I was gonna ask about the biometrics part in a separate question, but its both about security, so might as well combine it in one post.

Okay so I don’t use password managers. I just try to make easy to remember passwords 3-4 random words + 3-4 random numbers. Online accounts can’t be brute forced anyways. Edit: I mean most websites have log in limits don’t they? Maybe I’ve been mistaken?

For offline accounts, I just increase the words and numbers. For mobile I don’t use biometrics, although I’ve been testing whether or not I want a pin + no biometrics or alphanumeric password + biometrics. I just can’t decide.

    • rambles_shuck@lemm.ee
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      Nobody will try to brute force your account on a login form unless you are a high value target. Databases get leaked and password hashes with them. There are tools like haveibeenpwned which check your email against known database dumps that are available to everyone on the dark web.

      • megsmagik
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        I’m subscribed to haveibeenpwned but sometimes I read of breaches where password were plain text… a password manager is the best option, some of them also alert you of known breaches so you can change your password instantly

    • zerbey@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      1 year ago

      This is true, but if their password database gets compromised and they’re using insecure storage then they can brute force all day. There are server farms dedicated to doing just that and the vast majority of users are using simple, easy to guess passwords. The most common password? “password” [source: https://nordpass.com/most-common-passwords-list/]. Yes, we are a stupid species.