Slashdot Mirror
Ask Slashdot: Should You Use Password Managers?
New submitter informaticsDude writes: What do Slashdot users recommend regarding the use of password managers? The recent election underscored the hackability of many personal accounts. One solution is to use different passwords for every digital experience. But, of course, humans are lousy at remembering large numbers of large random strings. Another solution is to use a password manager. However, password managers have been hacked in the past, in which case you lose everything. How do Slashdot users balance the competing risks? What is a person to do?
Yes.
http://keepass.info/
> Yes, but I'm sure a photogenic memory is super uncommon.
But my god are they beautiful to look at.
Not web nor cloud based. You make a master password, it stores a file on your hard drive containing your encrypted stuff. You can move that file anywhere and, if keypass is installed, get your passwords on that platform.
I don't trust cloud-based password managers. Use KeePass and encrypt your keyfile with a really strong password. If you want to access your keyfile from multiple devices, sync it to the cloud with box/dropbox/gdrive/etc. Even if the keyfile is stolen, it'd be very difficult to compromise if you use a strong password.
There's several options.
(1) Don't use a lot of password protected services; that way: less to remember.
(2) Live with being occasionally hacked.
(3) The Bratva solution: someone hacks you, send someone to shoot them in the head.
I don't know about you, but I'm kind of partial to #1, with #3 being a close second. I don't particularly like #2.
Use a password manager = yes. Storing passwords online = no. If you must store in the cloud, use different providers for the encryption as the storage.
Website Just Down For Me? Find out
Some password managers rely on remote servers or the cloud to store your password. That is risky for two reasons. (1) A service holding passwords for many users is a more likely target for hackers than your own individual computer. (2) If the server or cloud service goes down even temporarily, you are stuck without your passwords.
You should choose a password manager application that is installed within your computer and does not rely on you having an Internet connection. The application should use a master password -- actually a master pass-phrase -- to encrypt the individual passwords. That master pass-phrase itself is not stored anywhere. Instead, if it is entered incorrectly, it fails to decrypt any passwords. By "pass-phrase", I mean a longer expression containing blanks, punctuation, etc.
Note that Mozilla-based applications have internal password managers that reflect my second paragraph above.
Why is lastpass a piece of crap, exactly?
+1 for 1Password.
I don't have strong enough words to endorse their Watchtower service, which tracks recent breaches, affected sites, and warns you about it so you can change your passwords on affected sites. It also reports about duplicate passwords used multiple places, last time they were changed, etc. That functionality of 1Password alone is worth the cost, especially if you have hundreds or thousands of passwords.
You can store your key database in multiple different places, you just have to choose the one you think is most secure. :)
Yes. I recommend Firefox's password manager which can encrypt passwords stored in your browser with a master password. Then add to that Mozilla's sync feature to store an encrypted copy of your passwords on Mozilla's server. They are stored encrypted and cannot be recovered without the sync password and e-mail access. If you don't trust Mozilla's server, despite the passwords being encrypted, they provide the open source software so you can run your own server to sync your encrypted passwords to.
If someone (you or hacker) does not know the sync password and resets the password with access to your e-mail account, it will not give them access to the passwords that were sync'd previously. This is good because it keeps a hacker from being able to just hack your e-mail account then use that to get access to all your passwords.
> Lastpass is a piece of crap.
And that's the end of the rant? Aww.
I continue to recommend Lastpass. 1Password (for 70$), not at all.
I've been using LastPass for years. I tried pwsafe (nice, but at the time, didn't support Mac well) and KeePass (which I didn't like for reasons that I don't quite recall now; ended up moving back to pwsafe) before I switched to LastPass.
The deciding factors were (1) LastPass Premium works on Android. (And, now, you don't need Premium; the free version also works on Android.) (2) Syncs password changes across all devices, and (3) Professional Paranoid Steve Gibson gave it his seal of approval.
Some of the others also have a way to sync across all devices now, but I haven't come across any compelling reason to switch. Though LetMeIn may be working on that one.
Just keep a tiny address book in your wallet.
Any important passwords you keep there.
The unimportant stuff can use a common password.
You had better use something in addition to that USB drive. One good static discharge and you're toast.
Use cloud storage like Google Drive or Dropbox and Keepass. It's encrypted, located locally and backed up to the cloud. Been working that way for years without any problems.
For any normal person (not rich, famous, or powerful), just storing hints in a document is good enough. Something like:
EBay kxxxxbxxxx3xxx
Where the mask character x is not precisely replacing characters.
It's enough to remind me, but not enough to aid a casual attacker.
Strange things are afoot at the Circle-K.
https://chriszarate.github.io/...
SuperGenPass is a different kind of password solution. Instead of storing your passwords on your hard disk or online—where they are vulnerable to theft and data loss—SuperGenPass uses a hash algorithm to transform a master password into unique, complex passwords for the Web sites you visit.
SuperGenPass is a bookmarklet and runs right in your Web browser. It never stores or transmits your passwords, so it’s ideal for use on multiple and public computers. It’s also completely free and open-sourced on GitHub.
+1 for 1Password.
I would have said the same a month ago, but 1Password is changing their pricing to $36 a year subscription.
I'm switching to LastPass.
I use a password manager that has Windows, Linux, Android and IOS clients. They all use the same encrypted data file that I keep on my dropbox.. I keep my day to day non-user critical account passwords in there so I can access them easily and quickly no matter where I find myself. But I don't put the important passwords (finical accounts and the like) in there, I just remember them.
But the PRIMARY thing you can do to keep yourself safe is to "DON'T use the same password on multiple sites!" Never, EVER use the same password in your "fun" accounts and your financial logins... This is because a breach at one of these "we don't care about your security" sites is a lot bigger risk than at your bank, but if you have the same password, you just gave the crooks a very important piece of information.
Secondary to that, is keeping passwords hard to guess. If you have a manager that generates passwords for you, use it for the throw away accounts.
So, in summary. Sure, use a password manager for the trivial junk accounts, use complex passwords and keep them different. But NO, don't put your important passwords in an online storage... Develop a way to remember them and Keep those in your head.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I've been using password safe for over 10 years. It's works well for me, is free, was created by Bruce Schneier and keeps your passwords in a local encrypted file.
I use LastPass just fine, because every site where getting my login details would hurt, I use 2fa: Microsoft, my bank, PayPal, LastPass, Google, etc. Sure I'm picking up my phone once in a while but it's a good balance between secure and convenient. Far less secure are card details; mine got compromised recently but was detected and reversed almost immediately. Which is why I use PayPal whenever possible.
it's what I've used for years. I have a not so memorable story, take an event from that, and turn it into your password scheme.
[completely fabricated example]
In 7th grade a girl I liked (Sarah) gave a presentation on Abraham Lincoln. She was wearing a blue dress.
Four score and blue dress. FoScBlDr (8 characters, safe)
Add in a number and a symbol, because some sites require it. FoScBlDr81? [I think it was in 1981]
So, there is my starting password. Password hint = Sarah Lincoln 81, maybe SL81 for short.
6 months later, you have to change your password. Hint becomes SL82 (FoScBlDr82?)
You could cycle through to 89, then back to 81. Over time, you can morph it in other ways. Maybe put a $ in there instead of a ? for financial sites, or come up with a separate story for those.
The thing is, YOU make up the story and the cycling rules.
You can even write down your password hints, nobody would ever think "Crush 88" was actually "FoScBlDr88?"
I have used one scheme/password since 1999, and it has morphed so much even if I told someone my original password, they couldn't guess what it is now... it's just jibberish.
My beliefs do not require that you agree with them.
I just write the passwords on Post-It notes and stick them to the monitor. :)
I used that technique until someone used my password from SiteA to guess my password for SiteB. Sorry, this isn't a clever solution
Pick even just a short password, and a consistent non-obvious way to append other data about the account. Then cat | some hashing command, type your stuff and cut/paste. Save the relevant data about the account in a text file, but not in the same format you use to append to the password and with some extra cruft. Be sure to include a rough date so you know how stale a password is.
This avoids one compromised cleartext password giving clues about others, as long as you are not so p0wned as to have someone be able to see how you generate the hash or hijack your clipboard.
Someone had to do it.
why more people don't do this. It's easy to come up with a suitably long and random base password that you can then add minor variations to based on some algorithm to make it unique per website or service.
People DO do this. Research has shown that when implementing Password Expiration, in 80% of the time users created a new password which could be guessed by using a dictionary attack on the previous password and applying minor variations.
This exactly. Taped to the bottom of my keyboard.
Yeah, that's great. I'm in IT and my Keepass shows over one thousand entries. I use the mnemonic device method for most passwords, like (examples only) rfhpwtycg (really fucking hard password that you can't guess), or MvEmJsUn (mercury, venus, earth, etc...), oTtFfSsEnT (one, two, three, four, etc...). Using mnemonic devices helps me remember what the password is, but not where it was used. I have at least 10 gmail accounts, 20 other email accounts, and multiple accounts with Cisco, SonicWALL, Office 365, Barracuda, Hostgator, CloudFalare, AT&T, Verizon, 8x8, Register.com, etc, etc, etc... I would never even think about trying to memorize any password except the one that opens Keepass.
Which is one reason why expiring users passwords too often leads to insecure passwords. If your password is going to last for a year, you might use a 20 character string including various special characters and caps/lower case mixing. If your password needs to be changed every month, you'll get the PASSWORD1, PASSWORD2, PASSWORD3, etc. variations.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
I am surprised no one has endorsed PasswordSafe yet! Written originally by Bruce Schneier, open source, and ported to Android which lets me sync my pwd database files between devices via Dropbox. I've been using it for years and plan to continue.
Since starting to use it on my mobile, I've segregated my database a bit to prevent a total breach in case my phone were compromised. I have my "lower security" internet website passwords that I need on the go in one file. And I have my financial passwords (which also stores account and credit card numbers that I might need in an emergency) in another file. And then on my PC there is a master file that has all these plus a ton of other accounts I've collected over the years but don't see the need to take on the road in my phone. Each database has a different unlock password, and those are all I have to remember.
I like it because you can use it for more than just passwords. You can store bookmarks and files in it too. I don't trust bookmark sync. I'd never use browser extensions for sensitive information because that info is only as secure as the weakest link, be it the extension or web browser. I also never use a cloud service to store the database files. Surely if something is important, you can remember a single password and where you keep a flash drive. KeePassX also allows the use of key files as a password. You can have it as both so if the password is compromised, they still need the file. This way, you can use a cloud service but it will only open on your computer. You could also keep them on separate services. What I do is create a dummy KeePassX database and key file and edit it with more random string stuff and then create the real KeePassX database and use the edited key file from before. It's only 44 characters long if you don't. 4096 that sucker! You could maybe also use Steganography to hide the key file within the icon of the database file if separate cloud storage is too much.
See above comment. ;-)
You have a totally solid ILLUSION of security going here.
I too use 1Password with DropBox integration vs their pay to play cloud service. I pay nothing and it updates DropBox which is accessible to all of my clients quickly. It can be used for secure notes and other things so all of those security questions that you do NOT put in truthful answers for can be remembered :) My passwords are generated by a different app and I use different passwords for nearly every site now. Get hacked once and you learn the hard way - took me an entire day to track down most of my accounts and fix them!
Someone below mentioned it leaking metadata through a .js file - that file doesn't exist on my DropBox, the .JS files that do don't contain anything cleartext.
Build it, Drive it, Improve it! Hybridz.org