Why are password managers considered good security practice when they provide a single entry for an attacker to get all of your credentials?
In: 21390
You have 30 safes in different banks. Each needs a 6 digit number to unlock as the password.
Because there are so many safes, you tend to use easy passwords. Something like your date of birth like 180317 to be used in all safes. The problem: once someone gets the password on one safe, they can access all safes now.
So you think of something more clever. Maybe an iteration based on where the safe is. E.g. Safe A is 180301, Safe B is 180302, Safe C is 180303, etc. It’s definitely more secure but it’s still bad practice. Hackers just needs to crack 3 safes and get the pattern to access 30 safes.
These are by far the most typical ways people kept passwords before password managers. Either using the same passwords for everything or a basic iteration.
Hackers might just try to crack your safe too. They don’t need to try every combination, just your birthday. So instead of doing 999999 passwords, they perhaps just need to do 3650 (10 years worth of birthdays). In practice, this is a dictionary attack, where hackers try commonly used passwords to limit the number of passwords they need to guess to crack a system. So you need a password that is not commonly used, which means it tends to get forgotten
The solution is obviously to have a random number for each safe, and keep a notebook of the passwords. Now the cracking of one safe doesn’t affect other safes, and you can use a completely random password so it’s not subject to the birthday hack mentioned earlier.
Even better is to keep the notebook in one safe (locked / encrypted), in your house where only you have access (offline) and you don’t have the password written anywhere. So with one password, you secure 30 safes. Then you can add more layers to protect that main safe like CCTV, guard dogs, a moat if you want to. All of which are not feasible to maintain for 30 safes. That’s what the password manager is
Latest Answers