I'm aware of what constitutes a decent password, but typing in 15-30 random characters each time I lock my computer screen is starting to get a bit taxing.
How secure does my user password really need to be and what are the threats to it? Does the same apply to a root-enabled user as a "regular" user when it comes to password security?
For context, my threat model doesn't need to account for real people breaking in and accessing my computer, the damage would be very contained.
Bonus question - what are the risks of having a weak password on a root user on a spare laptop on the same network as my main device that is used exclusively for web browsing? Thanks.
Using random characters is dumb.
It incetivices you to write it down (which in and of itself isn't a completely terrible idea).
As an IT guy, let me tell you, STOP using random passwords!
Use passphrases instead, it is far easier to remember a sentence than a random string of letters and numbers.
Yeah that's my preferred method too. Bitwarden's password generator can create passphrases too, so I have it just create random ones for pretty much everything. The only ones I have to remember are the ones to unlock Bitwarden itself, and the one to unlock the decryption when I boot my PC up. So like two sentences essentially. I literally don't even know what the passwords are to anything else lol.
Agreed - the message I was trying to convey is that I use a very secure password, which sacrifices convenience for security - is this necessary though? I have no concerns related to memorising or particular difficulties typing it out as it follows a passphrase structure for the most part.
If you are only relying on the password as security, then yes, if you use MFA in adition to a password, they also probably yes.
So yes.
Very inconvenient for a PC login. Also, you need a password you can remember for your password manager at least
Yeah, but you still need a password you can remember to unlock the password manager
Yes, but the problem is memorizing multiple passwords not one. The majority of ppl is able to memorize a single complicated password.
For context, my threat model doesn’t need to account for real people breaking in and accessing my computer, the damage would be very contained.
I mean if you don't have open ssh ports on your computer or whatever I don't think you need a strong password, given that you're not concerned about physical access. I would say that at the very least have a reasonably secure root password (/user password if you're a sudoer/anyone else who can get root permissions with your user account) because if you end up with some malware on your computer that can, say, enter passwords, you don't want it to be ridiculously easy to bruteforce.
Great! This is the kind of answer I've been looking for. Thank you.
Home computer? I wouldn't even have a password. If someone has physical access to your PC there are ways for them to get what they want no matter how strong your password is. You just need it to be secure enough to prevent specific people you know have access from getting in. Family, friends, whatever. So basically the only risk is that you use a password that they know you use because you shared an account with them or something.
So don't even bother locking your front door then?
Use strong security, and enable encryption. Let's not make it easy for the rando who doesn't know much of anything.
Full disk encryption has been available to Windows since about 2010, with TrueCrypt/Veracrypt
So don't even bother locking your front door then?
statistically? yeah that's probably not a very big risk factor, and your house has windows if someone actually wants to break in.
So don't even bother locking your front door then?
Pretty much because cops might walk in if there's nothing physically stopping them but they'd have to do a bunch of paperwork if they smash my window to get in. In a world without cops I probably wouldn't lock my doors.
Let's not make it easy for the rando who doesn't know much of anything.
When and why is "the rando who doesn't know much of anything" accessing your home PC?
Not a direct answer to your question, but you can use passphrases instead to make it easier and faster to type. This is assuming your only option to log on to your computer and unlock your screen is to type in your password (e.g. no biometrics or hardware token options).
No biometrics! Just wanted to clarify the only difficulties related to typing my password are its length
I use a pretty simple password in my PC and Laptop, since, in theory, I'm the only one with access to them (oh, and my wife, of course).
I just don't have ssh enabled and the root passwords are ridiculously strong.
