How many passwords is good for security? [closed]

Question

So I'm wondering how many passwords is enough to have my data safe because right now I have 1 hard password for bank & mail (>10 characters + numbers etc.) and 1 medium password for games and 1 for shady sites. I keep all them memorized and not on paper/in a document. Is this enough?

Answer 1

No, it is not enough. Using the same password for both your email and your bank is a bad idea. If your email provider is compromised, that means the attacker will get access to your bank account, and vice versa. You don't want that.

Use one hard password per site. You won't be able to memorise all those, but don't worry. That's what password managers are for.

If you want this explained in a video featuring an animated octupus, the Electronic Frontier Foundation got you covered.

Answer 2

One password for bank and mail.

One medium password for games.

One for shady sites.

Don't reuse passwords!

This is very bad practice - if somebody finds out one of your passwords, they have access to many of your other accounts. This is especially bad when reusing passwords between email and bank accounts, as @Jeutnarg's comment shows.

Less than 10 characters is too low. Go for something higher, at least > 15.

Use a unique, strong password for each account and use a password manager such as Dashlane or LastPass so you never forget your passwords. Your master password for these password managers should be very strong; if that master password is discovered, all your passwords are known.

Answer 3

Zero is the right number of passwords. Ideally the authentication system will simply know your identity without any active proof from your side to derive an access token. (In computation theory this hypothetical kind of system is called an oracle.)

Unfortunately, nobody came up with such an authentication method yet, so we take the next best number of passwords: one. You use a single password to unlock all your access tokens which are often but not necessarily passwords (think of key files for example). Now, in general you don't want to use the same access token for all authentication systems in case one of them is stolen and abused to impersonate you in the eyes of other systems. That's why you generate a different access token (e. g. a password) for each independent authentication system.

The system that manages and unlocks other access tokens based on your one single password is called a key chain with the popular special case of a password store which is a key chain for a single type of access tokens, passwords. There are a few good password store applications that you can set up and use. See the other answers for some examples.

Answer 4

As other answers have pointed out, reusing passwords is bad, as any account that uses a reused password may be compromised.

That being said, it may be acceptable for you do reuse passwords for certain services. Specifically, it may be fine to reused passwords for shady sites or throwaway accounts which you do not care about at all, as long as you are aware that they will be compromised.

For a secure setup, you would need to remember at least the following passwords:

• System Password: The password for your local root user.
• Password Manager: The password for your password manager. This can then take care of any passwords you use for web services.
• Encryption Password: The password that is used to encrypt your disk (this should definitely not be the same as the system or password manager password).

Ideally, that is all you need. Practically, you might want to access services on other computers, and you might not want to trust those computers to handle a USB drive containing your password manager data or with the password for your web-based password manager.

This is where you have to personally weight usability vs security.

Do you need to access your email from untrusted computers? And if so, is your email linked to important accounts (in which case accessing your email account is likely equivalent to accessing those important accounts)? If so, you might need an additional password you need to remember for your email account (and you might want to create a second email account to separate concerns).

If you need to access games from untrusted computers, you might also want a separate password for that. Depending on how important these accounts are to you, the password needs to be more or less complex.

The same holds for any other password you might need to enter into an untrusted computer where you do not have the chance to use a password manager securely. You can try to classify these accounts according to criticality and if necessary reuse passwords for accounts where you do not mind a compromise of the account too much.

Answer 5

Sharing passwords works, until a site is compromised or until you're being successfully phished. At that point, you're in trouble.

The attacker now knows your username which you will likely use on another site as well and (a salted hash of? hopefully!?) your password. With any luck, they manage to figure out the actual password from the hash, now you are really in trouble, since that same password works on many sites. In any case, even if they are not successful at finding another site where you used it, the password will go into their dictionary of known-to-exist passwords. If nothing else, it makes the brute force search a little less brute force next time.
In the case of having been phished successfully, you haven't put one account at stake, but many.

Writing passwords on paper is bad (though I admit I've done that for some decades), memorizing them is safer but doesn't really work that well. Heck, I even regularly forget the 4-digit PIN on my bank card because I only need it once per year. Go figure how well you can remember a reasonably random 12-character string.

As long as a computer is involved, it does not really cost you anything to do things properly. For example KeePass together with the Kee web extension (works on several high-profile browsers) will generate -- and remember -- sufficiently strong passwords for every individual site. And, within a browser, this combination is a "just works" setup. Never worry again, never waste a thought on that problem again. It works for other (non-browser) programs too, only just slightly less comfortable (copy-paste, no auto-fill).

The generated passwords are of much better quality than any password you might generate yourself or that you might successfully remember. So, not only does this solve the sharing problem, it also makes brute forcing your password unfeasible. Unless of course, a particular site's CIO is a complete idiot such as is the case with e.g. my health insurance's (Axa) portal. While they insist on postal identification for super extra security, they reject a random 256-bit random password, insist on silly rules, and have a parser that still rejects some passwords which comply with their stupid rules. So you end up with, you guessed it, 50% of the users choosing Fuckyou!1. Which, you guessed correctly, complies with their stupid rules.

But alas, there are things you cannot change. You should, however, address the isseus that you can change.

Answer 6

If you are using the same password for all your sites, it could be compromised. You should use caps small, Alphanumeric and special characters too, and it must be greater than 15 digits.

You can create any types of combination for password.

Answer 7

It's not about the number of passwords. I have a base password, something very hard to crack like "Y3DYFR34" which I simply memorize and a suffix which I add to the base. So my password for stackoverflow would be "Y3DYFR34_stackoverflow" and my password for email would be "Y3DYFR34_email".

• Protects from password dumps
• Easy to memorize