I've been using a well-known password manager to create several identities for use on each web service I sign up to.

I had the idea of creating 3+ email addresses with strong passwords consisting of 40+ random characters and signing up on each service with a different alias, sometimes a word, sometimes random characters. I never supply my real data, only made up but realistic information. This way an adversary running OSINT wouldn't be able to cross-correlate a given identity attributed to me to another one on a different service, right?

I'm aware that by using the same computer and IP address to create and log in to all those IDs is less than optimal, but my concerns are purely those of privacy and I don't include nation-state level adversaries on my threat landscape.


I think your question is: Does a PW manager protect my list of usernames (since we assume it protects your passwords).

Answer: No.

Based on your description, you're using unique information for each identity (username).

The place where you store that user/pass combo becomes a reference table that ties all those identities together. Specifically, if I have a list of usernames that you have the password for, then I can tie all of the usernames to you.

A PW manager is pretty good. HOWEVER, your username is often in plaintext to make it easier to search the database. This makes sense because the security is built around protecting your password - not your usernames.

Your list of usernames in plaintext is a threat to your ID Compartmentalization.

My password manager has secure notes. I'd use that feature to store this kind of information to keep usernames out of the plaintext fields.

  • 1
    Why do you think that all password managers store passwords in plain text? – flyaway0182 Dec 8 '19 at 20:33
  • 1
    Keepass encrypts the whole pw database, including usernames etc. I would imagine that most other pw managers do this too, as it is probably the simplest to implement and least likely unintentionally leak info. – Jack Dec 8 '19 at 23:36
  • No. They store the username less security. – Jonathan Dec 9 '19 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.