101–110 of 196 posts
Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.
Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…
Works on all platforms and all the good keepass apps and programs integrate with Dropbox.
Write down your usernames and account numbers as well. Today my banking app decided to 'forget' my login details. I have the account number available at home but I'm in the office today and so I can't log back into my account. So I can't check balances or approve payments (luckily I'm too busy to spend money)
Earlier quoted context omitted.
The KeePass unhosted ecosystem seems to fit your requirements. I recently switched to it from 1Password and am happy with it. I distribute the database to my various devices with (open source) Syncthing.
The distributed part is crucial, especially to avoid potential hardware failure. Happened to me, older machine ram (might be misremembering, that old machine had several parts replaced) failure made keypass unable to validate, claiming a corrupt database.
I am not sure how this works, when say in the example one's example.com password has been breached and example.com is forcing one to rotate the password. Then it looks like one has to have two sheets. One for all current passwords and a second sheet just for example.com. Am I missing something? (Does one rotate all of one's passwords so that one can use a single sheet? Seems time consuming to rotate all passwords.)
Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.
And 1 out of 100 websites will accept that password, unfortunately.
Although I just use a password manager but to each their own.
Do not write your real password. Instead modify it in certain way which is easy to remember: E.g real password is "xB6fqmd$a90". Apply algo: swap 2nd and last char. So store it as: "x06fqmd$a9B" This algo should be easy to remember and there infinite ways to come up with your own algo. Even if your passwords are exposed there is additional protection. In other words you have your own simple symetric encryption with a…
My Dad tried this when we first taught him to use an ATM and setup his PINs. He carefully wrote them in the back of his planner which he keeps in his pocket. Then he realized he needed extra security and added some extra digits before and after. Then promptly forgot which digits to remove and which to keep. His new approach is: 1. Pick a “famous” battle 2. Hand me a card and ask me to go to an ATM for him 3. Tell me…
Frequent usage helps to retain the memory. Also, in my case my wife uses it so its two people remembering instead of one.
Earlier quoted context omitted.
what if the password needs to be changed and previous ones can't be reused (You then must remember that)?
Then for such sites you add the date, maybe in the form of [year][password][courter]. Probably modified somewhat so it isn't obvious what is is.
Had a few websites like that, they were the bane of my existence until I got a password manager.
All I got out of this blog entry is that if I were a thief and I managed to steal this fellow's wallet, I would find the piece of paper in his wallet along with his ID card. I would then Google his name to find this blog post, which will helpfully allow me to decrypt his passwords.
If you've need additional security (or the feeling thereof), keep it on an IronKey
If you think that's not enough because some government or criminal organization is after you - hire somebody who understands security deeply, don't take advice from the Internet :)
(Also, threat model: unless you have state-like resources, a state-like attacker will win every time if they want to win. They just don't care about most of us)