How to solve this double master password dilema with dashlane?

Question

I just installed this password manager (dashlane). I put all my password in it including those of my email accounts.

I thought password managers have the purpose that I only have to remember one master password and it stores all the other for me securely. This allows them to be long and random and hard to guess and so on and so forth. Great, except that it doesn't really work like that in practice, because dashlane requires verification whenever I use my master password on a new device.

Here are two scenarios where this fails:

• I installed a new system. Then installed the dashlane app. Now I can enter my master password there, but it doesn't grant me access, because I need to enter a security code that it sent to my e-mail. But guess what I need to check my emails? My e-mail password, which is stored in dashlane. This is a security deadlock.
• If I want to check my e-mails in an internet cafe or on a friends computer, I can retrieve my password for that without having the dashlane app installed via their website. But again, I have to verify the login through my e-mail. Deadlock, again.

To solve this, I have to have a human rememberable password for my e-mail. As it appears to be a bad idea in general to re-use a password for different places, this password should be distinct from my dashlane master password. But that in turn weakens the purpose of the password manager.

What's the best practice for solving this problem? Should I have two passwords (for my manager and my e-mail associated with it)? Should I include the e-mail password in the manager?

Answer 1

The goal of a password manager is indeed to reduce the memory requirements needed to use lots of strong, unique passwords or passphrases. But they don't completely eliminate all memory burden, as you've noted. There will always be some passwords/passphrases that you have to commit to memory. Password managers just help you reduce that to a manageable number.

So yes, you should have a separate email password and memorize it if you need to log in on a system where you won't have access to your password manager database. That's true of any similar situation, regardless of the behavior of a particular password manager product.

Alternatively you can write your email password down on a note that you keep in your wallet or other private place, if you are willing to accept the threat of someone finding it there and figuring out what it is.

I would still keep a record of your email password in the password manager just as a failsafe since you could still access it from a trusted computer in the case of a memory lapse (or losing your wallet).