Nobody remembers their passwords anymore, not decent passwords anyway. If your password is P@assword1234 this post is not for you.
For those folks who do use a phrase that cannot be cracked in seconds seems the “forgot password” link is a valuable tool, faster than memory, and more honest than pretending we remember the names of three childhood pets we used six months ago. Sorry, Smokey-Thomas-Jonti.
Password reset emails are the real login method for many users. Everyone knows it but nobody admits it.
Sadly, IT standards force password changes every 90 days even though this practice weakens security. When you make people change passwords quarterly, they don’t create stronger ones.
And those systems demand eight characters minimum with at least one capital letter, one number, and one special character. “correcthorsebatterystaple” isn’t secure enough, but “P@ssw0rd!” is bulletproof. Yeah, right.
Of course nobody remembers passwords like “K9#mPx7!”. They’re impossible to remember by design.
Users develop ‘workarounds.’ Post-it notes under the keyboards, scribbled lists in pages at the back of their notebook, the kind of record you can find within a metre of someone’s office chair.
The safest password is one you can never possibly remember, like using UUIDGen in Terminal to generate a hexadecimal result, and some symbols and lower case characters, store that in your password manager.
Yet nearly every major password manager has been hacked at some point. LastPass suffered massive breaches in 2022, hackers stole customer password vaults. Researchers have found security flaws in 1Password, Keeper, Dashlane, and others. The tools meant to keep passwords secure from breaches keep getting breached themselves.
Chrome and Safari started generating random passwords because they knew users never would. Apple went further with iCloud Keychain, which syncs across all your devices and unlocks with your fingerprint or face. Not bad.
Biometrics work better than any password manager. Your fingerprint can’t be forgotten, written down, or guessed. They’re unique, always with you, and can’t be faked or stolen in a data breach. Yet.
Leave a Reply