0

I am wondering what I should do with my passwords.

I have divided the accounts by importance into two groups:

a) the first one which are accounts like this one I am writing from. I have set them to write some post in forums. Basically, I do not care about them. Each is different. Where I could close the account I did, but I am using some of such accounts in order to use functionality I need, for example be accessible in a forum. I store them in one file which is encrypted on my external disk, actually I have two such disks, in two cities encrypted by VeraCrypt. I think this is sufficient since I can't remember such a passwords etc.

b) the other set is more important, I would not mention what kind of accounts they are, but they are important for me. Recently I have changed all passwords for good ones, consisting of a sufficient number of characters and different types of them. Each account has a different password to prevent reuse one of my password in a different account. Actually, I did memorize them, but I am worried that one day I can just forget one of the passwords since some of them are not used often.

So, where can I store them?

1) I do not want to store them digitally, since I am not sure if I do not have exploit which can just steal the file I am storing them. Actually VeraCrypt documentation told me that an encrypted volume/container is encrypted in disk all the time and it is decrypted into memory each time. But what is the problem to do exploit which is dumping memory some time or triggered by some website opened? I could do that.

2) I do not want to use a password manager since I do not trust them. Ok, I can find one open source project and do my own investigation. But the problem I am scared of is that if one password would be compromised, for example by keylogger + exploit stealing the password manager file and I am out of the business.

3) The best way to store them is physically on paper since I trust my environment the most. But this is also not a good case theoretically. I do not have a safe.

So what do you recommend? What is the ideal model to store passwords? Where do you store them? I mean about a serious password, so b) group of my listing. The a) group are stored in encrypted files on an external disk and this is equally like I would store them in a password manager. I mean 1 password cracked = all passwords available. However, I am plugging this disk rarely so I guess even it is a bit safer than a password manager.

  • 3
    Easy, use 2FA to make sure that password compromises are ineffective. – schroeder Dec 2 '17 at 20:36
  • 2
    It looks like you have a set of requirements, and you have decided on the best approach. Why not just get a fireproof safe? They are not expensive. – schroeder Dec 2 '17 at 20:39
  • 8
    While I do not disagree with your threat model, you have an error in it. If you do not trust the memory of your computer and therefore do not want to store your passwords digitally, then how are you entering the passwords to gain access to these accounts? As soon as you type it in, anyone who had that level of access to your memory also has access to what you enter on a web page. It's a "chain is as strong as the weakest link" scenario. – schroeder Dec 2 '17 at 20:44
  • Thank you, great answer. Good point. I would precise. 2FA is an option but not everywhere can but turned on. Fireproof is what I would consider. I believe I have safe machine to work with, but assuming the most sceptic model I do not trust myself 100 % and always see possibility that there could be a way I got hacked. That is why I am considering the most I can do the least would affect me if something happen one day. Agree that if RAM got compromised even my VeraCrypt would not help me. THANK YOU ! – jan kowalski Dec 3 '17 at 21:05
-1

Best way to store ‘em is to AVOID storing them anywhere at all other than your own memory. Too much dependence upon writing, electronics, etc. has rendered our under developed memory nearly useless.

Case in point: I lost my cellphone last year and grew rather humble when I realized that I could not contact anyone over the phone — not even my own mother. Yet as a kid, I had over 15 phone numbers memorized.

If you must store the secret stuff external to your own brain, then I recommend rendering such content unrecognizable. For example, I keep a penciled list of important contacts. Anyone looking at the list assumes that it is a meaningless doodle of 2 dimensional, geometric shapes. None has guessed that each shape encodes a number, determined by the number of angular changes. I.e. a triangle is 3, yet so is the letter M. 2 might be the letter N, an X or something like an L.

F.

  • Well, for now I remember all of those passwords. It is around ten different passwords. But I can't be sure that I would do for long time. That is why I decided that I must to have one secret copy of this. I do not log often to some of those services and lost of this password can be hard for me. Recovery or change password would be hard. – jan kowalski Dec 3 '17 at 21:06
  • Interesting observation indeed about memory. I think the reason is that as an adult we have lot more things on our head, job, hobby, family, and our mind is overwhalmed by those, so we just do not have free memory or energy to memorize such a simple things like phone numbers. Or as you said we get more comfortable, and comfort is surely not a friend of improvement :) Thank you for the answer. This piece about angulars is even more brilliant I would consider to implement this together with Greendrake suggestion. – jan kowalski Dec 3 '17 at 21:06
4

The comments have a good point regarding endpoint security of your threat model:

If you do not trust your endpoint to store the data, you shouldn’t trust it enough to input your data from a piece of paper.

Not trusting password managers is strange as well - did you do a full analysis yourself on veracrypt, which you seem to have trust in?

I‘m not advocating for dumping encryption technology at large, but a password manager is probably the easier-to-review code base when trust issues go that far.

Other than that, here are my tips for keeping good passwords - and you should do that regardless of the grouping you did (as it is only little overhead for not-as-important passwords)

  • Use a password manager that you trust.
  • Use a machine you trust.
  • Use a multi-factor authentication where possible (i.e. a U2F-token like a yubikey or at least a software based Token generator).
  • Do not reuse passwords.

There is another problem your threat model is not addressing which is availability: loosing those passwords will probably be bad. Thus, it is a good idea to keep the database you created on a second device. For example, you could export it with a PGP key encryption on a thumb drive you carry with you at all times and keep the key for that on a yubikey in a bank safe.

This way, you should be able to recover the keys and you can create new backups without needing access to the yubikey.

  • About password managers and trusting: Well I do not trust any application which is commerce, even if disassembly is possible. About VeraCrypt I trust this. I checked the whole documentation and some code (not all). I would not accept password manager since trusting is just a piece. I am scary that compromising one password (I dont think so, but you never know model) would leak all my passwords. Using different password each time and do not use password manager would allow to compromise just one my password if happen. That is why I would not accept password managers unless I would write my own. – jan kowalski Dec 3 '17 at 21:08
  • While I need to agree what you are writing, but also I need to explain further my mind. I believe I have safe machine to work with, but assuming the most sceptic model I do not trust myself 100 % and always see possibility that there could be a way I got hacked. That is why I am considering the most I can do the least would affect me if something happen one day. Agree that if RAM got compromised even my VeraCrypt would not help me. So looking realistic I have safe machine or soon would have. But I want to be ready for the worst, that is why I am overthinking each point twice. – jan kowalski Dec 3 '17 at 21:09
  • Thank you for idea with second device. I wrote in my post that I implement this. Just yubikey may be something I can consider to add. – jan kowalski Dec 3 '17 at 21:09
2

As others have pointed out, the error in your logic is wanting to consider the security of password usage and storage on a compromised machine. Nothing is safe on a compromised machine, not even typing passwords from a paper notebook. You have to be aware that whenever you're using a password (typing it in, letting it filled in by software such as a key ring or a password manager), that password will be somewhere in the clear on your machine. For instance, the clip board is often available to many processes ; if there is compromised RAM access, there's no way to avoid the possibility of your password being stolen.

If you want to go to great lengths of protecting passwords (but with the caveat above), you could use Tails. You need 5 USB sticks: one with Tails installed on it, and 4 USB sticks that will serve as your key vault and backup. 1) use a machine with no internet connection, and boot on Tails with a USB stick 2) use the integrated KeePassX application to set up your encrypted database on a second USB stick 3) for added security, you could also generate a key and store it on another USB stick. 4) you should make a backup on yet a 4th and a 5th stick of respectively the passwords database and its associated key 5) you should be sure to remember the sole password that unlocks the Keepass database

When you shut down the Tails system, everything is forgotten apart from what's on the 4 sticks. In order to use your passwords, you will need a secure machine that has Keepass on it (for instance, Tails), and two USB sticks: one with the Keepass database, and another one with the key of the database. You'll also need your password of the database.

That's a lot of hassle, but for high-stakes passwords/keys, it might be worth the effort. Of course, if ever you put your stick in a compromised machine, or you type the passwords on a compromised machine, as others said, all this becomes moot.

It is a relatively secure way to keep, for instance, seeds of crypto currency wallets, but it is a lot of hassle.

  • Hey :) I need to explain further. I believe I have safe machine to work with, but assuming the most sceptic model I do not trust myself 100 % and always see possibility that there could be a way I got hacked. That is why I am considering the most I can do the least would affect me if something happen one day. Agree that if RAM got compromised even my VeraCrypt would not help me. The information I admire is your scenario with usb sticks. Demanding but interesting. If I have time I like hassle. Would think about this later. Thank you for an idea. – jan kowalski Dec 3 '17 at 21:06
1

Whilst memorizing important strong passwords is indeed risky because they are easy to forget, it is much easier and safer to memorize an operation on a string e.g. "trim 2 characters from each end", "swap the first and the last character", "just repeat the string twice" etc.

So, basically, you:

  1. Come up with a string operation and keep it in your mind only;
  2. Use encrypted files, password managers, pieces of paper and whatnot to keep your raw passwords which are strings that will yield the real passwords when your operation is applied to them.

Your raw passwords will be no use for anybody without knowing that they need to be transformed and how to transform them.

  • I like this answer the most ! It is not sophisticated, but indeed genius. Actually I invent my passwords with such an alogorithm performed on strings. But I do not know why I write down on the paper the passwords after operations and did not figure out to save just the version of password before them as operation I remember. I would implement this surely and stay with paper probably for now, maybe later move to electronical storage of strings before modifications. Thank you a lot for the hint and have a nice week ! – jan kowalski Dec 3 '17 at 21:05
  • Unfortunately, I cannot agree with such a technique. This is "security by obscurity", where the obscurity is a very naive "hash function" that a human brain can do, that is to say, almost nothing. It would give a false sense of security. Kerckhoff's principle ! If the essence of the security of your technique is the attacker not knowing your algorithm, you're not doing it right. – entrop-x Dec 4 '17 at 8:27
  • @entrop-x valid point in theory. In practice, the technique would only be used in addition to storing passwords the traditional way — as opposed to writing them on the walls. Would you argue that storing obscure passwords is less secure than storing plain ones? Every technique is good in certain era, so if/when attempting "naive human brain hash functions" on found passwords becomes standard for hacking software I will withdraw this answer :) – Greendrake Dec 4 '17 at 9:15
  • @Greendrake I agree with you that the technique 1) does no harm 2) can indeed be used to obfuscate somewhat a paper record of passwords... as long as you don't count on it for genuine security. It is a "paper and pencil" only form of cryptography. The danger of it resides in the false sense of security it might provide. If you use it to keep your passwords protected from the unsophisticated maid that might find the code book, why not. But that's about it. – entrop-x Dec 4 '17 at 10:26
0

I’ll offer a suggestion, though I am new to this forum, so be gentle….

Now, no decision is without risk. The ultimate direction you choose to go in is simply an expression of your risk tolerance.

Myself, I’ve had the my last 3 income taxes filed for me before the IRS caught on that my identity had been stolen. At that time I too became concerned about what else had been accessed and decided to change my passwords. Similar to an earlier post, I went with a rule based method. An illustration follows:

  • Cap 1st letter to represent the 1st letter of the domain of the site (C = .com, E= .edu, O = .org) etc
  • The 1st two letters of my lastname (i.e.Sm - assuming my name is Smith)
  • My year of birth (1885)
  • 1st three of my month of birth (Jun)
  • A special character (‘*’)
  • First 4 letter of the website name.

So for Stack Exchange it would be

CSm1885Jun*secu

Now, the risk I have accepted is that if someone has hacked enough accounts and have enough ID’s and passwords, then they may be able to understand the formula. My belief (however unsupportable) is that the password is complex enough to not be found in rainbow tables and would need enough work that the person stealing the encrypted password list would simply move on to an easier target.

So far I have not had anyone breach an online account……

  • RkRider
  • Your passwords are very poorly protected against social engineering methods. As an attacker will only need some basic knowledge about yourself and the method you use. There are better methods to choose easy to remember difficult to guess passwords (see xkcd.com/936) – Whysmerhill Dec 4 '17 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.