Coping with the Avalanche of IDs and Passwords?

Bitwick asks: "The number of web sites and other systems I need IDs and passwords for is finally becoming overwhelming. Right now, I tend to use a small selection of IDs and passwords. I know this isn't an ideal situation, but so far it has been the most practical. However, it has become clear to me that this needs to change. I am planning to get a USB keyfob and a password manager to keep track of my IDs and passwords. What experience have you had with password managers? What's good, what's bad, what features are important? Are there other reasonable and secure alternatives?"

Comments

Password Corral

[delus10n0]

Password Corral for Windows -- it's free, and the best one I've found, hands down.

Re:Password Corral

[Fry-kun]

got ya beat -- *open source* (though for windows only) Oubliette

Re:Password Corral

[kayen_telva]

http://www.schneier.com/passsafe.html

Password manager?

[Tanmi-Daiow]

How about BugMeNot.

security at its best...

[Anonymous Coward]

i love the post-it note method under the keyboard, now thats secure

Obsfucation?

[OneDeeTenTee]

A text file with your usernames and passwords slightly obsufucated may work depending on the sort of person you expect to find your thumbdrive.

You can run Openoffice on a thumb drive and save your list of passwords in a encrypted document if you need added security.

Re:Obsfucation?

[Aeiri]

You can run Openoffice on a thumb drive and save your list of passwords in a encrypted document if you need added security.

Why make it so complicated?

You could use Firefox's internal "remember password" system, and link the file that stores those passwords to the usb pen drive, and the usb pen drive is mounted using an AES-256 encrypted partition.

Add a startup script to mount the partition, you type the password on startup, and then you are set, and, it's all done for you instead of looking it up in an OpenOffice document.

Re:Obsfucation?

[golgotha007]

But the problem remains if you log in from a public terminal or other computer.

Look folks, it's easier to keep track of all those web registrations than you think.

First of all, choose a highly unique username that is unlikely to be taken by someone else (like ajh1198).

Next, choose a common word like pirate (change the i to a 1), so you end result is p1rate.

Now, for each site you visit, take the first letter or first two letters of the site and add that to the beginning of your password. In this case, my slashdot password would be slp1rate. Ebay would be ebp1rate and so forth.

Simple and secure and all in your head.

Re:Obsfucation?

[Jah-Wren Ryel]

That assumes you only use passwords on the web.
Some people have lives outside of the web.
Some even have lives outside of their computers (ATM PIN, password on bank accounts, utility accounts, etc).

Re:Obsfucation?

[ace_brickman]

lives? there's something out there besides /.?

Re:Obsfucation?

[baadger]

Building on the same idea

Trunc(Base64(MD5([Website subdomain or IP] + [master password])),[Maximum allowed length])

Here is a webpage with client side javascript that does just that. I suggest saving a copy, modifying it to allow variable length truncation, and make it your home page.

There is a bookmarklet of a similar script (no base64) here

Re:Obsfucation?

[Mumbly_Joe6432]

That sounds great, but most sites have password restrictions (length, basis on a word). For me, it's always the one exception to the rule that I forget.

Re:Obsfucation?

[buck_wild]

I keep a text-based list of all my logon IDs, with a very vague reference to the password.

So here's what I go through. (names of been changed to protect the innocent) All my passwords are generally the same, with slightly different numbers. So let's say my MSN password is based on an obscure auto part called a hog ring. Here's what my list would look like:

MSN
auto12123

Yahoo
auto5

And so on... So *I* know what 'auto' really means (for this example 'hogring), but no-one else ever will. If I change my password, I can easily recover.

Re:Obsfucation?

[ebh]

What makes it worse is that they have different restrictions, e.g., one site may mandate the use of at least one special character, and the next may require all alphanumerics.

And then, just about the time you've got a workable system, your passwords start expiring, subjecting you to just as wide a variety of password changing and reuse policies.

I finally had to write everything down in a "little black book" that I keep in my wallet, using codewords representing the user IDs and passwords, e.g., "ecom alnum" for an alphanumeric-only version of the password I most often use for E-Commerce sites.

That and heavy use of Mozilla's password manager.

Re:Obsfucation?

[Anonymous Coward]

OpenOffice just for crypto!?!?!

Just get "tinyfish" (blowfish based) a small DOS com:
"BLOWFISH is a 16 round Feistel network, of 64-bit blocks and with a 448 bit keyspace."

or "tinyIDEA" 500 bytes

google those two for source & bins

All eggs in one basket and watch that basket?

[Creosote]

My system for quite a few years has been to keep passwords in an encrypted file located somewhere that I can easily get to it whenever I have an Internet connection. I'm sure that's less secure than keeping it on a USB device. But the risk of someone hacking the file I consider to be much lower than the risk of losing the file (via system crash, user stupidity, or whatever), so that ability to have it backed up is crucial. And unless you are scrupulous enough to regularly back up a file on a USB device to another offline device that you will always have and not lose, I don't see that it's a better system, all things considered. I'm willing to be convinced otherwise...

Re:All eggs in one basket and watch that basket?

[name773]

that's certainly the most convenient method

i just remember them (i only have 3 aliases, and i remember the phases my passwords went through. the trick is using them enough; i forget them when i don't)

Re:All eggs in one basket and watch that basket?

[MarkRose]

I keep all my userids and passwords in one basket -- my skull. Really, what's so hard about memorizing a few dozen passwords? Yes, it takes a bit of effort, but then I'm never held captive to some device where my passwords are stored. What ever happened to using our brains?

Re:All eggs in one basket and watch that basket?

[Fulcrum of Evil]

Really, what's so hard about memorizing a few dozen passwords?

It's hard when you only use the password once every few months. I can remember my passwords for normal stuff easily, but simpler stuff that I touch 4 times a year I keep forgetting.

Re:All eggs in one basket and watch that basket?

[ebh]

A few dozen, easy. A few hundred, hard.

Re:All eggs in one basket and watch that basket?

[MarkRose]

True.

Password algorithm

[spineboy]

You can have a different password for each site if you make an algorithm for your password that involves the website. I.E have a standard password and add a few letters of the sites name, or add game to it if it is a game site, pron if it is that type of site, etc - Be creative and make it easy and it should work for you.

Re:Password algorithm

[TheCamper]

Dude, that's a good idea. Never thought of that.

Re:Password algorithm

[Aeiri]

You could make it even better, take that "password" and run it through MD5 or SHA1, then have that 32 character hash be the password for the site.

Or even better, parse it a bit, so that there are some more characters in there, such as:

echo "whateverpass" | sha1sum | tr '0-4a-c' '!$&)X-Z'

Gets capital letters, letters from both sides of the alphabet, and some characters in there, while leaving lower case letters and numbers to spare. 32 character password with everything.

I read something similar on slashdot before, improved the idea :)

Re:Password algorithm

[Vaevictis666]

The firefox extension you are looking for is Password Composer

Takes the domain name (plus/minus the www. if you prefer) and runs an MD5 of that plus your password, chops it to I think 10 chars. Damn near freakin impossible to work backwards from even though the domain name starts the md5, and it's a dead easy algorithm that you could do manually from the shell if you so desired.

Unfortunately, this only works well for web-based forms, though in theory one could do it via shell for other things.

Re:Password algorithm

[name773]

i think his idea had the advantage of being able to come up with the password if you forget it, although yours is certainly more secure

Re:Password algorithm

[elmegil]

And why can't you run the same hash algorithm on the same password and get the same results?

Re:Password algorithm

[znx]

short sweet simple,

now just to change them all...

Re:Password algorithm

[znx]

One cup of hostname (with a pinch of subdomain as per taste) into a bowl, crack one master password into the bowl add and stir using an MD5 size spoon.

Re:Password algorithm

[Philom]

Using MD5 and a single master password isn't such a good idea.

Suppose a bad guy steals your password for one site and wants to learn your master password (which you input to the hash function along with the domain name of the site). He can perform a brute force attack by checking each possible input password up to a certain length to see whether hashing it produces the stolen site password.

The problem is that MD5 is very fast to compute: for small blocks it takes <0.5us on a modern CPU. That means testing every possible password is surprisingly fast. For example, searching the space of all 8 character alphanumeric passwords (single case) would take only 16 days! With your master password in hand, the attacker can almost immediately determine your passwords for every other site where you employ this scheme. Of course, the attacker can work even faster if your password is in any way guessable.

Splitting a password with a hash function *can* work very well, but doing it securely is tricky. See this paper.

Re:Password algorithm

[name773]

oh, with that system i wouldn't bother writing it down (then again, i don't have that many usernames/passes)

Re:Password algorithm

[JRIsidore]

With that scheme you better make sure no one gets hold of your .bash_history file.

Re:Password algorithm

[tod_miller]

This is what I do actually, I won't give it out (obviously) but it is fairly simple.

I realise many people sign up with an email address, and give the same password as their email address to the website.

Hahah, silly.

Re:Password algorithm

[Aeiri]

With that scheme you better make sure no one gets hold of your .bash_history file.

I use ZSH, and as far as I know there are no files that log the shell history for that. At least I hope not...

~/.bash_history is worthless in my opinion... It's pointless for auditing because a knowledgeable attacker would just run "wget http://whatever/shell.tar.gz", extract it, and have a non logging shell to work with.

Or at least

Re:Password algorithm

[Aeiri]

Or at least

The side of my hand hit the mouse button when typing (laptop)....

Or at least edit the .bash_history file when they are done.

Re:Password algorithm

[InfinityBuffer]

symlink ~/.bash_history to /dev/null

Re:Password algorithm

[Anonymous Coward]

PasswordMaker http://passwordmaker.org/ gets around this by adding 10-15 other user-defined variables to the password=master+url formula. A brute-force attacker would have to know how you've configured these other variables, otherwise the search space becomes huge.

Some of the variables are: character set used to encode the hash value, l33t-speak level (if any), when l33t-speak was applied, which of 9 hash algorithms did you use?, date counter, username (added to the formula so you can have multiple accounts at gmail.com, for example), password length, password prefix, password suffix.

Best of luck cracking that with brute force, my friend.

Re:Password algorithm

[rmccann]

Or just set the HISTFILE bash variable to "".

Password Safe

[PktLoss]

Password safe is awesome
http://sourceforge.net/projects/passwordsafe/

Bruce Schneier recomends it in many/most of his monthly crypt-o-grams
http://www.schneier.com/

Re:Password Safe

[swf]

Password Gorilla is also a very good Password Safe compatible client that runs on Windows, OS X and Linux.

Re:Password Safe

[name773]

oooh, i have an idea: password gator

"this Desktop Pal(tm) remembers all your passwords for you! free download from the well known gator corporation"

i thought it was funny until i looked to make sure the company was called gator (and not just the product). i was surprised to find the gator ewallet that fills out forms, holds passwords, and encrypts stuff, and now i don't know what to say.

Re:Password Safe

[kcb93x]

The Gator eWallet has been around for years - I remember cleaning systems back in high school, from Windows 95 and 98 boxes - that had it, because it game in one of many ways. The free version of Sneed for Windows I think was one of the culprits...

Let the avalanche come.

[TheCamper]

I have a separate password for EVERYTHING I have, no matter how obscure the website or service is. Each password is at least 10 characters long, with random uppercase/lowercase letters, numbers, and symbols; none of this "can be broken by a dictionary attack" crap.

The trick is, you don't actually have to memorize your passwords; after you type each one about 20 times, your fingers retain it in muscle memory. I actually couldn't tell you what any of my passwords are, I have to type them on a qwerty keyboard. (If I ever lose one of my hands, I'm screwed.)

Anyway, as backup, I have them all written down on a sheet of paper in an undisclosed location, with the format of login on one line, password on the line after it, with no identifying information on which login/password combo goes to what website, computer, etc. The text in this list is also encrypted using a one time pad encryption program (that I wrote myself), the key to which is in a different undisclosed location.

So if my fingers happen to forget one of the passwords, I can still retrieve it (with a lengthy process). You'd be surprised how many different login/password combos you can remember, even months after you've used them last, if you type them several dozen times over the course of a few days. But to each his own. That's just my system.

Re:Let the avalanche come.

[Anonymous Coward]

YOU ROCK MY WORLD OMG I LOVE YOU
Finally somebody who respects security needs, no matter how obscure or insignificant the login may be. It's a matter of pure principle.

Re:Let the avalanche come.

[poopdeville]

The problem isn't remembering passwords, but remembering which password works with which login. If you have 20 logins and 20 passwords, there are on the order of 20! ways to mess up and compromise your other passwords.

Re:Let the avalanche come.

[Anonymous Brave Guy]

The trick is, you don't actually have to memorize your passwords; after you type each one about 20 times, your fingers retain it in muscle memory.

If you want to rely on that, be my guest, but please be aware that there is no such thing as "muscle memory". Your muscles don't remember anything; you're just talking about transferring the information to a different part of your brain.

The problem with this approach, of course, is that the information you remember will shift slightly with time, and when you start mistyping a password slightly without "knowing" what it really is, you're screwed.

Re:Let the avalanche come.

[Anonymous Coward]

Oh, for Christ's sake...this has to be one of the dumbest examples of Slashdot pedantry I've seen in a long time. Yes, technically your muscles do not consist of neurons that retain memories. "Muscle memory" is a name for a very real phenomenon. As a classical musician, I rely on it every day. Focusedly repeating a task causes the motions it involves to become ingrained for later use. This is the whole point of practicing one's instrument; it would be impossible to play a piece of music if one had to consciously think about each finger and mouth motion involved. And the information will generally not shift if you are repeating the motion consistently, be it playing an instrument or typing. I don't randomly play wrong notes in scales. The only major concern would be if he was typing these passwords only on occasion, which he stated was not the case.

"Muscle Memory" is a common term that, while perhaps not literally accurate, conveys a concept that the vast, vast majority of people understand and can relate to. Do you really think you look smarter by saying things like this?

Password Manager XP

[rerunn]

Password Manager XP by cp-labs has worked good for us.

http://www.cp-lab.com/index.html

Amongst many other features, it supports removable devices such as usb keyfobs and will install the necessary binaries on the device to run from.

From another /. story...

[Anonymous Coward]

hNo
matter where I'm at, I am always ssh'ed into my server. So, I put the following into my .vimrc:

augroup encrypted
au!
autocmd BufReadPre,FileReadPre *.gpg,*.asc set viminfo=
autocmd BufReadPre,FileReadPre *.gpg,*.asc set noswapfile
autocmd BufReadPre,FileReadPre *.gpg set bin
autocmd BufReadPre,FileReadPre *.gpg,*.asc let ch_save = &ch|set ch=2

autocmd BufReadPost,FileReadPost *.gpg,*.asc '[,']!sh -c 'gpg --decrypt 2> /dev/null'
autocmd BufReadPost,FileReadPost *.gpg set nobin
autocmd BufReadPost,FileReadPost *.gpg,*.asc let &ch = ch_save|unlet ch_save
autocmd BufReadPost,FileReadPost *.gpg,*.asc execute ":doautocmd BufReadPost " . expand("%:r")

autocmd BufWritePre,FileWritePre *.gpg '[,']!sh -c 'gpg --default-recipient-self -e 2>/dev/null'
autocmd BufWritePre,FileWritePre *.asc '[,']!sh -c 'gpg --default-recipient-self -e -a 2>/dev/null'

autocmd BufWritePost,FileWritePost *.gpg,*.asc u
augroup END

And I have a pw.gpg file that I just store everything in a "usage username/password" format. Works like a champ, and I'm not bound to a proprietary file format from the password-manager of the week. Seriously, I tried most everything before, from palm-based managers, os x's keychain, kde's wallet, and this is by far the easiest to use, most robust, and the most future-proof.

Re:From another /. story...

[fmaxwell]

You do realize that to 99.99% of Slashdot readers, including those who make their living as software engineers, that's completely incomprehensible, don't you? That's the reason why they invented comments.

Re:From another /. story...

[Anonymous Coward]

this is a fablulous tip!

I copy/pasted this in my .vimrc and it worked perfectly right off the bat. Simple, portable, and quick.

Thanks AC!

Re:From another /. story...

[GargoyleMT]

A GPG based solution for Win32 would be excellent. Linux already has one, using the GPGME API: cpm.

Paper.

[Pyromage]

No, seriously. Paper is an incredible solution. At our office we have a locked filing cabinets we store passwords in. Quite handy.

An excellent personal solution is to keep a list in your wallet. Keep another list somewhere safe and stationary, so that if you lose the first one you have a complete list of sites to go down to change all the passwords.

It's pretty much the simplest thing you could possibly have, secure, and responds well to failure.

Re:Paper.

[Aeiri]

An excellent personal solution is to keep a list in your wallet. Keep another list somewhere safe and stationary, so that if you lose the first one you have a complete list of sites to go down to change all the passwords.

Well, there is another type of attack for this method, unfortunetly it's not listed on Secunia.

It's called a "mugging attack".

Re:Paper.

[Pyromage]

Ahh, but they're not lost. You pull the one out of your safe location and go change all your passwords.

Keep in mind where you stand: yes, you can lose your passwords with everything else. But you've lost everything else then too; I'd be more worried about losing my drivers license, credit cards, etc., than I would the couple of passwords. Even if I lost my bank's website's passwords, how is that worse than losing my debit card?

Re:Paper.

[Aeiri]

Most debit cards have limited withdrawals, and automatic alerting to the customer when a withdrawal is over $200 or so.

With the password to the bank account, all you would need is a Swiss bank account ;)

Re:Paper.

[HeyLaughingBoy]

It's called a "mugging attack"

And your average mugger is going to know that how, exactly? You have a piece of paper in your wallet with "xyzzy, ncc1701a" and he's supposed to deduce that it's a username and password?

The simple, obvious solution is just one *good* username and password for everything. The odds of that becoming compromised are much smaller than the odds of you forgetting/losing one of the multiple ones.

Re:Paper.

[Sancho]

One *good* username and password may not be that good.

First of all, let's completely rule out the trust issue you have to have with each of the site's sysadmins, which actually is something to consider (since nearly every forum around requires registration to write, and some require registration to read). You have to worry about sites being compromised. Even if the sites all store passwords encrypted, a compromised site could capture passwords in plaintext before they hit crypt(). If you use the same password everywhere, the cracker can backtrack to whatever e-mail address you used, then go through your e-mail to find other sites (possibly banking sites) and try the same password on those. All your logins can be compromised in one fell swoop.

The very minimum number of passwords I would suggest to the average Internet user is 4. 1 for your primary e-mail address, 1 for a throwaway address, 1 for secure sites (banking, amazon, etc.) and 1 for generic logins (message boards). A better solution would be to have unique passwords for each site that deals with money. Amazon is a pretty big target, and it only takes one lucky hack for them to get a password sniffer on there (for example).

The odds of that becoming compromised are much smaller than the odds of you forgetting/losing one of the multiple ones.

The odds increase with every new site you use that login and password for. A statistically secure password is a good idea, but using the same one to log in to Redneck Discussion (hyuck!) forums run by Joe Schmoe as your online banking is just foolish.

Re:Paper.

[HeyLaughingBoy]

First, let me say that I appreciate receiving a coherent, well thought out response to my post. That's becoming all too rare here on /.

You're basically right. My suggestion is balancing odds, and I still think that odds are substantially that your username/pw won't be hacked, or captured by a "rogue" site. It's like losing my house key: if I lose it while fishing, I'll just get a new one (yes, my house has one key for all locks :-) because the small probability that the person who may have seen me drop them will follow me back to my truck and trail me home to see where I live is slight compared to the probability that they fell on the ground and no one was around or no one noticed.
But if it fell out of my pocket along with my fishing license (which has my name/address), bet your ass I'm changing the locks. Still small odds of a break-in, but substantially larger than the former situation.

My reality is actually pretty close to what you recommended: I have unique usernames/passwords for the few sites I consider sensitive: bank, PayPal, Amazon, brokerage acct, email, and those are written down on paper filed near this very computer. The rest are either all the same, or stored in Mozilla's password manager and it would be just a slight inconvenience if I forgot them or they were hacked. So what if my Slashdot nick becomes "NoBulletsLeft" instead of "HeyLaughingBoy" and my UID goes up by a factor of 5?

Re:Paper.

[Sancho]

I do agree that there needs to be a balance on the odds. That's why I think our solutions (sensitive passwords written down, generic passwords used across other sites) works rather well. It's the idea of using the same login/password on upwards of ... 50 sites, some of which may be run by unscrupulous people (yeah, I've got about 50 logins across the web and my job) kinda scares me. I still think that statistically, it's more likely that a person will have a problem with a compromised password being used on another site than someone brute forcing their password, but the liklihood of either is probably pretty small.

Pick a few

[CarlinWithers]

I have a few passwords that I use for all the various things that I need passwords for. The upside of this is that I don't have to remember as much. The downside is that if anyone ever did learn my password, it would compromise more than if I used a different password in each instance.

However, as a countermeasure I've been known to make my few passwords very long and obscure (full sentence method).

Re:Pick a few

[Sancho]

A long and obscure password means you are probably never going to be brute-forced. Good for you. But shorter, unique passwords for each site is better for security for your average person.

Crackers don't want your login and password--they want any login and password--precisely because so many people reuse passwords across multiple sites. If they manage to recover your password through a site hack or phishing scam (yes yes, you're on Slashdot, you're not going to fall for one of those) or a cross-site scripting attack, all your sites are now compromised. Your 20 character password means diddly.

An different 8 character password that will survive a dictionary attack for each site you use would be orders of magnitude more secure. As I said, no one wants your password (if you happen to be the president or a particularly "important" person, forgive my belabouring of that point). No one's going to brute-force your password, they're going to try common passwords for multiple usernames or simply hack the site to recover it. Having a password that will survive a dictionary attack solves the first problem, and not using the same password at every site mitigates the damage caused by the second problem.

Bruce Schneier's

[alexjohns]

Password Safe. Works great. You could just install on your USB fob, I imagine.

text file on local machine with backup on external

[XBL]

bla.com: u/xyz p/abc
yada.com: u/abc p/def
bbb.com: u/def p/ghi

K.I.S.S. Why do anything more complex?

KisKis

[kneeless]

KisKis is the best I've seen. Cross-platform, various templates, encrypt files too. I keep the database and the installer (which is also cross-platform, Java is cool) on my USB key.

S.T.R.I.P

[cmiller173]

I use S.T.R.I.P. "Secure Tool for Remembering Important Passwords" running on my palm OS handheld (Palm IIIxe). The encrypted DB is backed up when the palm hotsyncs so if I ever lose the handheld I can restore it to a new one.

by having it on my handheld which is very nearly always with me I don't have to rely on the app running on whatever system I'm working on at the time (various windows, Linux, Solaris, MVS, and others)

Re:S.T.R.I.P

[ibennetch]

S.T.R.I.P. is a little tempermental (as far as how to actually enter data - it's not as user-friendly as one would hope) but it is very useful for storing all kinds of information in a secure but easy to get to location.

If you keep a Palm close by, look in to it!

Re:text file on local machine with backup on exter

[Aeiri]

bla.com: u/xyz p/abc
yada.com: u/abc p/def
bbb.com: u/def p/ghi

I believe you loaded up the wrong file, none of those sites have login fields.

A whacky idea

[sonamchauhan]

Problem statelment: How to associate one string (domain name) with another string (username/password combination)? a.k.a. translate strings.

Here's a whacky possible solution: use a translator pen, such as this:"SuperPen Translator" - which supports 'custom dictionaries' , to store passwords. Run the pen across site's address bar displayed on the computer screen, and the pen translates it to your username/password for that site.

Here's another of those pens: C-Pen.

Of course, if none of their dictionaries are user-editable, and if they have no SDK, this won't work.

Here's a more sensible solution: Javascript password generator
(Video about it - flash format)

Re:A whacky idea

[vga_init]

I like your idea. What I think would be interesting is the creation of a programming algorithm that takes the name of the site or service and converts it to a password string. The benefits of this that I see is that *no* password gets stored and each login receives a totally unique password. It would work on extremely low memory devices and would support a theoretically limitless number of accounts. :-)

Re:A whacky idea

[elbarono]

The SuperPan is not magical! It WILL burn you!

Re:A whacky idea

[sonamchauhan]

Thanks. :) I hope it works if someone tries it. Perhaps it would be even possible to have easy-as "add password" mode - scan the URL on screen, then write down the username/password on a piece of paper (or notepad) and scan that. Destroy the piece of paper.

Regarding an algorithm to generate a unique password, take a look at the page source of the Javascript password generator link to in my previous post - that guy has implemented the MD5 algorithm in Javascript (see "function core_md5(x, len)")! Is this what you had in mind? His Javascript generates a unique password per site based on a secret master password you keep in your head. Totally cool!

Re:A whacky idea

[HughsOnFirst]

I know someone who used one of those cue-cat barcode readers that output an encrypted version of a barcode as a way of using objects on his desk like books or candy wrappers as user names and passwords.

Re:A whacky idea

[sonamchauhan]

Thanks! That's interesting. :) He'd better not lose those candy wrappers. :P

At least one of the two pen readers I linked to above can translate barcodes.

What would be cool is adding a bluetooth module to one of these readers so it can associate with a computer as an additional keyboard. Like so:

Website requests authentication -> user scans browser address bar -> pen device brings up the associated credentials -> user sends them via bluetooth keyboard

Re:A whacky idea

[vga_init]

Yeah, that's pretty much what I was thinking of. :) Thanks!

Standards

[ImagistTD]

We have standards for everything else, why not create a password-protection standard? If there was a standard set of requirements for a password, then people could use the same password for all standard-compliant systems.

Portable device

[erth64net]

What do you do when you dont trust the system you're at, enough to insert your USB keyfob (ie: internet kiosk, or needing the password to a customer's system while onsite)?

How about a USB KeyFob with a built-in display, and a means of entering a password to decrypt the database. When you want to make a change, you use a tool like Password Safe to edit the text file from a trusted system (copy the text file for backups too!). Though when you're at an untrusted system, you just snatch your password using the built-in display.

Re:Portable device

[erth64net]

So much for getting it into one posting...

Or how about a program such as FreeSafe - a Java MIDP which runs on most java-enabled phones. FreeSafe even does SHA1 and MD5 OTP!

My own personal solution

[Marie Antoinette]

I keep mine in an email that I sent to myself. I am only in trouble if I forget the password to that email account. I think it's a pretty solid system. I can access it from anywhere, and somebody would have to hack a pretty solid email provider to get at my information.

Re:My own personal solution

[Wojski]

Or just use a key logger on a public terminal that you happen to be using.

Re:My own personal solution

[Marie Antoinette]

Yes, very true. Wouldn't that deter any password solution though?

duh!

[undef24]

just use 12345 as your password on every site--problem solved.

Re:duh!

[Sancho]

That's the kind of password an idiot would have on his Windows computer.

Re:duh!

[miTcixelsyD]

That's amazing, I have the same combination on my luggage!

Keyring

[adolf]

I run Keyring on my Palm Pilot. It works well. I carry my Palm with me literally everywhere but at rock concerts, and it's very nice to have every obscure, seldom-used password securely available wherever I happen to be.

All of my passwords are there, and a few other bits of even more important personal information.

Stuff is encrypted, and lives in the Palm's RAM where it will be destroyed instantly upon power loss. So, if left in a bus terminal, chances are that the data will be gone before the hapless thief finds a charger for it to keep the RAM alive, let alone manages to crack the database or even recognize its existance.

All I have to do is remember one passphrase.

Stuff is also backed up to the machine that I hotsync to, where it remains encrypted on disk. While non-volatile, the machine does have the advantage of vastly increased physical security.

And that isn't much of a backup regime, so all of the work-related passwords and data that might affect Other People get beamed via IR to a co-worker with a similar rig. This usually happens in the windowless basement I call "work," and is thus also reasonably secure despite its plaintext-edness.

I've used Keyring on everything from old-school black-and-green Handsprings, to Treo 650s. It Just Works(tm). It is free. It is GPL'd.

I'd go on, but I shouldn't have to...

Re:Keyring

[dubl-u]

I've used Keyring on everything from old-school black-and-green Handsprings, to Treo 650s. It Just Works(tm). It is free. It is GPL'd.

Yep! I use it too, and love it. It's especially handy for those occasions when somebody calls you up about work you did a couple of years ago. Those passwords have long ago faded from my memory, but not from my Palm's memory.

So, if left in a bus terminal, chances are that the data will be gone before the hapless thief finds a charger for it to keep the RAM alive,

Note that this is not true for the Treo 650. They're using some sort of non-volatile RAM, so power loss doesn't erase the data anymore.

Re:Keyring

[kentborg]

When I realized that I needed to keep all my passwords unique, I looked around and bought a Palm Zire 31 and run Keyring on it. The Zire 31 is not too expensive and I can very easily back it up with an SD card.

I also carry a Palm-based phone, but I don't trust it. It makes mysterious 10-second data calls on its own. I also don't particularly trust the Zire's software, but I keep it mostly incommunicado, so I don't have to trust it so much.

-kb, the Kent who says: "Never reuse passwords, write down passwords (encrypted if you can), and password expiration is silly."

http://angel.net/~nic/passwd.html

[ehvoy]

Save the following html page to your computer or usb device

http://angel.net/~nic/passwd.html

Come up with a master password, enter the domain name of the particular site you are browsing and a unique password is generated for that site. All you have to remember is your master password. The page uses javascript, no data is passed to the internet. Whenever you need a password, just run the saved html page, enter master password, enter domain name, click generate button and you have your password

Re:http://angel.net/~nic/passwd.html

[cmdrbuzz]

Also have a look at the JavaScript bookmarklets on http://angel.net/~nic/passwdlet.html

I have Safari set-up so that pressing Command and 1 will auto fill-in any password fields with the site generated password.

Whilst your master password is stored in plain text in the bookmark file, as I use FileVault (AES Encrypted home folder) I think it should be OK for non banking sites...

of course

[syrinx]

use Gator!

PDA saves the day

[slashdot_commentator]

Besides being a programmable day runner with alarm,
Besides keeping cheatsheets, notes, & reference files

You get a program that will keep passwords and encrypt the datafile. Not just is it unlikely someone will be able to "steal" your passwords, but a backup copy of the data will be available when you sync the PDA.

Keep it with you and accessable

[cgenman]

Personally I use yaps on a Palm Pilot, though I could see using another PDA-based one. The cool trick about YAPS is that you can drag your pen across their keyboard for multiple inputs, effectively allowing you to draw very, very long passwords quickly.

I would use either a PDA-based or a phone based system... something you carry with you at all times, no computer required. Mine has everything from password / logins to credit card information and bank numbers. You're not always near a computer when you need to know your checking account number.

For computer privacy, try dekart private disk. It's a pretty solid encrypter / decrypter that creates virtual drives under XP. Anything you put on a drive is protected, from passwords to applications. And it runs from removable disks. It does tie you to windows, though.

Portable Apps

[pg133]

I suggest you consider encrypting part of the drive, TrueCrypt is a great little app and will run from the USB Thumb Drive as a way to store any info you wish to be secure.

You might also want to consider EssentialPIM or Getting Things Done tools like GTDTiddlyWiki or Next Action (requires firefox)

Check out portablefreeware for more apps and Slashdot

Microsoft usb flash manager is a way to backup you flash drive and keep the info safe, you might also want to consider a second flash drive

(PS: Getting Things Done is a simple and effective personal productivity method by David Allen. You can http://www.amazon.com/exec/obidos/tg/detail/-/0142 000280/qid=1115360158/sr=8-1/ref=pd_csp_1/002-8782 437-3718417?v=glance&s=books&n=507846" href="http://www.amazon.com/exec/obidos/tg/detail/ -/0142000280/qid=1115360158/sr=8-1/ref=pd_csp_1/00 2-8782437-3718417?v=glance&s=books&n=507846" class="externalLink">get the book from Amazon.
Also check out the GTD community at the 43Folders http://www.43folders.com/" href="http://www.43folders.com/" >website, http://wiki.43folders.com/index.php/Main_Page" href="http://wiki.43folders.com/index.php/Main_Pag e" >wiki, and http://groups-beta.google.com/group/43Folders/" href="http://groups-beta.google.com/group/43Folder s/" >newsgroup.)

Re:Portable Apps

[pg133]

A tidied up version

I suggest you consider encrypting part of the drive, TrueCrypt is a great little app and will run from the USB Thumb Drive as a way to store any info you wish to be secure.

You might also want to consider EssentialPIM or Getting Things Done tools like GTDTiddlyWiki or Next Action (requires firefox)

Check out portablefreeware for more apps and Slashdot

Microsoft usb flash manager is a way to backup you flash drive and keep the info safe, you might also want to consider a second flash drive

(PS: Getting Things Done is a simple and effective personal productivity method by David Allen. You can get the book from Amazon.
Also check out the GTD community at the 43Folders website, wiki, and newsgroup.)

Cellphone java app

[Anonymous Coward]

I was considering doing a little j2me (java) application for my cellphone, to keep them encrypted.

And I think its a good way to start j2me programming ;-)

Re:Cellphone java app

[erth64net]

FreeSafe is a Java MIDP which runs on most java-enabled phones. FreeSafe even does SHA1 and MD5 OTP! What's missing are a notes field, and a means of backing up the data (to email or a website).

It depends; on what platform? OS X already has it.

[ezraekman]

If you're running OS X on a Mac, you're already covered. All of your logins and passwords can be stored in OS X's "Keychain", which allows easy access to all of your passwords by simply logging in to OS X. All of your passwords (that you allow) will be automatically remembered and will populate any appropriate fields. In addition, individual logins and passwords can be accessed by typing your login info (for your OS X account), and it will reveal your login info for that particular item.

For more info on Keychain Access, read one of many of Apple's support pages on it. It's great, and completely integrated into the operating system. You don't even have to think about it. Any time you enter a username and/or password for something (in any application, web site, etc.) you'll be asked if you want the login information to be added to your Keychain. You can allow it to be added, ignore it this time, or never allow it for the particular site/application in question. You can even manually add items that have nothing to do with logging in. (Combinations for locks, or other confidential information.) It's a snap. :-)

Ilium eWallet

[Anonymous Coward]

I use eWallet (review) - it has a Windows, Windows Mobile Pocket PC, Windows Mobile Smartphone and Palm OS versions - all compatible.

I started using it with my Palm III, then moved throug a couple of other Palm OS devices, always synchronising with my Windows desktop. Then moved to the Windows Mobile Pocket PC version and I am now using the Smartphone version. I have more than 500 passwords stored, document numbers, credit cards, etc... Everything synchronises between platforms.

Re:It depends; on what platform? OS X already has

[ace_brickman]

Keychain's encrypted too, isn't it?

KeePass Password Safe

[Shadow_139]

KeePass is what you are looking for I have been using it for years now and it fucking cool.

It stores all you Username/Password DataBase using so called "most secure encryption algorithms currently known (AES and Twofish)" while SHA-256 is used as password hash.

YOu can Group your list with details on each password:
Title,Username,URL,Password (with AutoGen & Quality Rating), Notes, Expire Date and File Attachment.

It fully open-source (OSI certified) runs under Windows and PocketPC with NO INSTALLATION NEEDED so will run off USB key or Network, etc

All in all a very cool and sweet program for anybody with alot of Username/Passwords/URL/IPs to remember and a most have for all System/Network Admins.....

Password Maker

[utopicillusion]

How about a Firefox extension...Password Maker http://passwordmaker.org/. I think this would work just fine!

My strategy: MD5

[stewartj]

I used to use a USB key with a list of sites, usernames and passwords on it. All protected using a secure zip drive. It became a pain in the ass to get the passwords out, so I gave up. It also concerned me as a single point of vulnerability (if someone stole it and cracked it they have access to my life).

So now instead I use this algorithm:

$password = MD5($sitename . $single_password)

So I don't have any passwords written down, just the single global password in my head along with the algorithm. There's an MD5 calculator on every UNIX system, and there's javascript ones available on the web too.

The benefits of this system:

• I don't have to remember any passwords except my one global one
• I don't have a list of passwords written down anywhere or on a USB key, so i'm not vulnerable
• It's quick and easy to generate a new password for a new site
• If someone gets a hold of one of my passwords they can't use it to guess passwords on other sites.
• My passwords are 32 character random-looking strings, so they're virtually uncrackable.

Some websites don't support 32 character passwords, for those I just use the first 10 or 20 characters of the MD5 hash.

Password Safe for Windows/Linux/Solaris/OSX

[teridon]

If you like Password Safe, Password Gorilla uses a compatible database, and it runs on many more platforms through the use of TclTk.

Keep it simple with GPG and pwgen

[Anonymous Coward]

Rather than using a unique password manager, I just use a text file encoded with GNU Privacy Guard. A shell script called pwgrep consists of "gpg -d pwgen is a nice tool for creating random passwords that are still phonetically memorable. lai5Chema, Eshoh3tum, Thie2thoy, die4Baejo, etc. I use a new one for every last site, and the passwords I need to pwgrep half a dozen times or so stay with me after a while.

RoboForm

[ahrenritter]

The password manager I recommend is RoboForm. It isn't free, but It has every feature I've ever wanted.
* Secure encryption
* Random Password Generator
* Storage of automatic logins
* Storage of "SafeNotes"
* Ability to fill forms with one button (CC entry, etc.)
* Storage of bookmarks (import from IE/Firefox)
* Storage of contacts (import from Outlook or file)
* Portable version that runs from a thumbdrive.
* Palm add-on

Quite nice.

Re:RoboForm

[ahrenritter]

Just one quick clarification.
SafeNotes can either be password protected or cleartext. I use them to store secure pieces of information such as my driver's license and license plate numbers and other important information such as registration keys for my Palm software and such.

Single Signon and Passport

[Karma Farmer]

Since I work at a company that has a decent IT department, I have single signon at work. And, I only use websites that use microsoft passport.

So, I only have two passwords to remember, ever.

Re:Single Signon and Passport

[supertoad]

slashdot uses passport????

Correct!!

[spineboy]

I can use this at public places that I wish to log onto. I don't have to really remember much at all for these. I am smart enough to know of keystroke loggers and obviously use much better passwords for my bank and credit card ONLY at home.

Its not just YOUR password that matters...

[hacker]

Let's also not forget that you should regularly check and recheck the passwords of YOUR USERS , and enforce strong password strings (length, alphanumeric, punctuation at a minimum).

Very recently, someone I know who is a very well-known talking head in the Open Source community had his box rooted, because a colleague of his had an account on his server with a default password, and never logged in.

One of those recent ssh brute-force login bots came scanning along and got in using this account. They logged in, downloaded a rootkit from Romania into /tmp, built and executed the rootkit, replaced sshd, and as each user tried to log into the machine over ssh, they were forced to retype their password (ignoring ~/.ssh/authorized_keys).

Ever user logging in would blindly retype their password, thinking something was wrong.. Meanwhile their passwords were being sent back to Romania to someone to malisciously use elsewhere.

The smart part about this rooting, was that the user's ~/.ssh/known_hosts was scanned and used to further spider out and attempt more ssh attacks.

For example, user jdoe has his authorized_keys set up. He tries to log in over ssh, and instead of an un-prompted login, he is asked for his password. He dutifully enters it and is denied access. He enters it again (thus confirming it), and is still denied access. Now /home/jdoe/.ssh/known_hosts is parsed and remote hosts found in it are added to the "ssh attack these hosts" file for later brute-force sshd attacks.

It was ugly. We had to change passwords, generate new ssh keys, and check our local keys and machines as well... all because SOMEONE ELSE had a weak password in an account they never even used.

Re:Its not just YOUR password that matters...

[Anonymous Coward]

and you allow easy (i.e. by a standard kit) exec in user writable areas by default why?

Using mobile phone

[coolnicks]

A very different idea, and im not saying its a great one that will work in all situations, is using mobile phone, e.g my college login was numberic, so i stored it as a phone number entry. The same can be done with passwords using the name, or saving text messages, perfect for on the move for those who dont have PDAs like me.

Re:It depends; on what platform? OS X already has

[Anonymous Coward]

Yes, using Fast Elliptical Encryption, on which Apple owns a patent (via NeXT).

nonrelational mnemonics

[Anonymous Coward]

I have several passwords and login names, and give them 1- to 2-char nicknames, which I put in plaintext next to the text name in my bookmarks.

E.g.,

"BarBlog (nn n)" = my normal net login name, normal password
"FooBank (fn e)" = my full name, extended password
"BazPr0n (pn 8t)" = my pornstar name, 8 tabs

and so on.

It works fine.

PGP ?

[Anonymous Coward]

I just use PGP to encrypt a text file with all your passwords. One of the problems with other packages might well be lack of support in future (maybe e.g. passwordsafe will stay around ?).

KeYpass CRTL-Right Click Login

[Bitwick]

I have been playing around with KeYpass that has a CTRL-Right Click option to login. This is a very nifty feature, I wonder why you don't see it in other programs, like the open source ones. Does it have something to do with the development platform?

There are companies that do this for real

[John Harrison]

ActivCard is one such company. They have a full product suite that handles smart card issuance, storing passwords on the card, scripting to automate the password entry process, and even VPN access. You don't even have to type in the password to each application, the software does that for you.

While there are plenty of home-grown and one-off solutions, it would probably be worth your time to look into the various SSO (Single Sign On) software providers and find a security product that works for you.

no extra equipment needed

[DavidH_Mphs]

well, for system passwords, I just memorize them.
For websites, though, I mostly use this:

Click here if you've forgotten your password *click!*

Change password?

[lorcha]

What do you do when you are forced to change a password?

What if the system you are forced to change a password on won't allow you to use a previously-used password?