2

I only memorized my e-mail's password. Every other passwords I use are stored on a password manager.

I used to hide a long random string in a fake e-mail in my inbox as my password manager's master password, but now I changed that to an excerpt of a real e-mail I have.

Do you see any serious flaws on that scheme?

2
  • Just an aside: make sure you have a backup of that password in case your email provider deletes the email for whatever reason, and it’s synchronously deleted from all of your devices.
    – Steve
    Jun 12, 2018 at 3:24
  • 2
    "Is it OK...?" - whatever "OK" to you exactly means. There is nothing known about your specific risk, i.e. what kind of attacker you have to face. There is nothing known who has access to your mails. There is nothing known if somebody knowing your scheme find it kind of obvious which mail to look at. There is nothing known if your password manager is save against brute forcing. It is not even known if the password manager is online or offline .... . In summary: the question cannot be answered since it is missing lots information. I propose to close it as too broad. Jun 12, 2018 at 3:57

2 Answers 2

1

Yes, there are a number of flaws with doing this:

  1. All of the mail admins have access to your mail file and therefore can read this email.

  2. Chances are the mail file is not encrypted at rest, which means potentially sysadmins have access to it.

  3. If DLP tools are run against your mail file they will likely pick this up and store it in their database.

  4. Not sure if you have an offline copy of your mail file on say your hard drive and if you do, those with access to your local drive, would have access to it.

Best option would be to combine multiple passwords that you have memorized for your master password and use that.

0

Let us assume that someone (such as a sysadmin) can possibly have read access to your emails. However, they are still missing this information:

  • they do not know which email it is
  • they do not know how much of it is to be used as a password (you say you are using only an excerpt of it as password)
  • they do not know the very fact that it is to be used as a password somewhere
  • they do not know where can the excerpt of this email be used as a password.

An attacker would need to know all of this to break in. As long as these pieces of information stay with you and only you, the system is "OK" (your original question).

A drawback is that if they do know all of these pieces of information and are able to break in, all of your passwords are compromised.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .