So you are telling me that if i lock my database with 48 character strong password paired with yubikey, thats less secure than memorizing 20 different passwords which are variation of the same password combined with finger muscle memory.
No. I'm saying protecting your passwords with a password does not increase the strength of those passwords.
Using a pw manager means you neither have to remember, nor type them yourself, so you can use ludicrous long, so very strong passwords. That what brings more security, yes.
But only if
a) your pwmanager can be 100% trusted, and
b) your pwmanager's pw ain't cracked.
Can you tell me why would you not trust 100% open source software that works offline and its available in freebsd repo ?
No.
I was talking password managers in general. When you drag my general statement into a specific context of one very particular picked point of course my statement becomes wrong, so you feel right.
But to me that's no way to talk to each other. At least not if the talk is not about who is right, or wins an argument (political, power), but to share informations, experiences, and solutions (scientific.)
I'm saying a pwmanager ain't not trustworthy just because it's a pw manager.
I'm pretty sure, there are trustworthy pwmanagers, but I also believe there are others, who are not.
And there is another point I hoped I don't need to elaborate (again):
When you reached a certain age you become wary, even distrusful, because you have so much experiences, so many disappointments, sometimes even got you into real trouble because of you too quickly, too blindly, too naive trusted people (things are made by people) of the kind:
"It's awesome! You
must use this! Forget everyting else! This has advantages only, and no disdavantages at all! And it's completely for free! They are not doing it for profit, but out of pure altruism, only, to make the world a better place! All doing it! So why you, old-timer, be such a blockhead and insist to stay in the stone ages forever?!"
Well, because sooner or later all -
all -turned out not to be the final wisdom.
Because there is no such thing that provides only advantages.
Everything always comes as a package deal, as a compromise between advantages, disadvantages, and a price you have to pay.
Sometimes new or other things really are a good or even better thing, yes. But knowing the nature of compromises all things bring, you know evaluation, and validation is needed, to make distinctions when to use it how for what, and when for what the conventional 'old' things are better. Asking if it's worth all the effort? In almost all cases anything
useful new is an addition to the existing arsenal, a new option, but extremely seldom really a full replacement, which always have to be handled very carefully.
Sometimes new things turn out to be not useful, or even a larger burden. They safe you something (time, effort, work, money) at one edge for the price they cost you the same or even more at another.
Sometimes they turn out after a while to be not for free anymore, but you are being charged for them - especially when it comes to software. (As I said above: I'm talking generally. Don't pick a single point otherwise! I do know that myself.)
And sometimes things even come really as a fraud.
When you have the experience, there are no things - no matter what "youngsters" believe, nor tell you; I once also was a quick believer, especially in new technical innovations when I was in my early twenties - there are no things, and never will be, that does not anyhow fit into that grid, you don't decide for anything anymore, before you didn't give it a really close look.
And as long as the things you have do all the jobs you need, you only give few things a closer look, because you don't spend any effort on something you don't need.
And "it's better, you moron!" ain't no convincing prove.
So, since my methods I have work for me - I never was hacked in the fourty years of my computer life. I catched me the one or the other virus in the 80s and the early 90s, but neither one of my machines, nor any of my accounts have been hacked (so far [at least I didn't recognized]).
I don't see a reason to change a winning team, unless I really have to.
To give a silly example:
Cars are a pretty neat thing. No question. And in the 1950s...~1980s everybody agreed everybody had to have one. But if you live in Manhattan without a parking spot, and your job is just in the neighbour block, a car makes no sense to you at all whatsoever. It was just a useless burden ("The Odd Couple" S4 E6 "The New Car" USA 1973, pictures that exactly.)
Bottom line - again:
I never said "don't use password managers! They are useless crap!" No! That was stupid, of course.
I only say a password manager does not increase security just because you have one, neither they solve all your password issues for you, just becasue you have one.
And I say as long as you can handle your passwords yourself (I said above to make a distinction between a single user private machine at home, and professional/public machines) check if there really is a need for one. Since at first - as all other software per se you additionally install - it is additional effort, and they increases the attack surface. And if handled wrong - or like you said
those can become a security gap instead.
(
Which does not mean I imply you handle your pwmanager wrong.)
All I'm saying is:
Always check what alternatives there are, which is best for what, and find your own compromise suit your individual situation - evaluate, validate. But beware of ultimate single solutions, and above all don't convince people to also fall for those, especially don't question their sanity if they don't. They may have their reasons. Maybe in some cases they even evaluated and validated on a topic more than you. And it's not their intention to make you look bad, but simply to point out for other options, and alternatives.
Since there is no such thing as the one and only ultimate solution.
Am i the only sane person here ?
I am neither capable, nor willing to answer that question.
