Coping with the Avalanche of IDs and Passwords?

Bitwick asks: "The number of web sites and other systems I need IDs and passwords for is finally becoming overwhelming. Right now, I tend to use a small selection of IDs and passwords. I know this isn't an ideal situation, but so far it has been the most practical. However, it has become clear to me that this needs to change. I am planning to get a USB keyfob and a password manager to keep track of my IDs and passwords. What experience have you had with password managers? What's good, what's bad, what features are important? Are there other reasonable and secure alternatives?"

Comments

Password manager?

[Tanmi-Daiow]

How about BugMeNot.

Obsfucation?

[OneDeeTenTee]

A text file with your usernames and passwords slightly obsufucated may work depending on the sort of person you expect to find your thumbdrive.

You can run Openoffice on a thumb drive and save your list of passwords in a encrypted document if you need added security.

All eggs in one basket and watch that basket?

[Creosote]

My system for quite a few years has been to keep passwords in an encrypted file located somewhere that I can easily get to it whenever I have an Internet connection. I'm sure that's less secure than keeping it on a USB device. But the risk of someone hacking the file I consider to be much lower than the risk of losing the file (via system crash, user stupidity, or whatever), so that ability to have it backed up is crucial. And unless you are scrupulous enough to regularly back up a file on a USB device to another offline device that you will always have and not lose, I don't see that it's a better system, all things considered. I'm willing to be convinced otherwise...

Password algorithm

[spineboy]

You can have a different password for each site if you make an algorithm for your password that involves the website. I.E have a standard password and add a few letters of the sites name, or add game to it if it is a game site, pron if it is that type of site, etc - Be creative and make it easy and it should work for you.

Re:Password algorithm

[znx]

One cup of hostname (with a pinch of subdomain as per taste) into a bowl, crack one master password into the bowl add and stir using an MD5 size spoon.

Re:Password algorithm

[Philom]

Using MD5 and a single master password isn't such a good idea.

Suppose a bad guy steals your password for one site and wants to learn your master password (which you input to the hash function along with the domain name of the site). He can perform a brute force attack by checking each possible input password up to a certain length to see whether hashing it produces the stolen site password.

The problem is that MD5 is very fast to compute: for small blocks it takes <0.5us on a modern CPU. That means testing every possible password is surprisingly fast. For example, searching the space of all 8 character alphanumeric passwords (single case) would take only 16 days! With your master password in hand, the attacker can almost immediately determine your passwords for every other site where you employ this scheme. Of course, the attacker can work even faster if your password is in any way guessable.

Splitting a password with a hash function *can* work very well, but doing it securely is tricky. See this paper.

Password Safe

[PktLoss]

Password safe is awesome
http://sourceforge.net/projects/passwordsafe/

Bruce Schneier recomends it in many/most of his monthly crypt-o-grams
http://www.schneier.com/

Let the avalanche come.

[TheCamper]

I have a separate password for EVERYTHING I have, no matter how obscure the website or service is. Each password is at least 10 characters long, with random uppercase/lowercase letters, numbers, and symbols; none of this "can be broken by a dictionary attack" crap.

The trick is, you don't actually have to memorize your passwords; after you type each one about 20 times, your fingers retain it in muscle memory. I actually couldn't tell you what any of my passwords are, I have to type them on a qwerty keyboard. (If I ever lose one of my hands, I'm screwed.)

Anyway, as backup, I have them all written down on a sheet of paper in an undisclosed location, with the format of login on one line, password on the line after it, with no identifying information on which login/password combo goes to what website, computer, etc. The text in this list is also encrypted using a one time pad encryption program (that I wrote myself), the key to which is in a different undisclosed location.

So if my fingers happen to forget one of the passwords, I can still retrieve it (with a lengthy process). You'd be surprised how many different login/password combos you can remember, even months after you've used them last, if you type them several dozen times over the course of a few days. But to each his own. That's just my system.

Keyring

[adolf]

I run Keyring on my Palm Pilot. It works well. I carry my Palm with me literally everywhere but at rock concerts, and it's very nice to have every obscure, seldom-used password securely available wherever I happen to be.

All of my passwords are there, and a few other bits of even more important personal information.

Stuff is encrypted, and lives in the Palm's RAM where it will be destroyed instantly upon power loss. So, if left in a bus terminal, chances are that the data will be gone before the hapless thief finds a charger for it to keep the RAM alive, let alone manages to crack the database or even recognize its existance.

All I have to do is remember one passphrase.

Stuff is also backed up to the machine that I hotsync to, where it remains encrypted on disk. While non-volatile, the machine does have the advantage of vastly increased physical security.

And that isn't much of a backup regime, so all of the work-related passwords and data that might affect Other People get beamed via IR to a co-worker with a similar rig. This usually happens in the windowless basement I call "work," and is thus also reasonably secure despite its plaintext-edness.

I've used Keyring on everything from old-school black-and-green Handsprings, to Treo 650s. It Just Works(tm). It is free. It is GPL'd.

I'd go on, but I shouldn't have to...

My strategy: MD5

[stewartj]

I used to use a USB key with a list of sites, usernames and passwords on it. All protected using a secure zip drive. It became a pain in the ass to get the passwords out, so I gave up. It also concerned me as a single point of vulnerability (if someone stole it and cracked it they have access to my life).

So now instead I use this algorithm:

$password = MD5($sitename . $single_password)

So I don't have any passwords written down, just the single global password in my head along with the algorithm. There's an MD5 calculator on every UNIX system, and there's javascript ones available on the web too.

The benefits of this system:

• I don't have to remember any passwords except my one global one
• I don't have a list of passwords written down anywhere or on a USB key, so i'm not vulnerable
• It's quick and easy to generate a new password for a new site
• If someone gets a hold of one of my passwords they can't use it to guess passwords on other sites.
• My passwords are 32 character random-looking strings, so they're virtually uncrackable.

Some websites don't support 32 character passwords, for those I just use the first 10 or 20 characters of the MD5 hash.