What method of storing my passwords should I use?
21
1.1kṀ846
2030
81%
If I use a password manager, will I judge it to have been the better choice in 3 years?
50%
If I use a password generator, will I judge it to have been the better choice in 3 years?
38%
If I use a password scheme, will I judge it to have been the better choice in 3 years?

A "password scheme" being a private algorithm I can do in my head that accepts a website's identity and outputs a string of characters to use as a password. This makes me immune to credential stuffing attacks while still being convenient to use and not requiring me to store my password anywhere it could be stolen.

The main downsides of a password manager are that it provides a single point of failure if it gets hacked or my master password stolen somehow, and it's annoying to use if I have to log in on a new device. It also risks locking me out of my accounts if my hard drive fails; I could of course back it up, but if I do so in the cloud that's another risk vector.

The downside of a password scheme is that I'm not aware of any proper hash function that I can do in my head, so while using a password scheme does make me immune to traditional credential stuffing attacks, an attacker who's targeting me personally and manages to get 2 or more of my passwords might be able to reverse engineer the scheme and break into all of my other accounts. Also, it'll be difficult to design a scheme that can handle password requirements and enforced changes. And it won't catch phishing attacks that rely on presenting me with a lookalike domain name, whereas a password manager (partially) would.

When I'm calling a "password generator" is a hybrid approach, like Spectre. Has the benefit of not having to actually store my passwords somewhere like a password manager does, but uses a real hash algorithm and so is secure against reverse engineering like a password scheme is weak to. The main downside of a password generator is it will be annoying to have to copy-paste the password over each time I want to use it.

Password schemes and generators are also both worse at handling password resets. I can easily generate a new password by appending "1", "2", etc. to the input, but then I have to remember what iteration I'm on when logging in. (It's not that annoying to try multiple, but it is a little annoying.)

All options other than the one I use resolve N/A, the last resolves YES/NO 5 years after my choice based on, roughly, whether I feel like I would have been significantly better off choosing another other option.

Get
Ṁ1,000
to start trading!
Sort by:

Oh, another downside of a password manager is that if it's stored locally only I lose the ability to access all my accounts if I lose my hard drive.

@IsaacKing that should be a deal breaker anyways. You need the passwords on desktop and mobile.

@IsaacKing just backup the password manager's encrypted database to an external drive

I believe password managers generally need multiple things to go wrong in order to be compromised-i.e. even if someone steals your password, your account should be secure because of 2FA, and even if the password manager server gets hacked, your existing passwords should be fine as long as they haven't messed up the cryptography.

Also, however inconvenient you think password managers are, any reasonable password scheme you do in your head will be far more obnoxious.

bought Ṁ20 YES

Just use a security key as a second factor the password manager/use the key as the password manager

filled a Ṁ5 YES at 86% order

You might also want to consider something like this, which is kind of both: https://masterpassword.app/

@wolf Isn't it it just a password scheme that you do on the computer instead of in your head? Don't see why it's both

@wolf Oh this is neat. I'll add it as a third option.

@wolf that's really cool. What happens though if you are forced to change your password?

@AlexanderTheGreater I don't really use it, but there used to be an option to have a counter you can increment for a new password. I'm not sure if it's still possible.

bought Ṁ50 YES

Additional failure point for password scheme approach: when a password is leaked or a site requires you to update it it, you will need generate a new password and remember a new scheme. Over time your memory of this will fade and the number of passwords which diverge from your default scheme will increase.

No reason you can't do both

@redeagle How would I do both? Websites only accept one password.

@IsaacKing you create a password using the scheme and save it into your password manager (as opposed to using a generated password by the manager)

bought Ṁ10 NO

Password scheme won’t handle revocations. Also consider that applying AI to leaks of your passwords over time will make most schemes trivially reverse-engineerable.

Just remember them

© Manifold Markets, Inc.Terms + Mana-only TermsPrivacyRules