I just installed this password manager (dashlane). I put all my password in it including those of my email accounts.
I thought password managers have the purpose that I only have to remember one master password and it stores all the other for me securely. This allows them to be long and random and hard to guess and so on and so forth. Great, except that it doesn't really work like that in practice, because dashlane requires verification whenever I use my master password on a new device.
Here are two scenarios where this fails:
- I installed a new system. Then installed the dashlane app. Now I can enter my master password there, but it doesn't grant me access, because I need to enter a security code that it sent to my e-mail. But guess what I need to check my emails? My e-mail password, which is stored in dashlane. This is a security deadlock.
- If I want to check my e-mails in an internet cafe or on a friends computer, I can retrieve my password for that without having the dashlane app installed via their website. But again, I have to verify the login through my e-mail. Deadlock, again.
To solve this, I have to have a human rememberable password for my e-mail. As it appears to be a bad idea in general to re-use a password for different places, this password should be distinct from my dashlane master password. But that in turn weakens the purpose of the password manager.
What's the best practice for solving this problem? Should I have two passwords (for my manager and my e-mail associated with it)? Should I include the e-mail password in the manager?