2

I've recently started using a password manager (1Password). I have a really good master password (using diceware) but I'm worried that if I forget it then I can't access 1P and all my passwords.

One solution is just to write it down on a piece of paper (they suggest I do this), but I don't have a safe and live in shared accommodation. Ideally I would really like to store the password online, so I can recover it no matter what (fire, lost phone, etc.), but if I want to encrypt it then I'm back to square one as I then need to remember that password.

So is there any way to store a master password online, encrypted, without having to remember another password?

migrated from crypto.stackexchange.com Aug 11 at 11:24

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • It might be better to edit your question and ask how encryption could be used to securely store a password (given certain circumstances). We want to make sure that the question is suitable for this website. – Patriot Aug 8 at 11:15
  • 1
    Thanks for the feedback. I've updated the question a little. Hopefully I've interpreted you correctly! – HackSaw Aug 8 at 11:41
  • 1
    Well, to encrypt something you need a secret of some sort. So the alternative probably would be to use biometrics or some form of hardware where ownership authorizes access. – SEJPM Aug 8 at 12:25
  • 2
    Not a cryptographic answer, but consider a safe deposit box in a bank. – Luis Casillas Aug 8 at 20:09
  • 1
    Joke answer: Duct tape the paper to your body to make it harder to steal while sleeping. Non-joke answer: Be aware that biometrics still have risks that memorized passwords don't have in shared living spaces. – Future Security Aug 8 at 20:23
0

Since you don't have a safe, I think it's fair to assume that you are not a likely candidate for a seasoned cyber criminal to need/want to come to your home to try to steal your paper password. Paper is pretty darn secure compared to anything digital, not just because you need physical access to take it, but because the cryptographic knowledge of a person taking your paper password tends to be a lot less sophisticated than a foreign hacker who's spent 10 year studding how to break encryption. Your typical threat actors for a written down password are friends, family members, and opportunistic burglars.

Knowing this, there are many methods for writing a password that a person who is not an expert would be completely foiled by. A few examples include.

Method 1: Salting

Many of us have an old favorite password we've used for way too long that we will never forget. Let's say this password is "Mango56". This is way too short and lacks enough entropy to make a good password, but you could salt it with some random text so that it is "Mango56dGkeb%7Z4". Then what you write down is "...dGkeb%7Z4". You know the 1st half; so, you don't need to write it down, and the second half is useless without what is already in your brain.

Method 2: Appropriation

Your house is full of long strings of letters and numbers that go overlooked every day. Barcodes, Serial numbers, etc. A person can search your house all they want, but if your password is the serial number on the battery of an old Nokia phone in your junk drawer, then the likelihood of them even considering that as important information if they find it is slim to none.

Method 3: Hand Cyphers

Straddling Checkerboards and Scytales will never stand up to a computerized decryption program, but they are effective enough to beat your average human being. Especially when the output looks like random gibberish anyway.

2

How can I encrypt a password for storage without having to remember another password?

You cannot. But you can reduce the risk associated with the loss of this "master password".

Here are my private and professional method (which I wouldn't sell as perfect).

As the person in charge of some confidential information, I have to deal with the case I would die before being able to transmit everything to the next person in charge. Therefore, I made a printed copy of the master password of my software safe.

For my private use, this printed copy is in a closed envelope with the name of my wife on it as the unique person allowed to open it in this case.

For my professional use, this printed copy is in a closed envelope with the name of the persons allowed to open it in this case. This envelope is stored in my physical safe with a fully mechanical lock.

Concerning the choice of this master password, I printed a list of a few of them generated with a validated password generator, and then tested them on a validated OS without looking at the screen (cat >/dev/null) to validate my memory error rate to select the best one.

  • yeah Password Book of Death is the way to go. if you want to keep your PBOD in a Google Doc then store a copy of the gsuite account backup codes in a secure secret place, obfuscated so you can get back in when you forget your password. – Unicorn Tears Aug 11 at 13:55
  • What do you have in mind when you say ‘obfuscated’? – HackSaw Aug 11 at 19:39
  • @Patrick Mevzek: thank you :). – dan Aug 13 at 15:21
  • @HackSaw: the method to obfuscate was obfuscated… too hard :). – dan Aug 19 at 11:40
0

maybe I'm paranoid, but I keep and suggest you keep the password only in your head, since you can’t be 100% sure that important data is stored on the Internet. I propose my own method, maybe it will help you: take any password generator and make a list of new passwords, then type each or any password you like on the keyboard, if you feel any discomfort while typing, take the next one and so on until you find one that you like it and it’s convenient and convenient for you to type it. Actually, you have found your password, which is good and safe and easy and convenient to type, repeating it each for some time, you will remember it physically, that is, your fingers will themselves stretch to the next character themselves, so even if you forget it, your fingers help you remember him. You can also combine multiple passwords into one large one. I hope I understood clearly.

  • I was able to remember my password even after a severe accident with a large animal in a car. fingers remember everything if you want to remember it. – vbujym Aug 8 at 18:58
  • Thanks vbujym. I agree the best solution is to store it in my head only but I really would like some backup method. So far nobody has suggested a way of storing it encrypted without having to remember another password but I guess that is really impossible. Perhaps the only solution is to write it down (maybe without making it obvious what its for) and then storing in a safe place. – HackSaw Aug 9 at 12:41
  • Sorry I meant aside from biometrics of course – HackSaw Aug 9 at 12:50
  • it is possible to store a sealed envelope with information on how to get a password in a secure cell in a bank or something like this, for example, as a few words that are hashed by some algorithm. Suppose I died, but opening my letter, my family will find there a list of questions that only they most likely will know and having made the answers, for example, in one line without spaces, perform a crc hash (sha (answers ...)) to receive a password using Base64. Reminded me a bit of how cryptex were in movies like "da Vinci code" or whatever they were called. – vbujym Aug 9 at 17:13
0

I would get a YubiKey and store the master password on it. I would have an easier password to remember and set that on the YubiKey. It would be much harder for someone to steal your YubiKey and know your easier password. This way you can change your easier more memorizable password on the YubiKey less often. This obviously has only one advantage in the sense that you can memorize your password and also need a physical device be stolen.

This can also work on a bitlocked USB drive. Bitlocker is available with Windows by default. This option is also putting an easier password that you never use anywhere else to unlock the USB drive that has a plaintext file with your master password.

I find it easier to use an easier password than memorize the complex ones. Paper just requires anyone to take a look, obviously. If one of your room mates takes your USB device he would also have to know the easier password as well and take the device for a prolonged period to guess your easier password, which you would notice. Also do not use that password for anything else. One way or another yes you need a password but this is the best compromise between paper and losing a password.

BTW the YubiKey has a static password storage slot for anyone not familiar with that.

  • 1
    Isn't Bitlocker only available on pro, enterprise and education versions of Windows only? – Unicorn Tears Aug 11 at 13:42
  • If the YubiKey was stolen or lost, then wouldn’t I have a problem? Your idea effectively makes the YubiKey the new master password (if I have understood you correctly). Losing it means I lose access to my password manager. – HackSaw Aug 11 at 19:30
  • Don't forget this is way better than paper and see my answer for a more cost effective and safer solution. – samman Aug 12 at 16:51
  • @UnicornTears: yes Bitlocker is only available on Windows (and moreover only on pro & enterprise versions) and was ill conceived ( ex.: securityweek.com/… and an history of conception failures ). – dan Aug 17 at 8:00
  • @dan the article is from 2015. There have been many improvements including AES-XTS. I don't believe there are any security issues that I am aware of. – samman Aug 18 at 16:57
0

I would store the master password on two or three bitlocked USB drives with a password that is easier to remember, but unique and long enough to withstand brute force attacks. Give two of them to a friend or family member that doesn't live with you. They would not have access due to the simpler password. Then you can gain access to their drives in the event you lost yours. Again, I would never use this password elsewhere. I personally would never change this password and never use it unless I needed to recover the master. You can change your master password as often as you would like and not be concerned with memorizing or writing down your password.

This should take no more than 5 min. Just right click on each USB drive in explorer and go to Bitlocker. It is very simple and uses AES encryption.

What I like most about this technique is you feel safe not to write down or lose anything. If you are super paranoid about losing your drives just add more. They are cheap for 1 gb or even 256 MB drives you can even have two extra for yourself.

  • Beware, this solution works only on Windows, and a very strong hypothesis is "this Windows should be clean", your family or friend one should be clean too. – dan Aug 19 at 11:55
0

So is there any way to store a master password online, encrypted, without having to remember another password?

I don't think that is possible.

However, if I were in your situation, I would choose what I will call a "pass sentence" that is easy for you to remember, rather than a diceware password.

In theory, that has less entropy than a diceware password. After all, someone who knows you as well as you know yourself, will almost certainly be able to guess it. So you need to pick something from long ago in your life for best safety. And of course you must protect yourself from shoulder-surfing (always a good idea anyway).

An example, loosely paraphrased from something similar I often use, is "When I was 12, I drove a car into a tree." (yes, including the comma and the period at the end). I also had a mnemonic on paper: "W* 99, I d*." which reminded me that the first word was capitalised, there was a comma after 2 digits, and a period at the end, because in the long run those are the things you will forget. (The "d" is there because I once found myself remembering it as "I ran a car into a tree" and sweated bricks until I calmed the hell down and remembered it was drove not ran!)

Needless to say the above example is not what I actually use, but it illustrates what I want to say reasonably well.

You'll find a lot of password examples that advocate something like this, but shortened to first letters of each word. Resist the temptation to do that. Size does matter :-)

-1

I know a team based in Luxembourg who are developing something called password pledging - www.passwordpledge.com

It is a web-based service that allows you to store critical passwords with them, which in an emergency (death, serious illness etc.) they could pass onto your next of kin, colleagues etc. I can see how that is a useful service - they gave me the example of the Quadriga CEO who died leaving his wife without access to his laptop, on which he stored the passwords for millions of dollars worth of bitcoins.

I haven’t seen a product like this before, so don’t think there is anything that you can use today, but maybe others know of something similar.

I would imagine this could also be used to allow self-recovery of forgotten passwords for 1Password, LastPass etc. although I’m not sure if they will target that use-case.

According to their landing page (www.passwordpledge.com), that they have some way of encrypting the data so they can’t access it but you and/or your next of kin can decrypt it without needing a password. That seems to fit with what you are looking for but unfortunately they don’t say how they will actually do this. It could be biometrics or they have come up with some other clever way of doing it.

  • That could work although I suppose it would be a paid service. I would be interested to know if any members know of a similar service that is already live today and ideally free! Surely this type of thing already exits. – HackSaw Aug 11 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.