7

I believe that password managers have a lot of advantages rather than remembering the passwords. So: its time to use them! But I don't want to lose the capability of using my passwords in devices I don't own.

Asuming that the device doesn't have any malware, writing my password (without password manager) seems secure. But I can only think in two ways I could use a password manager from devices I don't own and none of them seems to be secure or good enough.

  • View your database online and be able to show / copy the passwords. Both very insecure, anyone could be watching and the password will also be saved in the clipboard.
  • Installing the password manager. This could take time and be very annoying and would imply to sync all my database. Also, the device could already have the product installed (in case the owner also uses it).

Is there any way I'm missing? Is there any product offerin a solution for this scenario?

Thanks

Improve this question
4
  • 2
    In some cases, I've used a USB device that simulate a keyboard and that can be reached through Bluetooth and can be controlled from my personal phone. I connect that to the server I'm working on and then use the PW manager on my device to "input" it on the server. A bit convoluted, but really good when you HAVE to enter that 40 characters root password
    – Stephane
    Oct 20, 2015 at 15:18
  • It is kind of convoluted, but its actually a very good alternative
    – Diego
    Oct 20, 2015 at 15:32
  • 4
    @Stephane Link? I'd be interested in such a device, if the price is reasonable...
    – Canadian Luke
    Oct 20, 2015 at 18:13
  • 1
    inputstick.com
    – Stephane
    Oct 21, 2015 at 6:39

2 Answers 2

Reset to default
9

When you introduce secret information in to a device you do not own, it's simply not your information anymore. Whoever owns the device owns the information. If you unlock the password vault with your password, there is always a chance it's recorded somewhere. In the end it all boils down to trusting the device provider.

Improve this answer
2
  • Yes you are right blog.lastpass.com/2015/06/lastpass-security-notice.html
    – user45139
    Oct 20, 2015 at 14:46
  • 1
    As an alternative, you can unlock your password database on a device you do own (like your phone), then transfer the individual password you need to the untrusted device. (Either manually, or with a device like InputStick.) Still not ideal since the untrusted device could potentially steal your password, but better to reveal a single password than your entire password database.
    – Ajedi32
    Oct 20, 2015 at 18:52
0

I know what you're talking about, the closer thing you have to this is "google sign-in" authentication. For example if you have accounts that allows you to log-in to their service with your google account, like Dropbox, Bitbucket or stackexchange you should use it.

That's as good as having a on-line password manager and better than this, right now Google have something called "sign-in with your device", that allows you to log in without using a google password in your browser, only you gmail.

This will work in this way.

  • You want to sign-in to stackexchange.com
  • Instead of entering stackexchange's username and password you click on log-in with google.
  • You enter your gmail.
  • Your android phone ask your for permission to log-in in another device.
  • Then you finally have signed in to stackexchange without entering any password.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .