Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I use LastPass and love it. My girlfriend creates her own long, complex, unique, and thus difficult to remember passwords for every site. She frequently forgets them and has to rest the password. The passwords are "organized" on various post-it notes and scraps of paper in her notebook.

LastPass is too complex for her to use plus she doesn't trust "the cloud".

Can anyone suggest a relatively low-tech yet secure method to store her passwords? Maybe a file on an encrypted USB drive? maybe a book code or something?

share|improve this question
1  
There are a few similar password manager solutions. I'm surprised she doesn't like LastPass....In my opinion their new UI is really 'girlfriend friendly' as I've personally had to start calling it. There's also keepass, which is free and keeps your files locally. In reality though, using a password manager is a security tradeoff. You are trusting the manager to remember your password and safely hand it off to you. –  Rell3oT Dec 1 '13 at 2:36
add comment

3 Answers

If her sole objection to LastPass is that the passwords are "out there", then I recommend using KeePass instead. It works similar to LastPass, but keeps the password database locally instead.

If she needs the passwords to be handy on-the-go, you can use KeePass as a portable app on a USB drive.

If you're really paranoid as to what might happen if the storage media containing the passwords is compromised, (even though the KeePass database is already encrypted) you can store the KeePass database within a TrueCrypt volume for extra protection. TrueCrypt also can be used as a portable app on a USB drive.

share|improve this answer
1  
Just make sure you keep backups. –  Stephen Touset Dec 2 '13 at 18:57
    
@StephenTouset Agreed. My personal preference is to use KeePass with a separate cloud storage account (e.g.: DropBox, Google Drive, SkyDrive, etc.). That way my database is backed up and accessible online, but I'm not reliant upon the cloud provider for its security since I'm guaranteed to be the only one with credentials to unlock the file. (i.e.: If the online account gets hacked, or subverted by a malicious insider, the database file is still useless to the attacker without my key.) –  Iszi Dec 2 '13 at 19:16
add comment

An alternative to keeping a file on a memory stick is using something like IronKey which has its own onboard browser and a password manager. It costs to get the IronKey, but it is solid. Some time ago I switched to LastPass for most of my passwords, but I still keep all my account info for banks, financial institutions, and few other very sensitive accounts on my IronKey. I like LastPass a lot, but not for everything.

IronKey self destructs (zap's its storage) after about 20 failed logon attempts, if someone tries to guess its password.

share|improve this answer
    
hmm this is is more along the right path I think. her objection to LastPass is that her passwords are "out there"; if it can be synced across devices, then someone can crack it. Maybe a biometric USB with a word file on it? Can those be easily defeated if lost? –  Vidro3 Dec 1 '13 at 3:46
add comment

Here is really low tech:

She should come up with one or two passwords such as one easy and one way hard but that she can remember. Assign each a name like EASY and HARD. Now use a small address book to list websites with one of the names for the passwords. For sites that require changing the password just attach a number to the end of the password and write it in pencil in the book ie: HARD7. Don't write the actual words down anywhere.

I'm sure your girlfriend carries a purse so this method is portable too. I started this before the tech solutions were available and it is so simple I have stuck with it.

share|improve this answer
1  
No - this is incredibly bad advice. A fixed password+number is a godsend to attackers as once one password is discovered (eg through a website user database attack - relatively common) all the rest are at high risk as they are easy to get. –  Rory Alsop Jan 18 at 19:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.