Methods for remembering passwords around the web

Question

What's the least painful way to manage passwords for user accounts that you have on various sites?

I see only 3 options:

• Password manager. Passwords can be different and strong, but the downside is that you still need a master password, which should be weak so you can remember it, like JohnDoe45. If someone gains access to it, all your passwords are compromised. Also, if the password data file gets lost, you're screwed.

• A single password for every site that you can easily remember. The downside is that if someone finds it, all your accounts from other sites are compromised.

• Different passwords using a personal algorithm. Like first two characters of the site + first two characters of your name + last character of the site + whatever.

The last option seems the best choice for me. What do you think? Are there better methods which I'm missing?

Answer 1

If you want to remember your passwords, you either have to work your muscle memory, or you will have to choose some easy to remember passwords. However, Easy to remember is also easy to guess. And the "mental strain" of remembering 3-4-5 passwords of a reasonable length with characters from all the different classes (upper; lower; numbers; symbols; even UTF-8 combinations (oh yeah, try having ALT+4099 in your password)), it's not worth the effort for the average user.

So, what we usually do is reuse or write down our passwords. Reuse of passwords (your #2) will, as you say, possibly compromise all accounts associated with it. People actually seem to understand this and usually reuse passwords only over accounts that protect low value data.

Writing down passwords, however: I claim that writing down passwords is not a problem if done securely. The difference here is writing your bank password on the back of the OTP generator or on a post-it note on your monitor, or if you hide the passwords in your wallet. Of course, you can't use GæµRA­♣$6(◘F0z03*╬ as your Facebook password and keep it in a safe. That's bad usability.

I don't like the algorithm either. It's some percentage "security by obscurity" in there, so however unlikely, if someone finds your pattern you're screwed. Say you're a high value target (I know, you might not be, but you might have some of that glorious money) and use the pattern on somedisposablemessageboard.com and somepaywallnewspaper.co.uk, two pages that might just have had a password leak. If your attacker is somewhat "cognitively capable", he might just find your pattern and try BaAnk$taticPa$$word (made up of "Bank", "Anna" and "$taticPa$$word"), which is your banking password.

Password managers are a storage facility that you trust to keep your passwords for you. As an example, LastPass works with a plugin for easy authentication. This way, you enter the master password (which should be hard to guess, but it'll be your only password, you can stand that) once per browser session (IIRC) and keep downloading passwords from LastPass to your service. There's another problem here, for the particularly paranoid. You enter your master password on your keyboard into your browser, meaning that it is stored memory and may (theoretically at least) be read by a trojan. Also, keyloggers may ignite upon your arrival at LastPass.com, collecting your password. Both get the key to the castle.

(Technical fun fact: LastPass passwords are encrypted with a key generated from your master password using 500 iterations of PBKDF2, a key derivation function. 500 iterations are half the absolute minimum for such use specified in the PBKDF documentation, and may not stand brute force if the stored encrypted passwords are leaked.)

So, what the hell should you do if you can't even enter your password on the keyboard? Stop worrying, write down your passwords and put them in your wallet. Do not write Facebook: ¤#V&W#V&, Bank: AybyB%¤YB¤, Porn: &%HB&4syby, etc. You can remember which is which..

If you're a spy for the CIA, I suggest an external device with a screen to keep your passwords. It should not be another mobile phone, but a dumbed-down device. It should, however, not show anyone the passwords and never transfer them in clear. It would work something like this:

Facebook: Gimme your password, Anna's PC.

Anna's PC: Hang on, I've got that cool external device!

Facebook: Yo, Anna. Authenticate by making your device calculate this challenge using our shared secret (the password) and a hash function (or KDF)!

Anna's auth device: HASH = KDF(Salt, (secret + challenge), Iterations (10000000)

Anna's PC: Hey FB. Response to challenge is boogaboogawhatever89646y7547645

Facebook: Wow, I got HASH = boogaboogawhatever89646y7547645 too! Why, you must be Anna!

(Facebook gate opens)

If you're really crazy, buy a USB bar code reader and make your bank password a couple of bar code numbers. I guess you might need several codes per password, however, as these devices (IIRC) only read numbers. 7025943875928759843758924759834759843725098347527465243785942365674382568347567345454735276567543356728578535 is an all right password, huh? Scan the bar codes for your bank and you're in.

Answer 2

For managing passwords, see this answer: the trick is not to remember them, but to store the passwords in some "reasonably secure" storage area.

If you really want to remember passwords, with your brain, then my advice would be to force yourself to type them often, at least daily. Fingers are better than brain cells at this kind of job (it is called muscle memory). Of course, this is not practical for Web passwords "at large". What you can do is split your passwords in two categories:

• the passwords which you use very often, and store in your brain;
• the passwords which you use rarely, and store in a file.

(Various storage systems exist, but a plain file can be secure enough, if you do it properly; again, see the previous response I link to.)

Answer 3

Comrades, ah the world of passwords! So fascinating, depending on which side you're looking at them from! Personally, I think using a sophiscticated personal algorithm along with some personal algorithmic salting, seems to be the most secure.

The trouble with simple algorithmic passwords is that if a website's admins could see your password in clear-text, they could figure out your personal algorithm, and use it at other websites.

In my experience, I have found that the one of the biggest threats to passwords is the ability to reset them, either from the outside (from the web), or from the inside (i.e. from within corporate environments.)

So a sophiscticated personal algorithm + a personal algorithmic salt is what I would use.

My password ofcourse is MyPwd*StackEx7 (, or like you say in America, NOT!... ;-))