How can I encrypt a password for storage without having to remember another password?

Question

I've recently started using a password manager (1Password). I have a really good master password (using diceware) but I'm worried that if I forget it then I can't access 1P and all my passwords.

One solution is just to write it down on a piece of paper (they suggest I do this), but I don't have a safe and live in shared accommodation. Ideally I would really like to store the password online, so I can recover it no matter what (fire, lost phone, etc.), but if I want to encrypt it then I'm back to square one as I then need to remember that password.

So is there any way to store a master password online, encrypted, without having to remember another password?

Answer 1

Since you don't have a safe, I think it's fair to assume that you are not a likely candidate for a seasoned cyber criminal to need/want to come to your home to try to steal your paper password. Paper is pretty darn secure compared to anything digital, not just because you need physical access to take it, but because the cryptographic knowledge of a person taking your paper password tends to be a lot less sophisticated than a foreign hacker who's spent 10 year studding how to break encryption. Your typical threat actors for a written down password are friends, family members, and opportunistic burglars.

Knowing this, there are many methods for writing a password that a person who is not an expert would be completely foiled by. A few examples include.

Method 1: Salting

Many of us have an old favorite password we've used for way too long that we will never forget. Let's say this password is "Mango56". This is way too short and lacks enough entropy to make a good password, but you could salt it with some random text so that it is "Mango56dGkeb%7Z4". Then what you write down is "...dGkeb%7Z4". You know the 1st half; so, you don't need to write it down, and the second half is useless without what is already in your brain.

Method 2: Appropriation

Your house is full of long strings of letters and numbers that go overlooked every day. Barcodes, Serial numbers, etc. A person can search your house all they want, but if your password is the serial number on the battery of an old Nokia phone in your junk drawer, then the likelihood of them even considering that as important information if they find it is slim to none.

Method 3: Hand Cyphers

Straddling Checkerboards and Scytales will never stand up to a computerized decryption program, but they are effective enough to beat your average human being. Especially when the output looks like random gibberish anyway.

Answer 2

How can I encrypt a password for storage without having to remember another password?

You cannot. But you can reduce the risk associated with the loss of this "master password".

Here are my private and professional method (which I wouldn't sell as perfect).

As the person in charge of some confidential information, I have to deal with the case I would die before being able to transmit everything to the next person in charge. Therefore, I made a printed copy of the master password of my software safe.

For my private use, this printed copy is in a closed envelope with the name of my wife on it as the unique person allowed to open it in this case.

For my professional use, this printed copy is in a closed envelope with the name of the persons allowed to open it in this case. This envelope is stored in my physical safe with a fully mechanical lock.

Concerning the choice of this master password, I printed a list of a few of them generated with a validated password generator, and then tested them on a validated OS without looking at the screen (cat >/dev/null) to validate my memory error rate to select the best one.

Answer 3

maybe I'm paranoid, but I keep and suggest you keep the password only in your head, since you can’t be 100% sure that important data is stored on the Internet. I propose my own method, maybe it will help you: take any password generator and make a list of new passwords, then type each or any password you like on the keyboard, if you feel any discomfort while typing, take the next one and so on until you find one that you like it and it’s convenient and convenient for you to type it. Actually, you have found your password, which is good and safe and easy and convenient to type, repeating it each for some time, you will remember it physically, that is, your fingers will themselves stretch to the next character themselves, so even if you forget it, your fingers help you remember him. You can also combine multiple passwords into one large one. I hope I understood clearly.

Answer 4

I would get a YubiKey and store the master password on it. I would have an easier password to remember and set that on the YubiKey. It would be much harder for someone to steal your YubiKey and know your easier password. This way you can change your easier more memorizable password on the YubiKey less often. This obviously has only one advantage in the sense that you can memorize your password and also need a physical device be stolen.

This can also work on a bitlocked USB drive. Bitlocker is available with Windows by default. This option is also putting an easier password that you never use anywhere else to unlock the USB drive that has a plaintext file with your master password.

I find it easier to use an easier password than memorize the complex ones. Paper just requires anyone to take a look, obviously. If one of your room mates takes your USB device he would also have to know the easier password as well and take the device for a prolonged period to guess your easier password, which you would notice. Also do not use that password for anything else. One way or another yes you need a password but this is the best compromise between paper and losing a password.

BTW the YubiKey has a static password storage slot for anyone not familiar with that.

Answer 5

I would store the master password on two or three bitlocked USB drives with a password that is easier to remember, but unique and long enough to withstand brute force attacks. Give two of them to a friend or family member that doesn't live with you. They would not have access due to the simpler password. Then you can gain access to their drives in the event you lost yours. Again, I would never use this password elsewhere. I personally would never change this password and never use it unless I needed to recover the master. You can change your master password as often as you would like and not be concerned with memorizing or writing down your password.

This should take no more than 5 min. Just right click on each USB drive in explorer and go to Bitlocker. It is very simple and uses AES encryption.

What I like most about this technique is you feel safe not to write down or lose anything. If you are super paranoid about losing your drives just add more. They are cheap for 1 gb or even 256 MB drives you can even have two extra for yourself.

Answer 6

So is there any way to store a master password online, encrypted, without having to remember another password?

I don't think that is possible.

However, if I were in your situation, I would choose what I will call a "pass sentence" that is easy for you to remember, rather than a diceware password.

In theory, that has less entropy than a diceware password. After all, someone who knows you as well as you know yourself, will almost certainly be able to guess it. So you need to pick something from long ago in your life for best safety. And of course you must protect yourself from shoulder-surfing (always a good idea anyway).

An example, loosely paraphrased from something similar I often use, is "When I was 12, I drove a car into a tree." (yes, including the comma and the period at the end). I also had a mnemonic on paper: "W* 99, I d*." which reminded me that the first word was capitalised, there was a comma after 2 digits, and a period at the end, because in the long run those are the things you will forget. (The "d" is there because I once found myself remembering it as "I ran a car into a tree" and sweated bricks until I calmed the hell down and remembered it was drove not ran!)

Needless to say the above example is not what I actually use, but it illustrates what I want to say reasonably well.

You'll find a lot of password examples that advocate something like this, but shortened to first letters of each word. Resist the temptation to do that. Size does matter :-)

Answer 7

I know a team based in Luxembourg who are developing something called password pledging - www.passwordpledge.com

It is a web-based service that allows you to store critical passwords with them, which in an emergency (death, serious illness etc.) they could pass onto your next of kin, colleagues etc. I can see how that is a useful service - they gave me the example of the Quadriga CEO who died leaving his wife without access to his laptop, on which he stored the passwords for millions of dollars worth of bitcoins.

I haven’t seen a product like this before, so don’t think there is anything that you can use today, but maybe others know of something similar.

I would imagine this could also be used to allow self-recovery of forgotten passwords for 1Password, LastPass etc. although I’m not sure if they will target that use-case.

According to their landing page (www.passwordpledge.com), that they have some way of encrypting the data so they can’t access it but you and/or your next of kin can decrypt it without needing a password. That seems to fit with what you are looking for but unfortunately they don’t say how they will actually do this. It could be biometrics or they have come up with some other clever way of doing it.