Safe storage for multiple passwords for multiple accounts

Question

I've had this difficulty for a while, and I hope to get some feedback or referral to the sites where this problem may be discussed.

Nowadays all of us have multiple accounts, both personal and work-related (logins to websites or applications at work, logins to personal computers and mobile devices, etc.). I personally have more than 50 different accounts. In addition, some of those resources require changing the password every month or so, and some of them require that the next password does not have the same combination of symbols as the previous one and that it has both capital letters and numbers and other symbols, well, you know...

How do you come up with so many different passwords that have different combinations of symbols and how do you remember all of them?

I feel that it is incorrect to record work-related passwords on personal mobile devices or in cloud storage. It is also prohibited by company policies. I also prefer not to record the passwords to the sites where I can manage personal finances or taxes.

Next, some passwords may be restored using the email that was used for registration. Some passwords may be restored using the phone number that was used for registration. How do you manage that? Do you record or memorize the correspondence between the emails and the sites/resources, and also logins? Do you use separate emails for money-related issues?

Are there any interesting articles on the topic? What is the correct way of working with this much complexity/is there a know how? Was there an idea that the creators of this system had in mind? How all this can be secure if we end up recording all these passwords?

Answer 1

Password managers are the accepted and recommended solution to this problem:

NCSC (UK):
https://www.ncsc.gov.uk/blog-post/what-does-ncsc-think-password-managers

CERT (US):
https://us-cert.cisa.gov/ncas/tips/ST04-002

ENISA (EU):
https://www.enisa.europa.eu/news/enisa-news/tips-for-secure-user-authentication

NISC (Japan):
https://www.nisc.go.jp/security-site/campaign/files/aj-sec/handbook-all_eng.pdf

NIST (Standards body):
https://pages.nist.gov/800-63-3/sp800-63b.html

And password managers have been the recommendation of the experts here since the site began 10 years ago.

Here's a list of password managers to get you started. This type of software has been around for about 20 years.

Features:

• Software may be online and synced between devices, or off-line and only stored locally
• Some are open-source (so experts can review the program code for problems)
• All software encrypts the data to prevent password disclosure in case the device it is on is stolen or accessed without authorisation
• Most (all?) includes note-taking functionality to include extra info, like secret questions, etc.
• Most (all?) will generate random passwords for you
• All software is tested to some extent by security researchers trying to find weaknesses. The more popular the program is, the more attention it gets from researchers hoping to make the news with a finding.

In practice, you do not need to put 100% of your passwords in one password manager. It can make sense to break up your work passwords and personal passwords into different software and use the software that has the features you need for your work environment. Some work environments provide a commercial password manager to all staff for work passwords. Others have a commercial password manager for IT departments to remember all the passwords for the thousands of systems they administer.

In reality, even a password manager with weaknesses is more secure than trying to generate your own passwords and remember them. A long, random password is the most secure, and your brain can't generate or remember those.

Writing them down is another option to consider, but that suffers from a lack of encryption and a lack of backup.

Answer 2

Using a password manager is the most obvious solution. There is no reason not to use one.
You can have very complex passwords, that are different for each website (or other purpose) and you don't have to remember them.

To present a concrete example based on my experience, I use KeepassXC which is a fork of the well-known KeePass software.

Some benefits:

• free and open-source
• local storage
• files portable across platforms

Some of the criteria which are important to me:

• I don't want to have my passwords stored in the cloud, even if the vendor claims that they cannot be recovered (in theory)
• I prefer open-source software

I use Linux most of the time but the app works on Windows too. I can simply copy the .kbx database file and start using it on another computer.

There is also a browser plugin available. So you can login to sites with zero keystrokes involved.

The downside: requires some discipline. I have multiple copies of the database file on several machines. So I have to ensure that they are in sync with each other. Or at least, if I make an update on one of them, I have to make sure I will not overwrite a more recent version. If in doubt, look at the last modified date.

I could sync the file in many different ways but so far I have not bothered to do so.

I feel that it is incorrect to record work-related passwords on personal mobile devices or in cloud storage. It is also prohibited by company policies. I also prefer not to record the passwords to the sites where I can manage personal finances or taxes.

You can have use one app but separate database files: one for personal use, one for business etc. This is indeed good practice.

Answer 3

It seems your situation is

1. You are not allowed to install software on your work computer.
2. Your work computer does not have a password manager installed.
3. You are not allowed to store credentials in the cloud.
4. Your work credentials protect employer (not personal) assets.
5. Your employer has dictated password policy with elements like mandatory password changes and character requirements.
6. Your work computer does have a spreadsheet program.

Then I would recommend that you use the spreadsheet to generate and store the credentials.

You can print out copies of the spreadsheet to serve as backup. Considering the mandatory password changes, I would date the spreadsheets. Definitely replace printed backups when you change your password. Securely destroy old printouts. Keep your printouts in a secure location.

Obviously a password manager would be better, but based on the available facts I would have to conclude that your employer does not want you to use a password manager.