1

I have lurked for a time on security websites and similar. I came to wonder, with the number of passwords we have (or websites that need a password) how to manage this.

Since I have well over 400 sites where a password is used, how can I keep track of all the passwords and avoid reuse?

I have a password manager but still have passwords that are used way too many times. Is the best solution to just make 400 different passwords and let the password manager deal with the issue and look them up every time I want to login?

Or is reusing for minor accounts the best alternative in terms of usability?

  • 2
    I think you missed something in all those sites you've read and the password managers you use. The idea is for the password manager to randomly generate the passwords for you. – schroeder Mar 27 at 10:30
  • 1
    @schroeder because working on different phones / computers makes it harder and syncing between all of them is probably even worse – Basho Mar 27 at 10:42
  • 3
    Ok, then we are narrowing in on what you're trying to ask. It's not that you have 400 sites, but that you need to be able to manage passwords across multiple devices. What do you mean by "syncing between all of them is probably even worse" – schroeder Mar 27 at 10:46
  • 1
    @schroeder it's more about having multiple websites / apps but on different machines. If I go to login on a friend's computer I don't have the password manager there. – Basho Mar 27 at 10:50
  • 1
    Whoa, logging into your sites while on someone else's machine is a massively risky thing to do! And if you are using a re-used password, your risks skyrocket. – schroeder Mar 27 at 10:53
1

The short answer is yes, let the password manager handle it.

You should have your password manager generate a unique password for each site. Don't make them yourself and you won't have to worry about reuse. For sites you currently reuse on, incrementally replace them as you come across them. Many have tools to identify password reuse which can also help you.

Based on your comments, you seem hesitant to commit to all random passwords because you use several different devices. Many password managers offer syncing solutions that work very well. Both Android and iOS support filling in login forms with password manager apps. If manual entry is a sticking point, consider generating passphrases, which are easier to remember momentarily.

6

Yes - let your password manager handle all of them.

400 sites is not a lot to have in your password manager - I have many more than that. Most I generated randomly. Some I created on other systems and then transferred them in. But most importantly, I don't worry what they are, because my password manager handles them.

Before I used a password manager, I tried patterns, but they are relatively easily guessed once a couple end up leaked and brute-forced, and yes, I have had the haveIbeenpwned alerts on occasion and had to change things. Trust me, doing that is much worse if you have used any pattern, as you have to change them all!!!

  • Thanks I guess it's hard to let go and not remember your own passwords as I did for my whole life but it's probably for the best! – Basho Mar 28 at 8:25
-1

400 sites are a lot, I do not use that much, but I just let pw manager deal with passwords.

However I have some sites that I use frequently and don't want to login everytime in the password manager. For those sites I use a simple method to create easily remember passwords.

It is actually two methods. I create a whole sentence and the first word usually the name of the site, a funny sentence coming from the function of the site or the title of the site. A whole sentence including some numbers or signs no way to crack, except brute force.

The other method is take a poet and the first letter of every word in a verse gives you a nice hash looking-like password. you can tune it up with numbers or signs.

  • "crack" and "brute force" are the same thing – schroeder Mar 27 at 12:37
  • and what you suggest is nothing like a hash – schroeder Mar 27 at 12:37
  • The problem with this method is remembering the elements of the pattern when you need to change the password – schroeder Mar 27 at 12:38
  • true, what you get is just looks like a hash. will correct. nobody said bruteforce is not cracking, what I said is brute force is the only method to crack it. if you have to change the pass, you can create another sentence or get another poet there are a bunch of them. – user8745622 Mar 27 at 13:35
  • "impossible to crack, except brute force" suggests that those are two different things. But they are the same thing. It's like saying "it's impossible to jump over, except if you leap very far". I think you meant to say that it is very difficult to brute force. – schroeder Mar 27 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.