7

I believe that password managers have a lot of advantages rather than remembering the passwords. So: its time to use them! But I don't want to lose the capability of using my passwords in devices I don't own.

Asuming that the device doesn't have any malware, writing my password (without password manager) seems secure. But I can only think in two ways I could use a password manager from devices I don't own and none of them seems to be secure or good enough.

  • View your database online and be able to show / copy the passwords. Both very insecure, anyone could be watching and the password will also be saved in the clipboard.
  • Installing the password manager. This could take time and be very annoying and would imply to sync all my database. Also, the device could already have the product installed (in case the owner also uses it).

Is there any way I'm missing? Is there any product offerin a solution for this scenario?

Thanks

  • 2
    In some cases, I've used a USB device that simulate a keyboard and that can be reached through Bluetooth and can be controlled from my personal phone. I connect that to the server I'm working on and then use the PW manager on my device to "input" it on the server. A bit convoluted, but really good when you HAVE to enter that 40 characters root password – Stephane Oct 20 '15 at 15:18
  • It is kind of convoluted, but its actually a very good alternative – Diego Oct 20 '15 at 15:32
  • 4
    @Stephane Link? I'd be interested in such a device, if the price is reasonable... – Canadian Luke REINSTATE MONICA Oct 20 '15 at 18:13
  • 1
    inputstick.com – Stephane Oct 21 '15 at 6:39
9

When you introduce secret information in to a device you do not own, it's simply not your information anymore. Whoever owns the device owns the information. If you unlock the password vault with your password, there is always a chance it's recorded somewhere. In the end it all boils down to trusting the device provider.

  • Yes you are right blog.lastpass.com/2015/06/lastpass-security-notice.html – user45139 Oct 20 '15 at 14:46
  • 1
    As an alternative, you can unlock your password database on a device you do own (like your phone), then transfer the individual password you need to the untrusted device. (Either manually, or with a device like InputStick.) Still not ideal since the untrusted device could potentially steal your password, but better to reveal a single password than your entire password database. – Ajedi32 Oct 20 '15 at 18:52
0

I know what you're talking about, the closer thing you have to this is "google sign-in" authentication. For example if you have accounts that allows you to log-in to their service with your google account, like Dropbox, Bitbucket or stackexchange you should use it.

That's as good as having a on-line password manager and better than this, right now Google have something called "sign-in with your device", that allows you to log in without using a google password in your browser, only you gmail.

This will work in this way.

  • You want to sign-in to stackexchange.com
  • Instead of entering stackexchange's username and password you click on log-in with google.
  • You enter your gmail.
  • Your android phone ask your for permission to log-in in another device.
  • Then you finally have signed in to stackexchange without entering any password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.