41–50 of 250 posts
Though typically your machine gets compromised and doesn't really matter if you type something from memory or copy paste it from a password manager, you are screwed. A proper way to restore your access that only you can do seems more safe. A password or login can be compromised, but as long as you have a way to regain (sole) access to your account, I think that is more valuable.
I used a small script to generate my passwords : I choose a simple password, I append the domain and I hash the string. I take the first 15 characters of the hash as a password. I find it quite convenient and easy to remember ! sha256("password"+domain)
I have a file on the local drive of my office computer and a sheet of paper near my home computer (used by me and my wife). When the sheet of paper is full of handwriting, I bring it to office to synchronize both list.. When my house has been robbed last year they have not found the sheet, but if they had, I could have changed all passwords very quickly. In case of fire, the backup is safe in a remote location. It is…
I used to have a little notebook with everything, tucked 'securely' out of the way. I mean, even in a robbery somebody isn't going to rifle through some junk on a shelf right? I came to think though, that in that situation of course a list of passwords is not the target but if the robber has a small amount of technical knowledge (getting more likely, these days) then the risk is that they recognize the value of something like a book of passwords and just take it along. All of a sudden, their technology aware friend has access to my bank account!
So, I use Keepass now with a long passphrase, and syncthing keeps copies of the database distributed across several devices in several locations for me and I have access from all the various operating systems that I use. I am thinking about giving the passphrase to a friend also, as I have known him for 30+ years but I do not work with him or live near him and see him only yearly or less.
A script lists all files through fzf[1] which lets me find and select the right one very quickly, then copy to clipboard (expires after a few s). In a laptop the whole process of switching to terminal and grabbing a password takes a couple seconds, slightly longer on an ipad due to app switching.
Downside: no access via mobile (though I could have).
On Linux I use the pass command, on Windows I use QtPass [2], and on Android I use Password Store [3] and OpenKeychain [4] (for the PGP key).
My "master password" is the password for the PGP key, and I type it each time I want a password. Git keeps everything in sync. If one of my devices is compromised, you still need the password for the PGP key. If my git server is compromised, you'd need the PGP key (which isn't on the server).
[1]: https://www.passwordstore.org/
[2]: https://qtpass.org/
I used a small script to generate my passwords : I choose a simple password, I append the domain and I hash the string. I take the first 15 characters of the hash as a password. I find it quite convenient and easy to remember ! sha256("password"+domain)
I use https://www.passwordstore.org/ .
If you use git to store your passwords you can use that to see the age of entries neatly too:
I have a function which is easily computable by hand but uses information only known to myself, which converts the website into a pseudo-random password.
Obviously I can't tell you the actual function I use as this would reveal all my passwords, but for example, you could use ROT13 on odd numbered characters in the domain name and then add a fixed string to make up the password length.
I still use the browser password store with non-critical websites for speed, but can still get into any site where I have an account from any machine by re-calculating the password in my head.
Of course, this isn't secure enough if you're someone who might be individually targeted by hackers (eg: if you work at a large company or in government) - if they obtained a few of your passwords, they could reverse engineer your password function and get into the rest of your accounts. You can mitigate this by separating the sites you use into different 'security clearance' levels (eg: those with access to your money, those with access to your personal info, etc) and having different password functions for each level.
I'm using ForgotIt? [1] because I'm its author. It doesn't have a browser interface and doesn't have a mobile version. I would make a version for iOS if I used an iPhone, but I have never planned to make an Android version, because Android devices are just too insecure. (They are theoretically secure but in practice most of them don't get enough security updates.)
That being said, ForgotIt? also has some weaknesses that are laid out in its documentation. It doesn't lock memory, so you should use encrypted swap or disable it, and its keystretching algorithm compromises a higher security margin for speed.
Depending on your threat scenario you can also keep some of your passwords written on paper in your wallet. You could also keep them in a physically secured place like a wall safe. If you're worried about targeted attacks, that's in fact the best choice for most people, since no current operating system, no PC, no tablet, and certainly no phone is currently safe from a targeted attack by a dedicated adversary.
I have a folder with encrypted text files containing a password for each service. It is available locally and backed up to the cloud (with another layer of encryption). The key is in my head, no backup. A script lists all files through fzf[1] which lets me find and select the right one very quickly, then copy to clipboard (expires after a few s). In a laptop the whole process of switching to terminal and grabbing a p…