1

I use a password manager, I vary the length of my passwords occasionally and they're all unique and random but I think - what if the PW database leaks (e.g., malicious software exfiltrates the contents)? Not all sites support 2FA so how can I increase security?

I came up with an idea. I decided to type a word at the start before I autotype the long random password. The word is always the same for every account in this "important" category and the word only exists in my head. The idea is if the database leaks then no one can get in to my most important accounts because they don't know the word.

This is a sort of 2FA without the need for website support. If multiple important credentials were to leak it would be obvious what I was doing and you could assume there were other passwords that I use with this word at the beginning. I assume this decreases entropy. In what scenarios would my system be less secure, if any? Could knowledge of my secret word from one leaked credential (e.g. from a website breach) help you crack another of my accounts beyond the obvious benefit of knowing e.g., 5 of my 25 chars? Am I better off not doing this for some cryptographic reason or is it a sensible extra precaution against a database leak?

After seeing some answers, more concisely, could knowledge of [staticWord]'s existence / content / position, help you crack "[longRandomString][staticWord]" or is it always at least as strong as [longRandomString]?

Just thinking through this, is there a possibility an attacker may not know they've cracked a password if it's a random string, until it's tested to see if it works. Whereas you could assume it's cracked if you decrypted a random looking string and noticed a real word at the end of it. I don't know whether this could/would happen. I think my staticWord should be short and random.

3 Answers 3

1

What this doesn't protect against

You don't really specify which database may leak. If the database of the web application leaks, or if your complete password leaks - eg via phishing - your scheme will obviously not help against that at all, because it's not real 2FA.

What this does protect against

On the other hand, if your password manager database - and the corresponding password - leaks, this will help in certain situations.

If we assume that an attacker knows that you are using this scheme, you are now essentially using the same password on all websites. Your security now depends on the security of the weakest website you registered, and on the strength of your additional password.

Things to take into account

Your second password should be reasonably strong, otherwise the scheme is useless.

Obviously it should also not be the same password you use for your password manager.

I would also recommend that you append this password after the password stored in your password manager. Some websites may cut off your password after X characters, and if X is small, you may end up with just this extra password, which will make leakage more probable and reduce your overall security. On the other hand, if your additional password is cut off, your back where you started (no additional security, but also no additional weakness).

Conclusion

Your scheme may add a small amount of additional security in case your password manager data leaks, although the added usability disadvantage - having to type the additional password - wouldn't be worth the trouble for me. At the most, I would use the scheme for extremely important accounts.

A more reasonable approach would be to have two different password manager databases: one for the less important passwords which you can also use on systems which may be more likely to be compromised, and one for important passwords, which you will only use on systems you deem to be secure. This should achieve the same goal you want to achieve in a cleaner way.

3
  • Yes I meant if, for example, my password manager's database contents gets dumped to cleartext and ex-filtrated while it is unlocked by some sort of malicious software. To be clear the part of the password that is stored in the manager is almost always letters, numbers, symbols and 16 - 30 chars. What I really want to know is whether that managed part of the PW is weaker because of the non random second part. Does using the random, managed string first instead of second mean my system is ALWAYS more secure than just a single random password?
    – Ian
    Aug 3, 2016 at 21:31
  • @Ian Appending additional, constant characters to your generated password will not make it weaker. And yes, appending those characters will be - very very slightly - more secure. But really, if your pw manager database is leaked in a way that the passwords can be read, you have more serious issues such as a compromised system, which means that an attacker can also gain access to your additional password, which is why I don't think it's worth the trouble.
    – tim
    Aug 3, 2016 at 22:04
  • There may be some use-cases where it does make sense though: you may use the manager on unsafe systems for less important passwords, which do not have the custom password, in which case your more important passwords would still be somewhat safe; but in that case, having two databases - one for important, and one for unimportant passwords, would be more reasonable.
    – tim
    Aug 3, 2016 at 22:04
0

You are using a password manager and want to protect against the leakage of the password managers database.

You may take a look at the mooltipass password manager. https://www.themooltipass.com/ This is a physical device, which stores your passwords. This will protect you against the leakage of the "complete password database".

Of course you are still using passwords. I.e. it does not protect against:

  1. Sniffing/keylogging/shoulder surfing of the password when it is entered. This will compromize one of your passwords.

  2. Leakage of the services' user database. Which will compromie the hash of one of your passwords.

So there are some scenarios it protects you against like:

  • stealing your local password database by some trojan.
2
  • Mooltipass does look very neat. I've thought about using an old smart phone that's had its radios disabled and running something like keepass2android on it to have something like this without the HID trick.
    – Ian
    Aug 3, 2016 at 21:40
  • I am using Mooltipass and am very content. But I also do not use certain websites and accounts on my smartphone.
    – cornelinux
    Aug 4, 2016 at 10:25
-2

just utilise the forgotten password feature in a website randomise the password and if you lose your DB then forgotten password comes into play.

but why not use a cloud solution for your password manager like dashlane. all backed up to the cloud; implement two factor in the cloud as well.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Aug 5, 2016 at 7:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .