Slashdot Mirror
Ask Slashdot: How Do You Manage Your Passwords?
Albus Dumb Door writes "As an IT professional, I've got a problem common to many of you: dealing with a lot of passwords. Memorizing them all becomes harder with age and and an increasing number of passwords. I will forget them eventually. I am obviously unable to use something online, like Last Pass and 1Password. Using a single password for all the systems is also obviously out of the question. I know that there are a few apps for cell phones for managing passwords (like Phone Genie and mSecure), but a cell phone, unless it's kept in offline mode (and even then), is still a security risk and I'm pretty sure my employers wouldn't like me having their passwords on my cell phone. I've also taken a look at things like the YubiKey, but changing the authentication scheme of most of the systems is not an option. The only interesting option I've seen so far is the Pitbull Wallet, but they just started taking pre-orders on IndieGoGo and are not expected to deliver until August. Amazon has some hardware password managers as well, like the RecZone and Logio, but either the price or their reviews scared me away. So how do you guys prefer to manage your passwords and what do you recommend?"
It's not portable, and this is just what I do at home so may not scale well to the office, but I've basically got an old intel atom box (MSI Wind PC) running linux (slackware) with no network connection and full disk encryption just using luks/dm-crypt. I keep passwords, banking numbers, and other bits of sensitive info on there. No fancy management software, just plain old text files. I have it hooked up through a KVM and I just leave it running all the time (with locked screen), so it's nothing to switch to it when I need to use an old password or update a password when I change one.
Files are backed up locally using rsnapshot (for history), and then that's periodically copied to one of 2 (also encrypted) USB thumb drives (I leave on plugged in the back and periodically swap them).
Primitive, but sometimes that's what works. You could probably do the same with a raspberry pi at this point (disk encryption might be fun though).
Also this topic comes up like once a month, and the answer has not changed in years. Stop asking!
Completely off topic: what would be the best way to physically disable the wifi capability of a device. Obviously you can disable in software, but I'm the paranoid sort, and would love a way of knowing that my IP web cam is not gonna be doing anything with that wifi antenna. Thinking maybe some kind of terminator or some other way of "absorbing" the signals.
on my desktop.
extensible, open source, active project...what's not to like?
For work, write them down on physical paper and keep them in your physical wallet.
You'll notice if your wallet goes missing.
For home, write them down on physical paper and keep that somewhere safe.
Why is LastPass not an option? The password database is always synced to your laptop/cellphone so there is no problem accessing your passwords when you are offline. The security is the most robust I have found when it comes to password management, especially when you use 2-factor auth.
I use Keepass.
I store my keepass database on dropbox, this way it is accessible from my iphone, ipad and all my laptops and desktops. Any changes I make are synchronized between devices automatically.
Keepass will auto fill in websites with plugins like KeeFox for Firefox, or launch Putty.
I don't even know what my Slashdot, eBay or Amazon passwords are, as they are all about 64 random characters each.
If you choose to go this route, it makes sense to have a very strong passphrase, as such, my passphrase exceeds 128 bits. A key file is also an excellent option.
Try to hack my 31337 firewall!
Why are you unable to use one of the online systems like Lastpass? It's been very well vetted, offers offline and online modes. I personally find 1pass to be very Mac centric and expensive but it's a good product too. Keypass is a good opensource alternative, although its a local program so there are those downsides. It has android and iOS apps too so you can have access on a mobile device if needed.
Maybe I'm an idiot but I don't get why these options are obviously bad. I use 1Password on a regular basis.
I keep a KeePass database for each of my consulting clients and encrypt them with a unique master password for each client that gets shared with the client. Then, another KeePass database with all of the client's master passwords inside of it encrypted with yet another master password that gets shared with my fellow consultants. This lets me give my clients access to their password documentation without having to give them the master password for all of my clients' databases. It also ensures that my colleagues have access to my client's passwords should they need to cover for me. Or, if you want to spend some money on a commercial product, look at Secret Server.
I like KeePass it uses a database file that you can copy manually and you don't need to sync, or you could place the file on a dropbox share and use it from there. The file is encrypted and you need to enter a Master password each time. If you ever needed to give someone passwords you can export just the ones you need to share and set a new password so they can use it. Its been my favorite one to use since I use crazy complex passwords for everything online.
PasswordSafe works for me.
Several passwords I need commonly, are written in my wallet, with nothing to indicate what, or what usernname, or system they are for. There are about 5 passwords written on a sticky note stuck to the back of a seldom used credit card.
Everything else is in PasswordSafe.
If I were God, wouldn't I protect my churches from acts of me?
randomly. three options. 1. slashdot starts with s: password is sw23edcx. 2. two s words: semaphoreslinky. 3. for those that require combos: Sw@3edcx.
I can understand not reading TFA, but did you even RTFS? What part of
I am obviously unable to use something online, like Last Pass and 1Password.
were you unable to understand?
Now, I have absolutely no idea why poster "obviously" is unable to use it, but it's already ruled out.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
every platform.... except desktop linux?
A failing memory means that you are not suitable for the job and should find something else, like working in a retirement home.
Yeah, how many passwords like: R;3m|/|iv%{^B$
do you have memorized? I have several passwords on that scale of arbitrary, that I did not pick, that I cannot change, that are changed on someone else's schedule, cannot be re-used, and that I tend to need to actually enter maybe once a quarter, if that.
A text file, encrypted locally with a long password (something I can remember easily, but quite long) and then uploaded to Google Docs for easy access anywhere that I have the decryption software. If I need a password, I just open that file up and copy / paste the password needed - then close it again. If I make a change to a password I can just change it once and that populates to all the other locations where my Google Docs are stored, but it is fully and safely encrypted the whole time.
I even have an app for my phone in case I need it, but there is three factor authentication: my phone's login, a short PIN for the app, and then my full encryption password.
William George
...that would be a security risk.
systemd is Roko's Basilisk.
For the most part I don't save or memorize passwords. I regenerate them as needed with SuperGenPass. SuperGenPass algorithmically generates passwords by hashing the site's domain name together with a single memorized password. This always generates the same password for any given site. So, I don't have to remember them or store them anywhere, I just need to know how they're generated.
But what if I'm at someone else's computer without SGP installed? The SGP website has a "mobile" version, which is just javascript that runs entirely within the browser. Go there, type in the domain and password, and generate it. (Yes, I've checked the javascript. It's not sending your password out to the mothership or saving anything locally.)
I do keep a notebook in a plaintext file with all the sites I use. This contains the domain name that the site had when I first signed up. Domain names sometimes change, or are ambiguous (ie., the same site is available via both foobar.org and foobar.com). The text file lets me keep track of what I need in order to regenerate the password.
What about sites that require periodic password changes? I use the domain and just suffix my memorized password with a sequence number. And I write the sequence number in my notebook.
What's that? Security questions? I generate the answer by hashing the question itself rather than the domain with my memorized password. And of course, I copy the question verbatim into my text file so I can regenerate the answer when I need to.
The only failing is when I hit a site that doesn't allow certain punctuation, or has length limits, or something of that nature. Then I modify the parameters that I give to SGP and write down the specific parameters that I used.
The notebook is stored on my home fileserver in an svn repository which gets backed up every night. I'm completely screwed if I ever forget my one secret, but it's one I've been using for literally decades now. It's going to be one of the last things to go when my brain develops bit rot.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
Memorized the passwords. Know your limit on how many random letters, numbers, symbols you can memorize and then remember them. This is especially useful because my data dies with me.
These cyber criminals are babes in the woods, compared to my brilliance. I pull wool over their eyes easily. See? I enter the password in the username textbox and the username in the password textbox when I created the account. That is the last place they will look while trying to hack my password. haa haaa. The jokes on you script kiddies...
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
KeePass. With the encrypted datafile in dropbox.
"Unheard of means only it's undreamed of yet,
Impossible means not yet done." ~~ Julia Ecklar
I keep all my work passwords in a file that is saved in a TrueCrypt volume. This volume is kept on a network share where only domain admins can access it. I also keep some of the important passwords on a piece of paper that is locked in a safe in the data center. Generally I remember all the passwords I need, but sometimes (especially after a vacation) I need to refer to the TrueCrypt volume. If I ever forgot the password to access the volume, I have it stored in the safe. If I forget the combination to the safe...I'm screwed. Thankfully that hasn't happened yet.
This is called "challenging the assumptions." You, he, (and I for that matter) agree that it's not obvious why he's unable to use it. If the article poster is unaware that LastPass or 1password can work completely offline, then perhaps that information would change why they're ruled out. He might have another reason, but since it's not as obvious to us as it is to him, it's more than fair to raise it, especially when you're getting the advice for free.
Personally, I only tolerate not being able to question assumptions when I'm getting paid to do it, and even barely at that. :-)
I also have them written on a piece of paper, but it wouldn't do you much good if you stole it. if you see "god#" what would you type? It reminds me of what password I actually used (which doesn't contain English words).
Now if someone REALLY wanted access to my accounts they could probably use that hint to reduce their search. If they had cracked some accounts, they could probably figure out some of the schemes I use as reminders and quickly figure out the rest.
Of course they could also just hack my home wireless, or put me in a van and drill holes in my kneecaps until I told them.
Systems that generate passwords like that - that you can't change - pretty much demand users write them down on a post-it note under their keyboard :(
Because the OP is totally wrong, is why. 1Password keeps its data file locally. There are all kinds of synchronization features, which you don't have to use if you want to avoid online operations.
OP may have been thinking of 1PasswordAnywhere, which is the all-online version.
I also have them written on a piece of paper, but it wouldn't do you much good if you stole it.
Same here. I use the names of common fruits and vegetables as my passwords. So if anyone steals my wallet, they will assume that my list of passwords is a grocery shopping list.
What I use is a text file on a thumb drive also backed up on several local drives.
The text file contains the first half or so of the password, enough to remind me of what the password is should I forget. The rest is stored in my brain.
For rarely used passwords and places I will put a hint under the half pass.
I am trying to get away from these long 20 character passwords though... I really wish some one would invent a better system. Maybe a thumb drive that combines storage and a thumb print scanner in one package.
Youy mean like this?
Yeah, they're a bit pricey, but not totally out of the ballpark for the concerned user :)
"I love animals! Some are cute, others are tasty, what's not to like?" - Betsy Schroeder, Jeopardy contestant
Because the story poster said, 1password was off the table.
Instead of just saying, "Use 1password", you should have challenged the assumption, and asked *WHY is it off the table?*, and then gone on with the benefits. Applehu Akbar also never mentioned its offline capabilities.
In addition, the subject line "There is but one true password manager" smacked of fanboism. It sounded like, "I don't care what story poster said, I like mine."
I'm quite willing to take my lumps, now that the false assumption in the story/summary was pointed out. Applehu should also be willing to take his for the flaws in his near first post.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
Systems that generate passwords like that - that you can't change - pretty much demand users write them down on a post-it note under their keyboard :(
Yea. Stupid rules end up with stupid results, and having passwords that are too complex is nuts.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I have 26 like that.
So if I generate 26 more, you'll have no trouble memorize them all? Assuming that is the case, good for you, you are a special flower.
To suggest that anyone else is unfit to work in any field requiring security is absurd.
I also have a generic "Password123" password for sites that are use once and forget.
I agree this is sensible.
To suggest that anyone else is unfit to work in any field requiring security is absurd.
I think he was saying if you're in an environment where you both need to use very strong passwords *and* its not acceptable to write them down in something you carry securely all the time, *then* that suggests you either have to have a very good memory or you're not qualified to operate with those restrictions.
I love my wife and her name is lesa 53
good luck with cracking the below
Ilvemywfenderamesesa53
GRC 2 X 10 ^ 39
or
my car is a 2004 vw jetta
YaRSa004WettA
GRC 2x10^23
next car is a 2014 nissan leaf sv
NexCaIA201NissaLeaS
It really is not that hard.
i think he was also saying "i am a fucking dick".
haha, captcha: "elderly"
I've been using them for years, and I love it so much that I subscribe to their premium service, even though I don't have a use for it, to provide support for them...their basic service is free.
It autofills my username and password on any machine where I have the app installed. If I don't have the app installed but need to get to my username/passwords, they have an online vault I can log on to.
And searching is easy - I can search by username or site or keyword in description. They auto-filter my passwords as I type into the search box.
https://lastpass.com/