Passwords - and multiple devices

[Dave2002]

I still dislike the way so many websites now use passwords. They don't even remember that one was logged in on the same machine just a few minutes ago.

Things get worse with 2nd factor authentication - which admittedly sometimes has ostensibly a protective benefit. So protective that when one of my banks changed the way I was able (not) to log in, that I couldn't access my account for over six months, and - yes - when I did get back to look at it there were problems which I would have noticed much earlier if I'd had access, and I still need to fix.

Some websites are really not that important - either re security or for other reasons, so why do we have to be tracked by them all the time? The BBC sites are not so much different either. "You only have to register once ...." Well - no. If one uses different devices, or different browsers, or there's a system change, then one has to go round the loop again, and again, and again.

Turns out, I think, that the links to BBC iPlayer to make our smart TVs work are probably different from the ones for BBC Sounds on computers and tablets.

Oh - I know - someone will tell me that I should just store all my passwords "in a cloud" - such as "trust Apple".
What - so that if anyone ever busts the security on a remote system they don't just have one password, but every password!

[ardcarp]

Passwords? AAaaarrrrgggghhhh!!!!!!!

[vinteuil]

Passwords? AAaaarrrrgggghhhh!!!!!!!

... sounds like a good one


.

[Old Grumpy]

... sounds like a good one


.

Already use it...



...Oops - security breach

[Serial_Apologist]

... sounds like a good one


.

Nevertheless... fortunately I don't need to access that many sites or links requiring passwords. And my bank has not to my knowledge changed mine or required a new one for a long time - famous last words! How could one possibly manage ones accounts? - we're so card-dependent nowadays for shopping purposes, especially since the pandemic, that constant monitoring is essential if one is not to incur banking fines - something which has happened to me when direct debiting services suddenly change the date of deducting without warning.

[Boilk]

My password "system" is to have a different password for each site I use, but without having to remember what the hell it is. This is how it works...

The same 15-character string (including one special character, capitals and numerics as these are sometimes mandatory) is preceded by two variable characters. The 2-character prefix depends on what the site is; for example, if I had a Twitter account (which I don't) the prefix would be "tw", or if I banked with HSBC the prefix would be "hs". That way the platform reminds you of the prefix to use, and you supply the standard suffix, all the while keeping each password unique.

Of course you don't share the main character string with anyone, including your web browser!

It usefully stands the test of time too, like when I revisited another forum after 5 years ....and got straight in!

[Dave2002]

My password "system" is to have a different password for each site I use, but without having to remember what the hell it is. This is how it works...

The same 15-character string (including one special character, capitals and numerics as these are sometimes mandatory) is preceded by two variable characters. The 2-character prefix depends on what the site is; for example, if I had a Twitter account (which I don't) the prefix would be "tw", or if I banked with HSBC the prefix would be "hs". That way the platform reminds you of the prefix to use, and you supply the standard suffix, all the while keeping each password unique.

Of course you don't share the main character string with anyone, including your web browser!

It usefully stands the test of time too, like when I revisited another forum after 5 years ....and got straight in!

Your approach is vulnerable to an attack by a determined attacker or group of such, as only two characters are different in each password. If everyone adopted this method, attackers would have a much easier time as they would know the nature of each password. However, the wider variety of different approaches to password generation by different people does reduce this risk considerably.

It is interesting that you don't share your password with your web browser. Presumably you think that this might cause issues. Many people would perhaps find that too cautious. I don't, but is there evidence that this might be a problem?

[Beresford]

I guess the issue is that anyone else using that computer could probably see all the stored passwords.
I use the same username and password for blogs etc, but not for financial accounts, or any site where things can be bought in my name.

[Boilk]

Your approach is vulnerable to an attack by a determined attacker or group of such, as only two characters are different in each password.

The fixed part of the password is 15 characters (where not exceeding a site's maximum) and comprises some caps and special characters. And when creating such a password during the registration for a new site, the site usually feeds back with "strong" or "very strong" security.

It is interesting that you don't share your password with your web browser. Presumably you think that this might cause issues. Many people would perhaps find that too cautious. I don't, but is there evidence that this might be a problem?

Definitely yes. As Beresford says just above, browsers can store passwords if you want login information remembered. For example, in Mozilla Firefox's top panel at the far right-hand side there is a dropdown option entitled "Logins and Passwords" which lists the lot, if saved! I do use Firefox, but one browser I like more for security and added privacy is Brave.

[richardfinegold]

Passwords? AAaaarrrrgggghhhh!!!!!!!

May I borrow it?

[vinteuil]

May I borrow it?

... already claimed (#3 and #4 supra)

.

[Bryn]

I still dislike the way so many websites now use passwords. They don't even remember that one was logged in on the same machine just a few minutes ago.

Things get worse with 2nd factor authentication - which admittedly sometimes has ostensibly a protective benefit. So protective that when one of my banks changed the way I was able (not) to log in, that I couldn't access my account for over six months, and - yes - when I did get back to look at it there were problems which I would have noticed much earlier if I'd had access, and I still need to fix.

Some websites are really not that important - either re security or for other reasons, so why do we have to be tracked by them all the time? The BBC sites are not so much different either. "You only have to register once ...." Well - no. If one uses different devices, or different browsers, or there's a system change, then one has to go round the loop again, and again, and again.

Turns out, I think, that the links to BBC iPlayer to make our smart TVs work are probably different from the ones for BBC Sounds on computers and tablets.

Oh - I know - someone will tell me that I should just store all my passwords "in a cloud" - such as "trust Apple".
What - so that if anyone ever busts the security on a remote system they don't just have one password, but every password!

The BBC iPlayer/Sounds login is a farce. It is just so easily circunvented.

[Leinster Lass]

The BBC iPlayer/Sounds login is a farce. It is just so easily circunvented.

Are there any drawbacks to never logging out?

[Dave2002]

May I borrow it?

Not such a good idea. Score on password meter - http://www.passwordmeter.com/ is zero.

[Bryn]

Are there any drawbacks to never logging out?

There is no real need to ever login if you 'get_' a freely available third-party program to access the iPlayer/Sounds to save, rather then immediately view/listen.