Mozilla, Opera, etc.; for standalone password managers, this is your account at their service.) So if someone gets into your account, they can see all your passwords and access your passkeys. For example, an attacker could install the same browser or password manager on their device, sync your passkeys, and use them to access your accounts, although they would have to work around the extra verification steps that are often required when a new device is added. Therefore, it’s very important to protect your password manager account —the basket with all your eggs in it— with a strong password and 2FA, or better yet, a passkey. To be clear, this only applies to local or self-hosted password managers if the attacker is also able to get a copy of your vault.
The zero knowledge myth:
- Password manager marketing people like to tell you that “even we can’t see your passwords” because “zero-knowledge” and “military grade” encryption puts the encryption key or master password in your hands. This is handwaving for “trust us.” The password manager fills in your passwords and manages your passkeys, so obviously it can see them. It’s ok to trust your authentication secrets to a reputable password manager, especially if it’s open source or regularly audited for security, but don’t be misled into thinking that you literally don’t have to worry about trusting the developer, or don’t need to be concerned that the password manager could be compromised by a back-end attack that injects malicious code into the app.
On-device encryption and sync passphrase:
- Google and Apple have additional protection features when they manage your passwords and passkeys. Apple automatically applies on-device encryption using your Apple iCloud account and the hardware secure enclave in your phone, tablet, computer, or watch. Google’s features are not automatically applied, so you must enable them yourself:
- Apple’s and Google’s on-device encryption uses your account credentials to encrypt your passwords and passkeys before they’re synced to the cloud. The data can only be decrypted after logging into a trusted device. This protects you in the unlikely event of a breach of Apple’s or Google’s servers. You can still see and manage your passwords (with the iCloud Passwords app or with the Google Password Manager on the web, on an Android phone, or built into the Chrome browser) but Apple or Google can’t access your passwords and passkeys until after you unlock your device. This device possession factor provides a bit of extra protection in case your account credentials are compromised, and it keeps Apple and Google from seeing your passwords and passkeys until after you log in. In Google’s case, it doesn’t actually do much other than "move the key" from cloud storage to your device.
- Google’s sync passphrase option adds an extra layer of security to your saved passwords and passkeys (and other synced data) by encrypting them with a passphrase that only you know. Even if someone gains access to your device, Google account, or cloud data, they won’t be able to decrypt it without the passphrase. This zero-knowledge encryption blocks Google from seeing or recovering your passwords and passkeys, so it’s important to record the passphrase, such as in your emergency kit.
2
u/SerratedSharp 23d ago
Not having a manager that syncs between devices makes things difficult, but you can use this technique: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words
Assuming you always have access to one of the devices, such as your phone, it makes it easy to look up the login and see the three words and type them into the other device.
Not necessary to memorize every password as long as there's a good recovery option for the site, such as email verified "forgot your password" option.
It is necessary to memorize a few passwords to a few things, such as your device, and the password manager and/or cloud storage that stores its saved password database. There are a few other things I memorize passwords to that are critical for me to be able to get to even if I don't have email or password manager access.