What is ideal way to store passwords?

Question

I am wondering what I should do with my passwords.

I have divided the accounts by importance into two groups:

a) the first one which are accounts like this one I am writing from. I have set them to write some post in forums. Basically, I do not care about them. Each is different. Where I could close the account I did, but I am using some of such accounts in order to use functionality I need, for example be accessible in a forum. I store them in one file which is encrypted on my external disk, actually I have two such disks, in two cities encrypted by VeraCrypt. I think this is sufficient since I can't remember such a passwords etc.

b) the other set is more important, I would not mention what kind of accounts they are, but they are important for me. Recently I have changed all passwords for good ones, consisting of a sufficient number of characters and different types of them. Each account has a different password to prevent reuse one of my password in a different account. Actually, I did memorize them, but I am worried that one day I can just forget one of the passwords since some of them are not used often.

So, where can I store them?

1) I do not want to store them digitally, since I am not sure if I do not have exploit which can just steal the file I am storing them. Actually VeraCrypt documentation told me that an encrypted volume/container is encrypted in disk all the time and it is decrypted into memory each time. But what is the problem to do exploit which is dumping memory some time or triggered by some website opened? I could do that.

2) I do not want to use a password manager since I do not trust them. Ok, I can find one open source project and do my own investigation. But the problem I am scared of is that if one password would be compromised, for example by keylogger + exploit stealing the password manager file and I am out of the business.

3) The best way to store them is physically on paper since I trust my environment the most. But this is also not a good case theoretically. I do not have a safe.

So what do you recommend? What is the ideal model to store passwords? Where do you store them? I mean about a serious password, so b) group of my listing. The a) group are stored in encrypted files on an external disk and this is equally like I would store them in a password manager. I mean 1 password cracked = all passwords available. However, I am plugging this disk rarely so I guess even it is a bit safer than a password manager.

Answer 1

Best way to store ‘em is to AVOID storing them anywhere at all other than your own memory. Too much dependence upon writing, electronics, etc. has rendered our under developed memory nearly useless.

Case in point: I lost my cellphone last year and grew rather humble when I realized that I could not contact anyone over the phone — not even my own mother. Yet as a kid, I had over 15 phone numbers memorized.

If you must store the secret stuff external to your own brain, then I recommend rendering such content unrecognizable. For example, I keep a penciled list of important contacts. Anyone looking at the list assumes that it is a meaningless doodle of 2 dimensional, geometric shapes. None has guessed that each shape encodes a number, determined by the number of angular changes. I.e. a triangle is 3, yet so is the letter M. 2 might be the letter N, an X or something like an L.

F.

Answer 2

The comments have a good point regarding endpoint security of your threat model:

If you do not trust your endpoint to store the data, you shouldn’t trust it enough to input your data from a piece of paper.

Not trusting password managers is strange as well - did you do a full analysis yourself on veracrypt, which you seem to have trust in?

I‘m not advocating for dumping encryption technology at large, but a password manager is probably the easier-to-review code base when trust issues go that far.

Other than that, here are my tips for keeping good passwords - and you should do that regardless of the grouping you did (as it is only little overhead for not-as-important passwords)

• Use a password manager that you trust.
• Use a machine you trust.
• Use a multi-factor authentication where possible (i.e. a U2F-token like a yubikey or at least a software based Token generator).
• Do not reuse passwords.

There is another problem your threat model is not addressing which is availability: loosing those passwords will probably be bad. Thus, it is a good idea to keep the database you created on a second device. For example, you could export it with a PGP key encryption on a thumb drive you carry with you at all times and keep the key for that on a yubikey in a bank safe.

This way, you should be able to recover the keys and you can create new backups without needing access to the yubikey.

Answer 3

As others have pointed out, the error in your logic is wanting to consider the security of password usage and storage on a compromised machine. Nothing is safe on a compromised machine, not even typing passwords from a paper notebook. You have to be aware that whenever you're using a password (typing it in, letting it filled in by software such as a key ring or a password manager), that password will be somewhere in the clear on your machine. For instance, the clip board is often available to many processes ; if there is compromised RAM access, there's no way to avoid the possibility of your password being stolen.

If you want to go to great lengths of protecting passwords (but with the caveat above), you could use Tails. You need 5 USB sticks: one with Tails installed on it, and 4 USB sticks that will serve as your key vault and backup. 1) use a machine with no internet connection, and boot on Tails with a USB stick 2) use the integrated KeePassX application to set up your encrypted database on a second USB stick 3) for added security, you could also generate a key and store it on another USB stick. 4) you should make a backup on yet a 4th and a 5th stick of respectively the passwords database and its associated key 5) you should be sure to remember the sole password that unlocks the Keepass database

When you shut down the Tails system, everything is forgotten apart from what's on the 4 sticks. In order to use your passwords, you will need a secure machine that has Keepass on it (for instance, Tails), and two USB sticks: one with the Keepass database, and another one with the key of the database. You'll also need your password of the database.

That's a lot of hassle, but for high-stakes passwords/keys, it might be worth the effort. Of course, if ever you put your stick in a compromised machine, or you type the passwords on a compromised machine, as others said, all this becomes moot.

It is a relatively secure way to keep, for instance, seeds of crypto currency wallets, but it is a lot of hassle.

Answer 4

Whilst memorizing important strong passwords is indeed risky because they are easy to forget, it is much easier and safer to memorize an operation on a string e.g. "trim 2 characters from each end", "swap the first and the last character", "just repeat the string twice" etc.

So, basically, you:

1. Come up with a string operation and keep it in your mind only;
2. Use encrypted files, password managers, pieces of paper and whatnot to keep your raw passwords which are strings that will yield the real passwords when your operation is applied to them.

Your raw passwords will be no use for anybody without knowing that they need to be transformed and how to transform them.

Answer 5

I’ll offer a suggestion, though I am new to this forum, so be gentle….

Now, no decision is without risk. The ultimate direction you choose to go in is simply an expression of your risk tolerance.

Myself, I’ve had the my last 3 income taxes filed for me before the IRS caught on that my identity had been stolen. At that time I too became concerned about what else had been accessed and decided to change my passwords. Similar to an earlier post, I went with a rule based method. An illustration follows:

• Cap 1st letter to represent the 1st letter of the domain of the site (C = .com, E= .edu, O = .org) etc
• The 1st two letters of my lastname (i.e.Sm - assuming my name is Smith)
• My year of birth (1885)
• 1st three of my month of birth (Jun)
• A special character (‘*’)
• First 4 letter of the website name.

So for Stack Exchange it would be

CSm1885Jun*secu

Now, the risk I have accepted is that if someone has hacked enough accounts and have enough ID’s and passwords, then they may be able to understand the formula. My belief (however unsupportable) is that the password is complex enough to not be found in rainbow tables and would need enough work that the person stealing the encrypted password list would simply move on to an easier target.

So far I have not had anyone breach an online account……

• RkRider