Ask Slashdot: How Do You Manage Your Passwords? 445
Albus Dumb Door writes "As an IT professional, I've got a problem common to many of you: dealing with a lot of passwords. Memorizing them all becomes harder with age and and an increasing number of passwords. I will forget them eventually. I am obviously unable to use something online, like Last Pass and 1Password. Using a single password for all the systems is also obviously out of the question. I know that there are a few apps for cell phones for managing passwords (like Phone Genie and mSecure), but a cell phone, unless it's kept in offline mode (and even then), is still a security risk and I'm pretty sure my employers wouldn't like me having their passwords on my cell phone. I've also taken a look at things like the YubiKey, but changing the authentication scheme of most of the systems is not an option. The only interesting option I've seen so far is the Pitbull Wallet, but they just started taking pre-orders on IndieGoGo and are not expected to deliver until August. Amazon has some hardware password managers as well, like the RecZone and Logio, but either the price or their reviews scared me away. So how do you guys prefer to manage your passwords and what do you recommend?"
Air Gapped Box (Score:4, Interesting)
It's not portable, and this is just what I do at home so may not scale well to the office, but I've basically got an old intel atom box (MSI Wind PC) running linux (slackware) with no network connection and full disk encryption just using luks/dm-crypt. I keep passwords, banking numbers, and other bits of sensitive info on there. No fancy management software, just plain old text files. I have it hooked up through a KVM and I just leave it running all the time (with locked screen), so it's nothing to switch to it when I need to use an old password or update a password when I change one.
Files are backed up locally using rsnapshot (for history), and then that's periodically copied to one of 2 (also encrypted) USB thumb drives (I leave on plugged in the back and periodically swap them).
Primitive, but sometimes that's what works. You could probably do the same with a raspberry pi at this point (disk encryption might be fun though).
Also this topic comes up like once a month, and the answer has not changed in years. Stop asking!
Completely off topic: what would be the best way to physically disable the wifi capability of a device. Obviously you can disable in software, but I'm the paranoid sort, and would love a way of knowing that my IP web cam is not gonna be doing anything with that wifi antenna. Thinking maybe some kind of terminator or some other way of "absorbing" the signals.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
all macbooks have the wifi and bluetooth on a small card. you can open the bottom and pull out the card. the camera, I don't know. drill it out? probably wouldn't crack the glass.
Re: (Score:3)
Apple will remove the camera on any of their shiny things for $99.
"Obviously" not Last Pass or 1Password (Score:5, Interesting)
Re:"Obviously" not Last Pass or 1Password (Score:4, Insightful)
I don't see the "obviously" either. I use 1Password and it's not web based, the secure password database file sits in Dropbox and is synced to all my computers and my iPhone. Works great.
Re:"Obviously" not Last Pass or 1Password (Score:5, Insightful)
If the file is encrypted before it goes on dropbox, then its as secure as your encryption. And if you don't trust any encryption, then why are you trusting any website with any data that would require you to put up a password to protect?
Re:"Obviously" not Last Pass or 1Password (Score:4, Interesting)
What if he doesn't trust the implementation of the encryption in the password manager?
These "what if's" are getting a bit silly. I'm not saying he should trust that implementation, but if he has reason not to, I'd hope that he's also smart enough (or believes he is) to pick an encryption scheme he does trust. We're really just talking about how paranoid someone wants to get with passwords that will be used on a lot of hosts, many of which are problem secured weakly. IE. seems like you're trying to create a flow chart out of this thread :-)
* 1password +dropbox or similar stuff? - don't trust dropbox ... with the vm files mounted via loopback encrypted again? ... this list can keep getting longer and longer.
* 1password + your own sync or backup? - don't trust 1password encryption
* clipperz + your own sync or backup (btw, clipperz is open source)? - not sure what you/he may not trust
* name-your-own-encryption + a text file? - maybe you don't trust your own network connected OS
* any of those, put inside a vm?
* any of those, put inside a vm using full disk encryption in the vm?
*
* any of those on separate hardware (Raspberry Pi, an old android phone, HDMI dongle PC, etc)?
The orig question was "what do you use?", not "what should I use if I'm a paranoid schizophrenic that doesn't trust anything, especially the aliens that keep talking to me in my sleep?"
To answer the orig question: I use an encrypted text file. I occasionally check out some of the offerings out there like lastpass, keepass, clipperz, etc, and even recommend those to others, but my simple encrypted text file has served me well for a long long time, and it is by far the fastest interface there is (vim). There is a security risk with it - one could do memory scraping while it's open to read the buffers, or use a key logger to snag the password for the master key, etc; and there's portability issues - it's trivial for me to get access setup once I'm on a linux OS anywhere in the world, but I don't always have that on me, and that hasn't been a problem.
Re: "Obviously" not Last Pass or 1Password (Score:2, Redundant)
Here's an idea - you can NOT put 1password db on dropbox and still use 1password
Re: (Score:3)
more info please. I got the email yesterday, but I didn't see how it related to the NSA.
thanks.
Re: (Score:2)
Re: (Score:2)
Completely off topic: what would be the best way to physically disable the wifi capability of a device. Obviously you can disable in software, but I'm the paranoid sort, and would love a way of knowing that my IP web cam is not gonna be doing anything with that wifi antenna. Thinking maybe some kind of terminator or some other way of "absorbing" the signals.
Find and remove the antenna for wifi. If that's not possible, make an impromptu faraday cage around the body of the camera. It won't completely block the signals but it should reduce it significantly.
passwords.txt (Score:4, Funny)
on my desktop.
Keepass (Score:5, Informative)
extensible, open source, active project...what's not to like?
Re:Keepass (Score:5)
Re:Keepass (Score:5, Informative)
Combine this with a keyfile that is not stored on the online syncing service. So if the keydb itself is obtained, it's useless without the keyfile (never put online) and the keyphrase. If someone obtains your phone or other device, they'll have the keydb and keyfile but not the keyphrase. Of course, nothing will protect you if your device is compromised (i.e. file access + keylogging) without your knowledge.
Re:Keepass (Score:5, Informative)
There are ports for just about everything, including Android, which is incredibly handy.
I particularly like the Firefox extension (KeeFox), which can be configured to automatically enter credentials as well as save new credentials entered in Firefox with one click.
Re: (Score:3)
Write them down. (Score:5, Insightful)
For work, write them down on physical paper and keep them in your physical wallet.
You'll notice if your wallet goes missing.
For home, write them down on physical paper and keep that somewhere safe.
Re:Write them down. (Score:5, Insightful)
For an extra layer of security, come up with some really basic cypher that you can do in your head. It doesn't have to withstand rigorous cryptanalysis, just has to hold up long enough for you to notice your wallet is missing and change all your passwords.
Even something silly like taking the third character and sticking it on the end is probably enough.
Re: (Score:3)
And, you still need to have a list of all the accounts which have passwords somewhere, so you know what needs to be changed.
Re: (Score:2)
Re:Write them down. (Score:5, Insightful)
If they're in your wallet then they're work passwords. So you contact the other admin and have her change your passwords.
And for work this should be documented already. Along with reset procedures and contact numbers.
For home, having them stolen is less of a risk. But you can always keep a copy (encrypted or not) with someone else in your family or a trusted friend or a safety deposit box. You're probably more at risk of them being destroyed in a fire or something. So treat them the same as any other important document.
Re:Write them down. (Score:4, Insightful)
Sounds good.
And you might also want to keep a few additional passwords on that piece of paper. For those circumstances where you're suddenly required to have a new one (X characters, Y capitals, Z numerals) for a new application or whatever. Always nice to have one ready instead of trying to think one up on the spot.
Re: (Score:3)
That's pretty much what I do during my contract on the ship. I don't have a wallet, but have a pocket notebook and there I write down the network configuration, some usernames/passwords for some servers etc (every ship is different). With time, I remember all of this stuff so I destroy the papers anyway.
I never write down which credentials are used for what, this is what I know, and always add some logical sounding letters/number to every piece of information but in some way that I always know what is garba
LastPass (Score:5, Insightful)
Re: (Score:3)
That and Lastpass encrypts/decrypts the password store on the client side. Only the encrypted database is ever sent over the wire. It's not perfect, but Lastpass has been great for me. Worth the $12/year. I don't know any of my passwords now except one, and my yubikey protects the Lastpass master password.
Re: (Score:2)
Or 1Password. You can use an iPhone or Android phone. The data is encrypted. Yes, the NSA can probably get to it, no they probably wont bother. Should be adequate for most users. If you lose the phone and you're worried about somebody breaking the encryption you can log into DropBox (or whoever you have the file stored with) and delete it or just change the password from another device.
Not perfect, but pretty damned good and a hell of a lot more user friendly than some of the Totally Paranoid suggestio
Re:LastPass (Score:5, Interesting)
Re:LastPass (Score:5, Informative)
They can't, because they don't have them. They have a bunch of encrypted blobs.
Re: (Score:2)
From TFA you cite:
"However, installing Java and loading and running the Java applet can be annoying. So in 2006, Hushmail began offering a service more akin to traditional web mail. Users connect to the service via a SSL (https://) connection and Hushmail runs the Encryption Engine on their side. Users then tell the server-side engine what the right passphrase is and all the messages in the account can then be read as they would in any other web-based email account.
The rub of that option is that Hushmail ha
Re:LastPass (Score:4, Informative)
The select the option on the website that allows you store your database in europe. (requires paid version currently)
https://lastpass.com/use_eu.ph... [lastpass.com]
There is but one true password manager (Score:2, Informative)
Get 1Password. There is a version for every platform, including mobiles. It stores your full logins and integrates with popular browsers: just click a toolbar icon, enter the one master password you have to remember, and you can log onto MightyMegaBank just by clicking on its name. The program will also optionally generate big random passwords to replace the short crappy ones that you used to be able to remember.
Re:There is but one true password manager (Score:5, Informative)
I can understand not reading TFA, but did you even RTFS? What part of
I am obviously unable to use something online, like Last Pass and 1Password.
were you unable to understand?
Now, I have absolutely no idea why poster "obviously" is unable to use it, but it's already ruled out.
Re: (Score:3)
This is called "challenging the assumptions." You, he, (and I for that matter) agree that it's not obvious why he's unable to use it. If the article poster is unaware that LastPass or 1password can work completely offline, then perhaps that information would change why they're ruled out. He might have another reason, but since it's not as obvious to us as it is to him, it's more than fair to raise it, especially when you're getting the advice for free.
Personally, I only tolerate not being able to question a
Re:There is but one true password manager (Score:5, Informative)
Because the OP is totally wrong, is why. 1Password keeps its data file locally. There are all kinds of synchronization features, which you don't have to use if you want to avoid online operations.
OP may have been thinking of 1PasswordAnywhere, which is the all-online version.
Re: (Score:3)
Because the story poster said, 1password was off the table.
Instead of just saying, "Use 1password", you should have challenged the assumption, and asked *WHY is it off the table?*, and then gone on with the benefits. Applehu Akbar also never mentioned its offline capabilities.
In addition, the subject line "There is but one true password manager" smacked of fanboism. It sounded like, "I don't care what story poster said, I like mine."
I'm quite willing to take my lumps, now that the false assumption in
Re:There is but one true password manager (Score:5, Informative)
Keepass (Score:5, Informative)
I use Keepass.
I store my keepass database on dropbox, this way it is accessible from my iphone, ipad and all my laptops and desktops. Any changes I make are synchronized between devices automatically.
Keepass will auto fill in websites with plugins like KeeFox for Firefox, or launch Putty.
I don't even know what my Slashdot, eBay or Amazon passwords are, as they are all about 64 random characters each.
If you choose to go this route, it makes sense to have a very strong passphrase, as such, my passphrase exceeds 128 bits. A key file is also an excellent option.
Re:Keepass (Score:4, Insightful)
Came here to say this.
I've used KeePass (or, in my case, KeePassX since I'm on *NIX) for about 6 years and it's been great. Encrypted local storage that I can sync between devices if I want, with an Android app (KeePassDroid) available makes life easy. It's also the only approved password storage method where I work.
Re: (Score:2)
Re:Keepass (Score:4, Informative)
The keyfile is in my dropbox folder, I have dropbox installed on all my devices. On the iphone or ipad I just need to select the keepass file and it will open in the keepass app.
Then my passphrase is required to open the encrypted file that contains the list of my passwords.
This step is only required on my iphone/ipad if the keystore is out of sync with the dropbox folder. Otherwise the file remains cached on my portable device.
Re: (Score:2)
So, do you put the keyfile in your Dropbox folder, or no? If so, how is that more secure than using a password? Otherwise, do you just manually move it to different devices with a thumb drive or email, or what?
I don't, but opinions vary on this. For me it's no big deal to transfer the keyfile offline to any device that I would want to use, but 90% of the time it's one of two devices (phone, laptop). I always have my phone with me, so I always have my keyfile with me too if I need access from a different device...I suppose if I accidentally dropped both of them off a mountain somewhere, then I'd be hooped until I could get home again and grab the keyfile from my secure backups :)
AS to the how, well bluetooth wor
Re: (Score:2)
Same here. I use KeePassX, other members of my team use KeePass on Windows or Mac. I also use KeePassDroid on my Android phone. The database is compatible between all versions, and encrypted so it can be stored on a file share (In our case, our departmental drive). I also use ownCloud to sync it automatically between devices whenever a password is updated.
I don't use the plugins though. I don't need to. KeePassX allows me to auto-type in named windows by hitting a global hot-key. Very useful.
Re: (Score:2)
I use Keepass.
I store my keepass database on dropbox, this way it is accessible from my iphone, ipad and all my laptops and desktops. Any changes I make are synchronized between devices automatically.
Keepass will auto fill in websites with plugins like KeeFox for Firefox, or launch Putty.
I don't even know what my Slashdot, eBay or Amazon passwords are, as they are all about 64 random characters each.
If you choose to go this route, it makes sense to have a very strong passphrase, as such, my passphrase exceeds 128 bits. A key file is also an excellent option.
Why not both? KeePass allows you to do that.
I also use KeePass (despite how silly the name looks when it's not properly capitalized :) but I use both a strong passphrase and a keyfile, then keep the KP database on Dropbox. The keyfile is manually transferred to any computer or device that I want to access Keepass from, so even if someone scrapes my DropBox, they can crack away at the database all they want, they still don't have the keyfile needed to decrypt it... I guess if someone gets my phone or lapt
Re: (Score:2)
Why is a keyfile an excellent option? If you only have 500,000 files on your computer (I bet you have less on your iphone), it can't take long to try them all - that is less secure than a 6 digit PIN, isn't it?
Or do you mean keyfile+passphrase? But isn't the effort to find the path of the keyfile more clicking/typing than an extra 6 digits??
Re: (Score:2)
Ditto. Worth mentioning since no one has so far that the password list is heavily encrypted (including multi-pass encryption to ensure that any attempt to brute-force it requires many seconds or minutes per guess to attempt the decryption), so you only need to remember a single password for the vault to keep the stored passwords secure. You also have the option of using a separate multi-KB keyfile to increase security even further - i.e. you need password vault on computer + keyfile on USB + password in h
Why (Score:2)
Re: (Score:2)
Re: (Score:2)
I like KeyPass because the same database file can be used in my Android phone and on me PC. I don't want to use a cloud based password storage as that might be a vulnerability. I also like that KeyPass allows you to use more than just a password to protect the database, you can also have it use a keyfile. So it turns into something you know (the password) and something you have (the keyfile on a USB key). Then you just need to keep the database synchronized between the different systems you use it on. That could be a problem if you add passwords very frequently, but in my useage it has not been a problem. KeePassDroid is a nice Android version.
My dually-encrypted KP database is the one and only sensitive file I entrust to Dropbox, since even if someone gets it, they'll have to crack both the keyfile and the passphrase to get anything out of it. That does a lovely job of keeping your database in sync for you, since Dropbox clients are pretty much everywhere :)
Re: (Score:2)
It's really just a file that you copy back and forth between the two. I have recently placed it up on my Google Drive location as a backup in case my phone is lost or the microSD gets damaged. Then I could copy it down to my PC and in the KeePass there just open that file with the same password and keyfile and everything is there.
As for Lastpass and the cloud storage? I can see that the file is an encrypted blob, same as the KeePass file, but what about while it is opened to look up a password? Do these clo
Encrypted Databases (Score:2)
KeePass (Score:2)
http://passwordsafe.sourceforge.net/ (Score:3)
Several passwords I need commonly, are written in my wallet, with nothing to indicate what, or what usernname, or system they are for. There are about 5 passwords written on a sticky note stuck to the back of a seldom used credit card.
Everything else is in PasswordSafe.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I use a few password for common systems I log in. For all the rest I use pwsafe to generate random passwords. I keep the password file on a git repository cloned on all my machines so it is difficult to lose that file.
Web aoo (Score:2)
I created a web app. The password (decyption key) is sent on every request, so it's never at rest. Under the hood, entries are encrypted and decrypted with openssl using a reasonably secure algorithm. Each entry in the database is just a plain text file. I can include passwords, accounting information, URLs, whatever I want.
Establish a secure area at the office (Score:2)
passwords management Allen Ludden style (Score:3)
Insecure but secure enough to keep most people out (Score:2)
What I use is a text file on a thumb drive also backed up on several local drives.
The text file contains the first half or so of the password, enough to remind me of what the password is should I forget. The rest is stored in my brain.
For rarely used passwords and places I will put a hint under the half pass.
I am trying to get away from these long 20 character passwords though... I really wish some one would invent a better system. Maybe a thumb drive that combines storage and a thumb print scanner in one
Re: (Score:3)
What I use is a text file on a thumb drive also backed up on several local drives.
The text file contains the first half or so of the password, enough to remind me of what the password is should I forget. The rest is stored in my brain.
For rarely used passwords and places I will put a hint under the half pass.
I am trying to get away from these long 20 character passwords though... I really wish some one would invent a better system. Maybe a thumb drive that combines storage and a thumb print scanner in one package.
Youy mean like this [ironkey.com]?
Yeah, they're a bit [amazon.com] pricey [amazon.com], but not totally out of the ballpark for the concerned user :)
Answer too long to fit in subject line (Score:3)
A text file, encrypted locally with a long password (something I can remember easily, but quite long) and then uploaded to Google Docs for easy access anywhere that I have the decryption software. If I need a password, I just open that file up and copy / paste the password needed - then close it again. If I make a change to a password I can just change it once and that populates to all the other locations where my Google Docs are stored, but it is fully and safely encrypted the whole time.
I even have an app for my phone in case I need it, but there is three factor authentication: my phone's login, a short PIN for the app, and then my full encryption password.
Re: (Score:3)
A text file, encrypted locally with a long password (something I can remember easily, but quite long) and then uploaded to Google Docs for easy access anywhere that I have the decryption software
This. However s/password/passphrase/ and I don't use google docs but similar propagation.
My text file also contains credit card account and phone numbers in case I need to cancel a card, routing and account numbers for if I need to set up direct deposit or other EFT, my kids social security numbers, and other similarly confidential reference information. I've even at times (not currently) kept a regularly needed signing cert in the file as my backup.
I've tried many of the desktop password apps. But I've
Re: (Score:2)
A text file, encrypted locally with a long password (something I can remember easily, but quite long) and then uploaded to Google Docs for easy access anywhere that I have the decryption software. If I need a password, I just open that file up and copy / paste the password needed - then close it again. If I make a change to a password I can just change it once and that populates to all the other locations where my Google Docs are stored, but it is fully and safely encrypted the whole time.
I even have an app for my phone in case I need it, but there is three factor authentication: my phone's login, a short PIN for the app, and then my full encryption password.
Just FYI, KeePass [keepass.info] does basically the same thing for you, but in a user-friendly, searchable, generally-less-mucking-around-required database. Pop the encrypted database file into Google Docs or Dropbox or somewhere and boom, you're done.
I suppose one benefit of using a text file would be that you could theoretically use it on some new system that didn't have a KeePass client yet...if your encryption/decryption client worked on the new system, that is.
Vim (Score:2)
Use a scheme (Score:2)
The problem with any password manager/tool (of course aside from a simple text file, which is obviously out of the question) is that you are dependent on that piece of technology. A commercial password manager may exist for Desktop OS 1 today, but may not be supported in Mobile Phone OS 2 tomorrow. The cumulative turnaround time for your password inventory is often much longer than that of any particular device in your possession.
I've resorted to a lower tech solution for my own password inventory: A
Re: (Score:2)
I can't even remember what service it was (this was mid 90's) but I once got an auto-generated password string from a site I registered on (might have been my online banking).
I ended up using that short string as a base password for everything and have continued to do so even today. I did this by doing the same thing you suggest, taking a small chunk and devising your own system for encrypting it while leaving it easy to recall.
Yes, there are certain site with overly simplistic password rules. For those I
I'd love to tell you, but... (Score:5, Funny)
...that would be a security risk.
Re:I'd love to tell you, but... (Score:5, Funny)
...that would be a security risk.
Security through obscurity? Has this site taught you nothing?!? :)
SuperGenPass (Score:5, Interesting)
For the most part I don't save or memorize passwords. I regenerate them as needed with SuperGenPass [supergenpass.com]. SuperGenPass algorithmically generates passwords by hashing the site's domain name together with a single memorized password. This always generates the same password for any given site. So, I don't have to remember them or store them anywhere, I just need to know how they're generated.
But what if I'm at someone else's computer without SGP installed? The SGP website has a "mobile" version, which is just javascript that runs entirely within the browser. Go there, type in the domain and password, and generate it. (Yes, I've checked the javascript. It's not sending your password out to the mothership or saving anything locally.)
I do keep a notebook in a plaintext file with all the sites I use. This contains the domain name that the site had when I first signed up. Domain names sometimes change, or are ambiguous (ie., the same site is available via both foobar.org and foobar.com). The text file lets me keep track of what I need in order to regenerate the password.
What about sites that require periodic password changes? I use the domain and just suffix my memorized password with a sequence number. And I write the sequence number in my notebook.
What's that? Security questions? I generate the answer by hashing the question itself rather than the domain with my memorized password. And of course, I copy the question verbatim into my text file so I can regenerate the answer when I need to.
The only failing is when I hit a site that doesn't allow certain punctuation, or has length limits, or something of that nature. Then I modify the parameters that I give to SGP and write down the specific parameters that I used.
The notebook is stored on my home fileserver in an svn repository which gets backed up every night. I'm completely screwed if I ever forget my one secret, but it's one I've been using for literally decades now. It's going to be one of the last things to go when my brain develops bit rot.
Re:SuperGenPass (Score:4, Informative)
I too use SuperGenPass and it's absolutely great, but I recently discovered that it has some well-known weaknesses: http://akibjorklund.com/2009/supergenpass-is-not-that-secure
An alternative is PwdHash, but I haven't motivated myself to switch yet.
Safely (Score:2)
Password protected spreadsheet (Score:2)
(Truly curious as to why a password manager is considered better than an encrypted spreadsheet, using the same password or pass phrase).
I hide it plain sight. (Score:3)
KeePass (Score:5, Interesting)
TrueCrypt and a Safe (Score:3)
SplashID (Score:2)
I use SplashID on my phone (and it's probably the single biggest usage of my phone). Don't get the current version though - 7 is pretty much unusable. I had to fall back to 6, which is usable, though not quite as simple as 4 was (I think that's what I upgraded to 7 from, which was a terrible mistake). Like the submitter, I refuse to use the cloud offerings (which SpashID has as an option now). A cell phone is a risk, but I choose to believe that I could change the passwords before the database could be
My method (Score:2)
Break your password up into two parts: the root and the suffix. The root part of the password is the complex part, that you want to change periodically yet is the same for all of your services. The suffix part is simple to remember and unique to each service, and should be consistently derived from the service itself.
For example, lets say you are setting up a password for your Yahoo account. The root part is "TLi945!zx" and the suffix would be "yahoo" resulting in a password of "TLi945!zxyahoo".
Your pas
Old school (Score:2)
I memorize them. It's not always easy but it's really the only 100% secure way, and no they are not simple and they do get changed often.
Modified Tablet (Score:2)
Captain Bad Password! (Score:2)
I'm pretty awful at password management.
One "simple" password, used for web services that don't have any sort of financial or other "real" interaction with me beyond a pseudonym and a download I needed to access or an article behind registration that I needed to read.
One "complex" password with a little bit of ever-changing entropy used for things like Google or Microsoft type services, banking/mortgage sites that don't offer me two-factor, etc. Your basic 7724hAppy!d0G$$smil3s sort of affair. Next year
Re: (Score:2)
I fail at /b>
TrueCrypt + DropBox (Score:2)
I have a truecrypt virtual disk that I store in a dropbox folder. Because dropbox can sync differentially the entire thing doesn't have to sync every time I disconnect the file. Because all dropbox sees is the encrypted file, unless someone can decrypt it it is useless even if they breach my dropbox account or in some other way gain access to the file.
It works a treat, to be honest. I keep sensitive passwords, of course, but also use it as encrypted storage for my notetaking app, sensitive diagrams, images
password repository on a company phone (Score:2)
I have Secret! and KeePass on a company smart phone. Secret stores my personal passwords, and Keepass stores system passwords. Both are synced to/from a company server. The master password for Keepass is known to the other admins, and the Secret password is known only to me. (And no, it's not Correct Horse Battery Staple, sorry.)
If the company has a problem with you keeping company passwords on a personal phone, have them issue you a phone with remote kill.
The advantage of using a repository is that you
Re: (Score:2)
I too am thinking of how to carry my passwords with me. My memory isn't as great. At home I have 1password running in the browser and in the menu bar at the top of the screen. But when I'm away from home i'm often lost. Before I was using the same password everywhere but am trying to move away from that because it is bad habit.
I have 1 password installed on my phone, so presumably when I want to enter a pwd on a website I could take out my phone, open the app, look up the pwd, and manually type it in. But I
Re: (Score:3, Interesting)
I also have them written on a piece of paper, but it wouldn't do you much good if you stole it. if you see "god#" what would you type? It reminds me of what password I actually used (which doesn't contain English words).
Now if someone REALLY wanted access to my accounts they could probably use that hint to reduce their search. If they had cracked some accounts, they could probably figure out some of the schemes I use as reminders and quickly figure out the rest.
Of course they could also just hack my home
Re:write them on a piece of paper (Score:5, Funny)
I also have them written on a piece of paper, but it wouldn't do you much good if you stole it.
Same here. I use the names of common fruits and vegetables as my passwords. So if anyone steals my wallet, they will assume that my list of passwords is a grocery shopping list.
Re: (Score:2)
The problem already exists (reset mechanisms are a huge hole in most systems), using it shouldn't make it any more vulnerable to attack.
Re: (Score:2)
The reset mechanisms exist regardless of how complex I make my passwords. They're generally not my systems.
Re:Passport belt (Score:5, Insightful)
A failing memory means that you are not suitable for the job and should find something else, like working in a retirement home.
Yeah, how many passwords like: R;3m|/|iv%{^B$
do you have memorized? I have several passwords on that scale of arbitrary, that I did not pick, that I cannot change, that are changed on someone else's schedule, cannot be re-used, and that I tend to need to actually enter maybe once a quarter, if that.
Re:Passport belt (Score:4, Insightful)
Systems that generate passwords like that - that you can't change - pretty much demand users write them down on a post-it note under their keyboard :(
Re: (Score:3)
Systems that generate passwords like that - that you can't change - pretty much demand users write them down on a post-it note under their keyboard :(
Yea. Stupid rules end up with stupid results, and having passwords that are too complex is nuts.
Re: (Score:3)
I have 26 like that.
So if I generate 26 more, you'll have no trouble memorize them all? Assuming that is the case, good for you, you are a special flower.
To suggest that anyone else is unfit to work in any field requiring security is absurd.
I also have a generic "Password123" password for sites that are use once and forget.
I agree this is sensible.
Re: (Score:3)
To suggest that anyone else is unfit to work in any field requiring security is absurd.
I think he was saying if you're in an environment where you both need to use very strong passwords *and* its not acceptable to write them down in something you carry securely all the time, *then* that suggests you either have to have a very good memory or you're not qualified to operate with those restrictions.
Re: (Score:3, Insightful)
i think he was also saying "i am a fucking dick".
haha, captcha: "elderly"
Re: (Score:2)
Re: (Score:2)
So you keep all your passwords in .bash_history? If by any chance the way you generated it for one site spills (from watching over your shoulder to putting a keylogger or whatever), all the others could fall.
Btw, just adding a space at the start of the line will make bash to not save it in history.
Re: (Score:2)