10

Is it possible to only remember the master password to the password manager and still be safe? For example you must also know the password to log in to the computer (and possibly the password for full disk encryption) before you can access the password manager. Multiply this for each device.

If you backup your password database then you probably need a password for it too (especially if you’re using a cloud based service, such as Google Drive or Dropbox, for the back up). Also if you have multifactor authentication enabled, you probably need to remember the password for your phone too (if using app such as Google Authenticator).

Is there a better way, or am I misunderstanding something? Is it really possible to only need to know the password to the password manager?

  • 1
    If it's for home, you could print some password, put it in a hidden safe in your home. Then you only need to remember the safe password, and remember to store that piece of paper in the safe every time. – the_lotus Aug 4 '16 at 11:34
  • 1
    Well, LiveCDs do not require a password to run, and you can install a password manager there and keep some files so theoretically it's easy to always boot from a liveCD, enter your password manager password to unlock your database which contains the encryption key for your FDE drive and then start doing stuff from there... – Bakuriu Aug 4 '16 at 13:12
9

Possible? Yes   Realistic? No

I set my Windows login password to be the same as my FDE password. A controversial choice, but I don't see any major risks with this.

If you have FDE then in theory you can use a password manager with no master password and still be safe. However, most people (and I include myself) don't feel comfortable with that. So that's two passwords as a minimum.

There are some passwords I don't want to put in my password manager, e.g. PINs for bank cards. So I have to memorize them.

I also find there's a few passwords you need to have memorised for practical reasons. One example is my Apple AppStore password. Even with touch ID I find myself typing it enough that I need it memorised. You can't paste into that password field, and it's modal, so you can't switch between it and the password manager.

  • 4
    I do find the Apple AppStore password one of the most cumbersome. – MrWhite Aug 4 '16 at 9:45
  • 6
    If you have FDE then in theory you can use a password manager with no master password and still be safe I'm not exactly sure what is the theory that you go by, but to me it only protects from attacks done off-line on a machine which is not booted. – Sebi Aug 4 '16 at 13:48
  • 3
    @paj28 With master password in place both decrypted disk captures and physical access to the machine while it is booted will not give you the passwords. – Sebi Aug 4 '16 at 13:57
  • 1
    @paj Please consider two points: One is that when your computer is locked, your decryption key and, depending on your OS settings, a few gigabytes of data resides in your memory. If we assume physical access we can also assume that it can be read by the attacker. This is very unlikely scenario, and probably only applies if you are an important, direct target. The second one, applies in the opposite case. Malware often only looks for easy, sensitive information - such as bitcoin wallets or password managers and if you are not hit directly, chances are that password-locked stuff will be ignored. – Sebi Aug 4 '16 at 14:20
  • 3
    I can copy/paste in the Apple ID passzord modal on iPhone. I use the MiniKeePass app. When buying something on the App Store and the modal appears I simply exit the app, open MiniKeePass, get the password and go back to the app store to try my purchase again. – André Borie Aug 4 '16 at 14:21
2

If SmartCard or similar technology is used to login to the computer then IMO one can get away with single password to the password manager. Even more - some password managers are able to authenticate using SmartCard or token on the USB drive.

That leaves the devices like smartphones, which do require password. However, if fingerprints authentication is used (which is not a most secure authentication method though), then technically, you need just one password... to your smartphone device.

1

Yes, technically you could store the passwords in a password manager and just have the password for the password manager to get access.

But if you do this, you should really get away from a "password" and maybe use a "passphrase", a password that is so long, that it's unrealistic to be brute-forced. Another problem is that these password managers can be hacked, so be also aware of that.

Another very good option is a password manager that checks the physical address of a computer instead of a typed password, so there's no password needed at all. This is especially useful for companies, because it would only work for the computers in a company.

So all in all, yes, you can get a password manager to encrypt and store all your passwords, but get a very powerful password for the password manager for safety.

  • 1
    "Another very good option is a password manager that checks the physical address of a computer instead of a typed password, so there's no password needed at all." how do these work and what are they called? I've never heard of them but sounds like a great idea. – Celeritas Aug 4 '16 at 10:28
  • a password manager that checks the physical address of a computer instead of a typed password, so there's no password needed at all. So anyone using your computer can access to your passwords? – A.L Aug 4 '16 at 17:08
  • I believe that they check the MAC address of a computer. @A.L Yes, if they can Log-in or somehow hack into the computer they could access the passwords. – Mathias Aug 5 '16 at 6:15
1

It's slightly opinion based this question, however I wouldn't say it was enough so to be closed.

Realistically you probably need to have a few different passwords remembered.

If you carry the same device around everywhere containing your password vault, i.e. your phone, then you probably need to remember two passwords at a minimum:

  • Phone password
  • Password manager password

Within your password manager you could store the passwords for your other devices.

However, this assumes that you never lose your phone. Therefore I'd recommend remembering your laptop password as well, then you have another trusted device you can log into when you need access to your passwords.

If you're using separate cloud and password manager systems rather than something integrated into the cloud like Lastpass, then that's another password you may have to remember.

I would recommend using several Dicewords for each password you need to remember, because these are more memorable. A memory technique such as the link method may help you to remember lists of words, however Dicewords can sometimes produce some uncommon and unusual words. I find though that this works for me, and can often transform the words produced enough so that I can remember them after typing them enough times.

This way you will end up with say a maximum of three passwords you will need to actually remember, plus maybe one or two for extra devices. You don't need a memorable one for every device, as long as you will have access to one when needed you can then retrieve the passwords for the others from your password vault.

0

Is it possible to only remember the master password to the password manager and still be safe?

Depends on circumstances. If you assume that nobody will ever guess, crack or otherwise get your master password, then sure, you are as safe as can be.

The problem arises if somebody does get your master password - then it's a much larger damage than if you were remembering different passwords.

It's simply "keeping all eggs in one basket" - it might just be too much for your level of paranoia.

For example you must also know the password to log in to the computer (and possibly the password for full disk encryption) before you can access the password manager. Multiply this for each device.

Not an issue. The safe itself needs to be encrypted, then you can and should replicate your (encrypted) safe wherever you need, possibly even in public spaces (of course only if you believe that it is resistant to brute force attacks and free of bugs and backdoors).

For example, I have my KeePass safe on my home PC as well as on my smartphone; especially the version on the smartphone can easily be accessed by whoever gets his hands on it. I believe the password and the program to be "safe". I would never put it in a public space (e.g., on a github repository) because while I believe the software to be clean now, it would not be the first time that software turned out to be bad after the fact.

This is a bit of a different issue though, "do you trust your password safe". I assume this is given, or your current question would be moot.

If you backup your password database then you probably need a password for it too (especially if you’re using a cloud based service, such as Google Drive or Dropbox, for the back up).

You would never have a cleartext password database in the first place, so this is not an issue. See above, it's the same thing.

Also if you have multifactor authentication enabled, you probably need to remember the password for your phone too (if using app such as Google Authenticator).

Sure, you need to remember passwords for the devices you actually use to access your safe. Nothing will ever change that, unless you use the same password for your safe and your devices. This would, at least at my level of paranoia, be unacceptable though since it would make it more likely for it to be intercepted.

Is there a better way, or am I misunderstanding something? Is it really possible to only need to know the password to the password manager?

In principle, yes, with the exception as above.

0

Is it possible to only remember the master password to the password manager and still be safe?

Of course it is possible to remember the master password, but is it safe? I am not sure about that. If you're looking for something that maybe you're the only one will remember, even if people saw the word wouldn't doubt it, You can set the master passphare to something complex that has no meaning and perhaps with different language alphabet than English such Russian on RU keyboard. like: одоЧтетьаелбан

That maybe will helps you for a certain extent. Not if someone intentionally seeking that password. Nothing online is 100% secure, it is a matter of time and hardening, but all things on the internet are breakable.

Is there a better way, or am I misunderstanding something? Is it really possible to only need to know the password to the password manager?

It is possible but a risk, a better way to by your peace of mind, is dual-authentication to your Password-Vault. Even better something like a physical token that you carry on you most of the time. that way even if an attacker got access to your master password for the vault, they still going to need a second physical authentication to gain access.

I really like Yubico for that particular reason.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.