24

So I'm wondering how many passwords is enough to have my data safe because right now I have 1 hard password for bank & mail (>10 characters + numbers etc.) and 1 medium password for games and 1 for shady sites. I keep all them memorized and not on paper/in a document. Is this enough?

7
  • 4
    I think keepassx should be fine for remember many sophisticated passwords per many sites.
    – user164059
    Nov 18, 2017 at 11:49
  • 16
    No of course this is nowhere near enough Nov 18, 2017 at 15:52
  • 32
    function enoughPasswords(numAccounts, numPasswords) { return numAccounts === numPasswords);
    – corsiKa
    Nov 19, 2017 at 4:36
  • 2
    @corsiKa enoughPasswords(10, 42) 🤔
    – mb21
    Nov 19, 2017 at 12:34
  • 5
    @mb21 uhhhh properPasswords(accounts) { valid = []; accounts.forEach(a => { if(!valid.includes(a.pass) && entropyBits(a.pass) > 40) valid.push(a.pass); }); return valid.length === accounts.length; } :doctorPERFECT:
    – corsiKa
    Nov 19, 2017 at 15:55

7 Answers 7

78

No, it is not enough. Using the same password for both your email and your bank is a bad idea. If your email provider is compromised, that means the attacker will get access to your bank account, and vice versa. You don't want that.

Use one hard password per site. You won't be able to memorise all those, but don't worry. That's what password managers are for.

If you want this explained in a video featuring an animated octupus, the Electronic Frontier Foundation got you covered.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Nov 20, 2017 at 20:29
18

One password for bank and mail.

One medium password for games.

One for shady sites.

Don't reuse passwords!

This is very bad practice - if somebody finds out one of your passwords, they have access to many of your other accounts. This is especially bad when reusing passwords between email and bank accounts, as @Jeutnarg's comment shows.

Less than 10 characters is too low. Go for something higher, at least > 15.

Use a unique, strong password for each account and use a password manager such as Dashlane or LastPass so you never forget your passwords. Your master password for these password managers should be very strong; if that master password is discovered, all your passwords are known.

4
  • I can recommend LastPass, their free accounts are feature loaded and the mobile apps are great
    – Keith M
    Nov 17, 2017 at 23:24
  • 13
    Talking specifically about bank and mail, you should strongly avoid having a single password grant confirmation AND access. As in, some services (banks for one) send sanity check emails when they detect a logon from an unknown address or significant changes on accounts. If you use the same password for email and that service, you may be sacrificing this protection/notification.
    – Jeutnarg
    Nov 17, 2017 at 23:53
  • 6
    And while you are at it, you should enable two factor authentication on websites that support it especially if you reuse passwords. Nov 18, 2017 at 0:57
  • 6
    I would strongly advise against using the same password for email and bank accounts. Nov 19, 2017 at 21:50
8

Zero is the right number of passwords. Ideally the authentication system will simply know your identity without any active proof from your side to derive an access token. (In computation theory this hypothetical kind of system is called an oracle.)

Unfortunately, nobody came up with such an authentication method yet, so we take the next best number of passwords: one. You use a single password to unlock all your access tokens which are often but not necessarily passwords (think of key files for example). Now, in general you don't want to use the same access token for all authentication systems in case one of them is stolen and abused to impersonate you in the eyes of other systems. That's why you generate a different access token (e. g. a password) for each independent authentication system.

The system that manages and unlocks other access tokens based on your one single password is called a key chain with the popular special case of a password store which is a key chain for a single type of access tokens, passwords. There are a few good password store applications that you can set up and use. See the other answers for some examples.

5

As other answers have pointed out, reusing passwords is bad, as any account that uses a reused password may be compromised.

That being said, it may be acceptable for you do reuse passwords for certain services. Specifically, it may be fine to reused passwords for shady sites or throwaway accounts which you do not care about at all, as long as you are aware that they will be compromised.

For a secure setup, you would need to remember at least the following passwords:

  • System Password: The password for your local root user.
  • Password Manager: The password for your password manager. This can then take care of any passwords you use for web services.
  • Encryption Password: The password that is used to encrypt your disk (this should definitely not be the same as the system or password manager password).

Ideally, that is all you need. Practically, you might want to access services on other computers, and you might not want to trust those computers to handle a USB drive containing your password manager data or with the password for your web-based password manager.

This is where you have to personally weight usability vs security.

Do you need to access your email from untrusted computers? And if so, is your email linked to important accounts (in which case accessing your email account is likely equivalent to accessing those important accounts)? If so, you might need an additional password you need to remember for your email account (and you might want to create a second email account to separate concerns).

If you need to access games from untrusted computers, you might also want a separate password for that. Depending on how important these accounts are to you, the password needs to be more or less complex.

The same holds for any other password you might need to enter into an untrusted computer where you do not have the chance to use a password manager securely. You can try to classify these accounts according to criticality and if necessary reuse passwords for accounts where you do not mind a compromise of the account too much.

2
  • I haven't used password managers but should it not be possible to export just a specific password? So you could copy just the password manager data files for the passwords that you need to use elsewhere to your USB drive, and leave the other ones at home? Nov 18, 2017 at 17:59
  • @MichealJohnson yes, you could export some passwords into a smaller keyring.
    – Ángel
    Nov 19, 2017 at 23:43
3

Sharing passwords works, until a site is compromised or until you're being successfully phished. At that point, you're in trouble.

The attacker now knows your username which you will likely use on another site as well and (a salted hash of? hopefully!?) your password. With any luck, they manage to figure out the actual password from the hash, now you are really in trouble, since that same password works on many sites. In any case, even if they are not successful at finding another site where you used it, the password will go into their dictionary of known-to-exist passwords. If nothing else, it makes the brute force search a little less brute force next time.
In the case of having been phished successfully, you haven't put one account at stake, but many.

Writing passwords on paper is bad (though I admit I've done that for some decades), memorizing them is safer but doesn't really work that well. Heck, I even regularly forget the 4-digit PIN on my bank card because I only need it once per year. Go figure how well you can remember a reasonably random 12-character string.

As long as a computer is involved, it does not really cost you anything to do things properly. For example KeePass together with the Kee web extension (works on several high-profile browsers) will generate -- and remember -- sufficiently strong passwords for every individual site. And, within a browser, this combination is a "just works" setup. Never worry again, never waste a thought on that problem again. It works for other (non-browser) programs too, only just slightly less comfortable (copy-paste, no auto-fill).

The generated passwords are of much better quality than any password you might generate yourself or that you might successfully remember. So, not only does this solve the sharing problem, it also makes brute forcing your password unfeasible. Unless of course, a particular site's CIO is a complete idiot such as is the case with e.g. my health insurance's (Axa) portal. While they insist on postal identification for super extra security, they reject a random 256-bit random password, insist on silly rules, and have a parser that still rejects some passwords which comply with their stupid rules. So you end up with, you guessed it, 50% of the users choosing Fuckyou!1. Which, you guessed correctly, complies with their stupid rules.

But alas, there are things you cannot change. You should, however, address the isseus that you can change.

2
  • 2
    Writing a password on a piece of paper isn't the worst thing you can do. I do it when I change a password I can't use a password manager for, until I've learned the new password. (Love forced regular password changes.) Of course I keep close tabs on the piece of paper. Picking a much simpler password just so you can remember it is probably worse.
    – user
    Nov 18, 2017 at 17:57
  • I know exactly where my sheet of paper is. 2000 miles away. Nov 19, 2017 at 0:22
-3

It's not about the number of passwords. I have a base password, something very hard to crack like "Y3DYFR34" which I simply memorize and a suffix which I add to the base. So my password for stackoverflow would be "Y3DYFR34_stackoverflow" and my password for email would be "Y3DYFR34_email".

  • Protects from password dumps
  • Easy to memorize
9
  • 7
    Please register on this free low-quality website Because I am really not going to try changing the suffix of the password you provide to "stackoverflow" and attempt to log into your account… (nor will any of the hundreds of websites where you register ever be compromised to steal the entered passwords, nor actually save the password in cleartext)
    – Ángel
    Nov 19, 2017 at 23:39
  • 2
    To clarify what Ángel wrote: this does not protect you from password dumps. It's a very bad idea. You get the worst of both worlds: someone who cracks one of your passwords cracks them all, yet you don't gain the convenience of being able to use the same password on different sites. Nov 20, 2017 at 0:27
  • If a password dump has one of your accounts using this password style (lets say the Stack Overflow one), there's nothing stopping someone from finding what you're doing and try the password everywhere, replacing the website name for each website.. If you really want to differentiate your reused passwords on different websites (seriously, don't reuse passwords), then at least find a unique abbreviation or synonym method and use that (eg. sover, eletters), but you shouldn't have to do that. Nov 20, 2017 at 11:38
  • 2
    "Y3DYFR34" is not hard to crack, my machine would do that in about 5mins.
    – Arlix
    Nov 20, 2017 at 11:56
  • @Ángel is the link actually a phishing page, or is it actually from Mozilla? Firefox blocks it, but some links inside it seem genuine
    – Ooker
    Nov 20, 2017 at 12:05
-4

If you are using the same password for all your sites, it could be compromised. You should use caps small, Alphanumeric and special characters too, and it must be greater than 15 digits.

You can create any types of combination for password.

1
  • 3
    I can see what you're getting at here, but it doesn't answer the question. The answer only really suggests guidelines for a good password, and it repeats what has already been explained in other answers. Nov 20, 2017 at 11:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.