What is a good practical (and sane) way to manage all your passwords for online sites?

Question

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords.

This is something that I have been putting off, but since LinkedIn decided to give away one of my passwords away, I figured it was about time I addressed this issue.

I say somewhat secure, because - clearly - the most secure way would be for me to remember every single unique 200 character password I created for every site.

I know there are various sites that allow you to create hashes per url that you mix with a particular word you select, so I think that is what I am leaning towards.

I could also write it down, but then if I don't carry my passwords with me I am in big trouble and I am clumsy like that.

What is a good practical way to manage passwords for different sites (short of writing them down)? Any Chrome plugin hash generator I should be looking into? Online service?

Answer 1

There are several ways to keep track of massive amounts of passwords. Which you choose is up to you, but each one has pros and cons.

I have used LastPass, KeePass, 1Password, and KeePassX.

If you want to be independent of software or services, you could come up with a simple algorithm that works on any website. I do this for security questions and it works well. (No more "mother's maiden name"!) For example, your little password formula could look like this (don't use this exact one):

Domain name of site + Num. characters in site name times two
    + a favorite phrase with punctuation + last 4 characters of URL shifted left by 1

Whatever you choose, consider:

• Upper/lower-case letters
• Numbers
• Non-alphanumeric characters (punctuation)
• Pseudo-randomness (shifting, swapping, modulus, etc; adds complexity, but it becomes habitual with practice)

The idea of memorizing a password algorithm is to create apparent entropy from actual order. Case in point... It doesn't have to be "cryptic" per-se, but at least long enough to be cryptographically secure so it can't be easily cracked with an automated process.

And yeah, don't write it down.

If someone finds your plaintext password because a site is exploited (like LinkedIn, on which I changed my password this morning), the attacker would still have to guess on other sites, especially if you swap, shift, or replace some of the characters systematically in your algorithm.

Take the example above, for instance. If an attacker saw your plain-text password from one site, what would he know?

• The first part is obviously the domain name of the current site
• The second part is probably the number of characters in the site name
• The next part is probably a static (unchanging) phrase
• The last part is... apparently random?

There is uncertainty generated by shifting the characters on the last part (that's a good thing). You could do this anywhere in a real formula... even the delimiters between different pieces, if you choose to have one, could come from the site or service name. For extra obscurity, shift the characters of your delimiter or any piece of the formula.

Security through obscurity isn't perfect, but for something memorable, you can't "bank" (no pun intended) on truly randomized data. If your password is long enough, you can stop most automated attacks, and if your password is obscure enough, you'll slow down an attacker enough to make it impractical to guess, giving you enough time to change your password.

PS. See the "Related" links on the side for discussions about this topic and pros and cons to each method.

Answer 2

If your looking for an offline solution then you could use Steve Gibson's Off The Grid. It a paper based encryption which allows you to hash a domain name into a password. This gives you a lot of security as it doesn't require trusting any third party source. I know you mentioned you may forget it, but it's easy to store in a wallet.

The basics of it is you take a 26x26 table of characters. This table follows rules similar to Sudoku (only one of each character in each row and column). This starts it off with a lot of entropy (1400 bits minimum). The basics of how to use it are fairly easy (I won't bother re-typing it all out again). The biggest risk for it is if someone physically steals your grid. Even then there are few steps you can take slow (should be easily long enough to realize someone has stolen it). These methods include,

1. Choosing a different starting location
2. Salting (You can do this by pre-pending/appending something when performing the encryption)
3. When performing the encryption (read the appropriate page) instead of choosing the next two characters. Instead choose perhaps the next three characters, one across one up, two down one left, etc.

Answer 3

What I do is the following:

• I write the passwords down.

Many people will cringe and scream and curse me and say that this is wrong and should never be done, but this is too simplistic an assertion. Details matter. Here are the details:

• I keep the passwords in a text file.

• When I get out of my home and must access my passwords, I bring with me a netbook. That computer has a few specific characteristics:

  1. It runs Ubuntu (a Linux distribution).
  2. No swap space is configured. What is "in RAM" is really "in physical RAM" and never makes it to permanent storage.
  3. The /tmp directory is a tmpfs, i.e. the files in that directory are only in RAM (and that's physical RAM, see above).
  4. I always shut the machine down; I never put it in "sleep mode".

  Under these conditions, I have a reasonable guarantee that if I write a file in /tmp, read it, then shut down the computer, then the file contents will not be accessible to any evildoer who would steal the machine.

• My file full of passwords is symmetrically encrypted with GnuPG, with a big, fat, strong passphrase (that passphrase, I keep in my brain).

• When I must use a password, I decrypt the file in the /tmp directory and I erase it immediately after; and when I no longer need to use the computer, I shut it down, as is my custom.

Under these conditions, my passwords are reasonably safe. This is not perfect: if my computer is hacked in silently and the attacker can observe everything I do for a long time, he will get my passwords -- but he would get them anyway under these conditions, if only by plugging some evil code in the Web browser itself (regardless of how you manage your passwords, the Web browser code gets them at some point, since it must send them to the servers who ask for them). I claim that my method is much safer than the common alternative, which is reusing passwords on several sites. Do not reuse passwords !

(In practice, I very rarely have to access my file of passwords, because I remember the passwords I often type -- and those I do not often type, well, I type them rarely, by definition.)

Answer 4

I like to use VeriSign's Personal Identity Portal. It works automatically with a lot of major websites and you can add your own custom sites as well. It also has some support for OpenID. The best feature is the 1-Click Sign In which gives you a JavaScript snippet that will automatically log you in to the current page.