1

How many different passwords should I use for my ArchLinux laptop that I'll be carrying around all the time ?

Here are the services I could need a password for :

  • Full disk encryption
  • User login
  • Root login
  • Password manager encryption
  • Backup encryption
  • BIOS Password
  • GRUB Password

Is it safe to reuse the same password, let's say for full disk encryption and backup encryption for instance, or for the user login and the password manager encryption ? Or should I use 7 different strong passwords ?

Would it be safe storing the backup password/root password in a file under full disk encryption ?

Improve this question
5
  • Obviously seven different strong passwords provide more security than reusing the same password. But there are some considerations to make: - Do you tend to forget you password? - Do you shut down your OS before you carry your laptop around? - Who has access to that laptop anyway? - What is a "strong password" to you (that you are able to remember)?
    – anon
    Commented Jun 6, 2017 at 10:52
  • A strong password for me is a password of at lease 6 Diceware words, generated randomly. I would forget a password if I don't use it often. For instance, I won't forget my encryption password as I have to use it each time I reboot, but I'll tend to forget the root password because I use sudo most of the time. I do shutdown/hibernate to encrypted swap my OS most of the time, arch is really fast to boot up, however I might sometimes just lock it using i3lock (not really secure).
    – tourdetour
    Commented Jun 6, 2017 at 13:46
  • 1
    I posted an answer based on the given facts. Besides: Is this question restricted to linux? IMO this does not depend on the OS.
    – anon
    Commented Jun 6, 2017 at 14:25
  • just a short note: full disk encryption does not protect against an attacker that can modify the disk and you using it later or against an attacker that can image the whole disk at two different times. FDE protects only against lost laptop, not evil maid attack.
    – Hubert Kario
    Commented Jun 6, 2017 at 14:45
  • I personally use KeePass 2 for managing passwords. This isn't helpful for full disk encrpytion systems (tho there are mobile apps for reading KeePass files) but for root and backup passwords theese might help. My KeePass file is synced so i can use it from another device if i forgot my user password but idk if that helps you
    – BlueWizard
    Commented Jun 7, 2017 at 23:02

3 Answers 3

Reset to default
2

I really do like @Serge Ballesta's answer, since my questionlike comment was meant to direct the OP that exact way. Although I will try to answer the question of: "Where can I reuse a password without loosing too much safety?" Let us look at the given list:

Full disk encryption
User login
Root login
Password manager encryption
Backup encryption
BIOS Password
GRUB Password

Since Full disk encryption and Backup encryption is basically the same thing (besides the fact there is another timestamp in it): I suggest it is safe enough to reuse the strong password for both of them. Typically you want your backup as new as it can without being broken/infected like your current system. Thus it is propably good enough for an attacker to obtain one of them.

Since you mentioned that your User login has administrative rights I guess it is O.K. if your Root login has the same Password or maybe an easy to remember variation of your User's Password.

(Since some of you want to kill me with fire now) I will focus on where I would definitly not reuse passwords.

Password manager encryption is IMO a save bet here. If you already have a password manager and you just have to remember one strong password, why would you reuse it?

I am less sure about BIOS Password and GRUB Password. I will not give any opinion on that, because I don't want to cause you trouble.

As others already mentioned: If you are able to store seven different and strong passwords in your brain for eternity: forget all my previous points. DISCLAIMER: This is an opinion-based answer and I will not guarantee that reusing passwords this way is as safe as using different strong passwords.

PS: Please consider also the fact that sometimes wrench > password strength. (https://xkcd.com/538/)

Improve this answer
2
  • It seems better to reuse passwords to some extend (for instance for backup encryption) than forgetting it or having to note it down somewhere. I'll try to use only passwords I'll have to use each time I boot my system, without making it unusable. For instance, having a bios password, then a grub password, then the encryption password, then the login password, would be overkill. If I sum up your post, I'll need : 1. Password for disk encryption / backups 2. Password for login and administrator tasks 3. Password for password manager to store random strong passwords for websites and other servers
    – tourdetour
    Commented Jun 6, 2017 at 15:03
  • @tourdetour That is a really good point. I can see that most of us are happy with less passwords for one system boot.
    – anon
    Commented Jun 6, 2017 at 15:07
0

It depends whether your are a robot or a human being. If you are a robot, fine, just use 7 strong (random) password. Store them in your non volatile memory, and your will find them there every time you need them.

Human being on the other hand have only associative memory. Finding, remembering and correctly typing 7 different, strong and unrelated password is beyond the capabilities of many of us. So we have to balance between ideal security and usability. In addition, the overall security of 7 different passwords is not far from the security of a single passphrase composed of 7 real words...

The worst case I strongly urge you against is when one of the seven passwords is used far less often that the others: the risk of forgetting it would really be too high.

Of course, a real answer should considere a serious risk analyzis in terms of Confidentiality and Availability (integrity should be less a concern here). For example my holiday pictures have not same value as a nuclar bomb code: I cannot rebuild the former if I lose them, while a code always provide a lost password facility ;-)

Improve this answer
1
  • So I might use a single strong password, and use a password manager for everything else ? I guess encrypting my password manager with my account password wouldn't be a bad thing : the passwords are well hashed in Linux aren't they ? I don't see the point of having a root/account password : if somebody could guess my encryption key, they would just have to mount the drive by booting from a removable drive and change the account passwords.
    – tourdetour
    Commented Jun 6, 2017 at 13:52
-1

Use seven different passwords.

You need to start getting used to the idea of using many different, yet secure passwords, for different services or accounts. Reusing passwords is a potential problem that will come back at you somewhere in the future.

"Remembering seven secure passwords, however, is a very difficult task." This is the answer I'd expect. As such, let me give you a good password creating strategy.

The strategy consists of choosing one combination of words and one rule-set. With these, you will derive all the passwords you need for your machine depending on the context (where a context may be "root", "user", "backup", "bios", etc.). Let's say we choose the word combination "HorseStaple" and the following rulset to construct a password:

1) Take the 2nd letter of the context and use it as the First letter.
2) Add a "!" char.
3) Add the word combination replacing all "e"s with the third letter of the context.
4) Add the first letter of the context Capitalized.

This sounds complicated, but look at these context - password pairs:

"boot" - o!HorsoStaploB
"user" - s!HorseStapleU
"backup" - a!HorscStaplcB

You are free to simplify or make the rule-set as complicated as you want. This also works for passwords you use in other sites:

"gmail" - m!HorsaStaplaG
"facebook" - a!HorsaStaplaF
Improve this answer
2
  • So the idea is not to reuse the password, but use similar ones for similar things using a rule set ? Is it really secure ? If two passwords are compromised, the attacker could easily guess the ruleset, so I'll need a very complicated rule-set that might be even harder to remember than a password. But that's a good idea anyway, thank you !
    – tourdetour
    Commented Jun 6, 2017 at 13:50
  • 1
    modifying previously cracked passwords for different attacks is exactly what crackers do, what cracking tools are programmed to do (see John the Ripper). So compromise of any one password should be considered a compromise of all of them.
    – Hubert Kario
    Commented Jun 6, 2017 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .