It is actually very hard to force password manager usage. You can encourage it, educate, but forcing it? How do you do that.
replyPasskeys.
replyYeah. I prefer 2FA. My passwords look like 1bTsby#ZNaz1TJDDzglL&MmD&HOCMd^Cc and having a separate device with a TOTP token is more secure.
replyI won’t be victim of url jacking since the password manager feels the form. And if it can’t then the domain name is wrong.
And if you steal all the keys/passwords, unlike with pass keys, that’s not enough. I don’t like having all my eggs in one basket no matter how shiny.
Passkeys are really long password locked to a domain, i.e. no different* than your setup.
replyPasswords are just a worse, hacky version of passkeys.
*They are private/public keys, so they can’t be MITM.
[dead]
replyHow do you force password manager usage?
replyTechnically or socially?
The second one is hard, the first one can be done easily - just require the passwords to be 14/16+ characters, multiple symbol domains and calculate tempo of input. Slower than 350ms between keystrokes - error message.
Those who can type that fast already are using pw manager or you can just skip this 0.001%.
replyDoing that will certainly get people to use a password manager.
replyBut it doesn't say which password manager.
The most popular password manager is some text/word/excel document on the desktop.
I have no evidence to back this hypothesis, but I wonder if that’s still more secure than using bad passwords.
replyEveryone's password is now 1q1q1q1q1q1q1q1q1q1q!Q
reply