# I hate passwords, help me out.

**URL:** <https://boards.straightdope.com/t/i-hate-passwords-help-me-out/831073>\
**Category:** In My Humble Opinion\
**Created:** [March 13, 2019, 3:35pm UTC](https://boards.straightdope.com/t/i-hate-passwords-help-me-out/831073 "2019-03-13T15:35:18Z")\
**Posts on this page:** 1\
**Page:** 3

<div class="post-metadata">

**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\
**Post date:** [March 15, 2019, 7:23pm UTC](https://boards.straightdope.com/t/i-hate-passwords-help-me-out/831073/41 "2019-03-15T19:23:25Z")

</div>

> [@RTFirefly](#):
>
> But here’s something that I wonder about: you know how your browser remembers usernames and passwords for you so you don’t have to type them in every time? That means Firefox or Chrome or whatever you use has them stored somewhere. A few months back, I was able to access my list of stored passwords in Chrome (I’ve already forgotten how), and copied them and saved them to a spreadsheet, which gives me access to them that isn’t dependent on Chrome.

The builtin browser password managers have been getting better, but I don’t follow it closely enough to know if they should be trusted with the password to important sites. I do the two tier thing in that I let the browser remember passwords for message boards and such, but not for my bank or email. As far as I’m concerned, the master list is still in my standalone password manager, and the browser stuff is just for convenience.

> [@Dead\_Cat](#):
>
> Is this not also an issue with using a password manager? OK, not “one password” perhaps, but the leaking of whatever the password manager requires for access. Or is this risk vastly reduced by the use of 2(+?) factor authentication?

The idea is that you never reuse your password manager’s password. It is the one piece of information that you must memorize, and it should be unique and complicated. Some sort of phrase or a random string you’ve committed to memory. Adding in real 2-factor authentication is even better. A standalone or phone based OTP, yubikey, or such will make it more secure.

I’m just not concerned about an adversary that can break AES-256, because if one even exists (and I don’t think one does), they are going to be on the order of a major government. They will not have to break my password database to get into my bank, they can just directly issue a warrant to the bank for what they need. I’m much more concerned about a bug in the password manager that renders the AES-256 encryption worthless. That is where reputation and quality come into play. A password manager that is known to quickly and effectively fix bugs is important.

[Previous page](https://boards.straightdope.com/t/i-hate-passwords-help-me-out/831073.md?page=2)