I use 3 passwords: One for my email, one for my computer's login, and one for my password managers master password.
You have exactly three passwords, don't you?
31–40 of 86 posts
Re: You have exactly three passwords, don't you?
#32I use one password per account. I have a common shared suffix like "HuRf!z0" and then I prepend a prefix depending on the website, like "gm" for HN. So far, this has been quite simple to use, even when I am not in front of my machine.
Isn't this vulnerable to someone guessing the prefix if the password is compromised? This assumes that you're up against identity theft, not automated spamming, but the algorithm you're using to hide the prefix isn't very robust. Does this matter to you?
Re: You have exactly three passwords, don't you?
#33The bank managing my 401k requires a password between 6 and 8 alphanumeric characters. Non-letter, non-digit characters are not allowed.
charles schwab does this. \\
chase bank does this.\\
captial one does this.\\
god knows why I still use them...
Re: You have exactly three passwords, don't you?
#34I ran a cracking forum for a few months and found similar stats. Even in a community whose members should know better. I modded the vBulletin software to store passwords in plaintext. Roughly fifty percent of members registered with an e-mail address that was also registered with Paypal. Of those who had, roughly 75% of them had matching passwords for both the forum and Paypal.
Re: You have exactly three passwords, don't you?
#35No. I have exactly 146 passwords.
Re: You have exactly three passwords, don't you?
#36Some systems don't require a complex password. I don't care if someone breaks into the game center thing on the iphone because my password is prettypony2 - what are they going to do, erase my high scores on Tetris? I'm sure as hell not copying and pasting a 16 character password between the LastPass app every time.
I thought Gamecenter on iPhone used your Apple ID
Re: You have exactly three passwords, don't you?
#37The problem with password managers is, when you're away from whatever machine you managed to get the thing set up on, you're locked out of all your accounts.
Do browsers sync these yet? I know Chrome, Firefox et al. have various syncing options, but I've never looked into how they work exactly. Edit: looked into it, and the situation for password sync is - Chrome: built in since V. 11 - Firefox: available through add-ons/extensions (XMarks) - Opera: since beta 11.5 (the latest as of right now) - Safari: available through extensions/other services (mobileme? not sure) - IE…
Firefox 4 and up have built-in password syncing (along with bookmarks, history etc). Everything's encrypted client-side, so you never have to worry about unauthorized access to them.
Re: You have exactly three passwords, don't you?
#38Yes. This is why I use a password hash function. The exact Hash function is in my head (and only my head), although it requires a lookup table for random bits. The lookup table is typically a poem, (when I was younger, I would use digits of pi, but I consider that insecure now), but can really be any sequence of words about 50+ that I can reproduce pretty much instantaneously.
The exact hash algorithm is my secret, but the input to the hash is the url of the website that I log into. So, we have
f (the hash function, which is secret).
url
poem (think of this as the "secret key").
This is secure against prefix attacks and other guessing attacks, although not cryptographically so (unfortunately, I am unable to memorize a 128 bit pseudorandom string and the algorithm to SHA2, so this will have to do.)
But I'm still paranoid, so my google account uses a completely different password that has nothing to do with any of the above, because access to my google account is protected by 2-step verification and my android phone, and it is a very weak link. If you compromise my GMail account, you can pretty much use "I forgot my password" on every other account of mine. (While 1 of my banks requires email AND phone, since my google account relies on 2-step there is an unfortunate correlation in the failures there. So GMail really is account-vulnerability-complete for me.)
Re: You have exactly three passwords, don't you?
#39The problem with password managers is, when you're away from whatever machine you managed to get the thing set up on, you're locked out of all your accounts.
This is not true with Lastpass and Passpack. I highly recommend Passpack. Very secure.
Re: You have exactly three passwords, don't you?
#40I wrote up an interesting comparison of Password Managers on this very thing: http://blog.danielfischer.com/2011/05/12/its-time-to-start-u...