I know...But I Have a System
Where
PasswordsCon
BSides Las Vegas
Duration
43 min
Explains why staff resist password managers and how empathy and gentle onboarding can win them over.
Summary
The speaker, a software tester who studies how apps can be misused, starts from the point that password managers help both individuals and companies, yet many staff never adopt them. Rolling out a licensed tool is the easy part. The gap between accounts and real use is common, and it is often widest among managers, new hires and people going through difficult periods.
The middle of the talk looks at the reasons people give for not using the tool, such as already having a personal system, having nothing important to protect, losing faith after a technical problem, or finding setup boring. Ordering people to adopt it, through policy emails and threats, usually produces minimal compliance or quiet defiance. The speaker argues for respectful listening, paid time for setup (about an hour per person), getting managers on board first, and walking people through setup step by step in person. Drop-in help sessions, a playful summer event, and storing routine shared credentials in the vault were presented as ways to build trust and peer advocates inside the organisation.
The closing takeaway is that adoption depends on people feeling safe enough to learn, and that habits can shift later during life events such as marriage, having children, illness or divorce, when people reassess their routines. Audience questions covered SSO and MFA rollout, trust in IT departments, shared accounts and audit trails. The message was to build a security culture rather than simply mandate a tool.
Related talks
PasswordsCon·24 min
Dave Lewis
Argues that defenders should treat breaches as lessons, using anecdotes on shadow IT, default credentials and incident planning.
DEF CON Groups·27 min
C-Money · The Jackal · ReaperMonkey
Shows how DC862 founded and runs a DEF CON group, covering organizer roles, venues, speaker recruiting, outreach and succession planning.


