Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard.

What system do you recommend that won’t compromise all my accounts when one site gets hacked (assume the worst case — site storing passords in clear text)?

EDIT: I am asking for a system that helps me remember the passwords, not a way to store them.

share|improve this question
add comment

9 Answers

Use humor, rhyming, repetition, offensiveness, silliness, common patterns, embarrassing facts, and other similar techniques to remember your passwords.

Examples:

  • octagon@pentagon.gov
  • SquidSquisher
  • pork-the-roast
  • 1ntouchwithmyself
  • dookie4donuts
share|improve this answer
add comment

Put a business card in your wallet with a matrix of shapes, digits and punctuations marks on it. Then just memorize small shapes and use the corresponding icons as your password.

If you prefer to memorize them use the palate method, remember 10 sets of numbers and words, use 3 to make a password and you're instantly got 1000 unique passwords.

share|improve this answer
add comment

Steve Gibson has a number of tools that may be effective - see password haystacks that has the effect of making the password far more memorable but more difficult to break. Alternatively Perfect Paper Passwords can make things easier to remember. There are also multiple variations of the technique recommended by @les

share|improve this answer
add comment

I choose a few letters from the site name. Perhaps those letters are the acronym of the company name. I combine (prefix, append, embed) that with a sequence of characters (to make a strong password) that are the same for all of my passwords. For example:

google =              goog15#*xfg27%
yahoo =               yaho15#*xfg27%
Wall Street Journal = wall15#*xfg27%
share|improve this answer
    
It is better if the letters are transformed by an easy to memorise, but hard to guess if you just get to see one password. –  kinokijuf Feb 22 at 16:56
add comment

This can be done, but requires work, hence the popularity of password database software!

You'll want to study mnemonics, the art/science of systems of remembering things. Mnemonic performers do things like memorize the order of a shuffled deck of cards; those methods on a smaller scale should be enough to recall a few passwords.

Derren Brown's "Tricks of the Mind" has a good beginners tutorial, but here's an example of one simple technique, image linking, which should work well for pass phrases.

Suppose your email password is "correct horse battery staple". Imagine, in turn these silly images:

  • a huge pile of mail envelopes being corrected by a school teacher as if they were homework
  • the same teacher still correcting papers while riding a horse through the classroom
  • the same horse in a garage having it's battery changed by a mechanic in oily overalls
  • the same car batteries being used to power an enormous stapler

These are deliberately stupid images, the vivider the picture you can make in your mind, the better. Picture this sequence repeatedly, and you'll find that the sequence sticks in your memory; when you start your email program, you'll think of a mail envelope, which leads you to correct, to the horse, then to staple.

Bonus tips:

Choose words that are easy to visualise; you saw I had a little trouble with "correct" above!

If you don't like typing something that long, use a passphrase initialism, e.g. turn "abicjinh" into "apple bicycle idol chicken joker icicle notebook house" and make image links for those words.

You may have password complexity rules for some apps, where you have to use upper/lower case or numbers. These need a little more work.

Remember which letters are capitalised by picking some landmark from a capital city and setting the image there. e.g. for "aB" you visualise an apple riding a bicycle past the Eiffel tower.

Numbers are harder, the usual way is a "peg" system where you assign a reserved word to each number, memorise those, and then use the associated word in the image. e.g. memorise 1-gun, 2-zoo, 3-tree, then remember "a2" as a wild apple being exhibited in cage in the zoo.

share|improve this answer
add comment

If it's something you really can't afford to lose, the safe mentioned above may be the best way. But if you want to truly remember them, you should try to make a sentence out of it.

When I have to create a new password, this is what I do:

  • I pick a song (if possible related to what I need the password for);
  • I keep the first letter of every word (I take as many words as needed);
  • I write these letters in 1337-speek (a modified version with only one character per letter: it's easier to type while singing (in your head of course!), and some letters are left).

Let's take an example: "Mary had a little lamb whose fleece was white as snow" → mhallwfwwas → m-411w=ww45 (the - is the horizontal bar of the H; same with = for F, * for P (from |*), …)

share|improve this answer
add comment

To remember passwords, type them often. You can remember dozens of passwords if you type them daily -- that's muscle memory, the same kind which is used by martial arts practitioners, so remembering many passwords is like being a Kung fu master (albeit in a slightly less awesome way).

Bruce Schneier, well-known Chuck Norris imitator, recommends writing down your passwords and keeping them in your wallet. This makes sense because you are both trained and highly motivated at maintaining a high level of physical security on your wallet. I would double that with a copy of the same password sheet somewhere in your safe, so that you could recover from a wallet theft (i.e. logging again in all the sites and change your password). Also, a piece of paper has no battery which needs recharging.

(Caution: your smartphone is not a good wallet. Physical security on your phone is much lower than the one you apply on your wallet. Unless you are in the habit of flourishing your wallet at arm's length while walking in the street.)

share|improve this answer
    
I agree with Bruce and @ThomasPornin, write them down and keep them in a safe or in your wallet, I mean, how often do you lose your wallet? That being said, don't put your wallet on your desk and go to the can, keep it on you at all times. –  GdD Oct 15 '12 at 9:22
    
+1 for muscle memory :) It is greatly useful for me when i solve Rubik's cube. –  Ebenezar Dec 3 '13 at 9:49
add comment

A way of resolving this issue I've been using with much joy lately is the PWDHash system by the Stanford Security lab.

Basically what is does is compute a cryptographic hash of your 'master password' together with the domain of the page you're signing up at, clips it and then fills the result in as the password. This way, every site you sign up for has a non-reversable password that does not compromise any other login, even if someone happened to stumble upon it in plaintext.

There are PWDHash addons for the major browsers, and you can use the web interface if you're on the move.

Other than the fact that it's a marvelous and easily understandable application of theory, a major upside is that you don't have to trust any third party with your passwords. Everything is done locally and open source - it works fine without an internet connection or incomprehensibly encrypted binaries.

share|improve this answer
add comment

You can use a password vault. For instance you have a txt or an excel with all your passwords and you keep it in an encrypted container (truecrypt for instance) and just decrypt it when you need it.

However this is hard to actually use if you want it readily available at any time. If you trust other companies with your data, you could opt for sites like http://www.passpack.com to store your passwords. I'm not really a fan of this myself because you are never 100% how things are stored on the backend.

share|improve this answer
    
What if I’m not at home? –  kinokijuf Oct 14 '12 at 14:55
    
pendrive, dropbox? –  Lucas Kauffman Oct 14 '12 at 14:57
1  
There are entirely offline password vaults designed for such use, like KeePass. –  ewanm89 Oct 14 '12 at 15:06
1  
Using KeePass 2 and store the encrypted database on dropbox is a common solution. –  ewanm89 Oct 14 '12 at 15:08
1  
I was asking a different question. I want a system that helps me remember the passwords, not store them. –  kinokijuf Oct 14 '12 at 16:15
show 7 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.