How do I remember passwords for environments where Password Manager is not available?

Question

I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible.

However, there are environments where 1Password cannot be used. That is the password to protect 1Password itself and the password for full disk encryption before the OS boots.

I have a laptop that I use daily and a server at home. And both of them are encrypted with LUKS.

And I am a journalist in a repressive country. My computers can be seized by the state.

Now, the main question. Should the full-disk encryption password for my laptop, which shuts down frequently, be different from the full-disk encryption password for the server, which is always running, and the 1Password password? Or would the same password be acceptable?

If they should be different, how do I remember a long password? I can remember one, but it is extremely difficult to remember more than one.

Answer 1

IMHO, strong passwords are good to protect things (data, operating systems, etc.) against distant attacks. When it comes to the real world and when attackers could use physical threats (this may include special police in repressive countries) what matters is plausible denialability, if non detection is not possible. Even if I know that a password is strong enough against brute force attacks and hard to guess, I could just have to give it if an attacker was to threaten my life or the life of members of my family.

That being said, several words pass phrases are no so hard to remember. Slightly modified song or poems texts (portions of them...) can be both easy to remember and strong enough for most concerns.

The only rule should to not use the same password for security zones of very different levels. If you need a password to unlock your smartphone to show a photo to a friend, you might not control that nobody is looking over your shoulder, as much as when you type one to access a highly sensitive database...

Answer 2

As others have already mentioned, if you are arrested and be forced to give the keys then it does not really matter what kind of keys or how many of them you use; you'll have to give them away anyway. So you may want to think of other approaches in order to protect you/your work (e.g. steganography or having your server in another country, away from your country's jurisdiction, to which you connect from your laptop, in which laptop you store nothing).

Now, to the point of your question, the short answer is yes, they should all be different.

The reason is that a single password can grant access to all of your protected data (server, laptop, 1Password) if it gets compromised. For example, a knowledgeable adversary could just target your server from the internet, exploit the software on it, gain admin level access, extract the key (e.g. from memory or by installing a bootkit), then visit your home while you're out, copy your laptop's hard disk without leaving any trace and then use the password to decrypt your laptop's copied disk. And you wouldn't even know. Which also means that they could do it again and again, getting access to any new info you put in your computer. (I guess I don't have to explain the impact this will have, if the same password is the master password for 1Password).

On the difficulty of remembering a long password, that's easy: use a passphrase. An easy way to find one is to pick a song that you remember well, get one sentence from the song, change some letters to their optical similar numbers (e.g. o to 0, A to 4 etc), capitalize a couple of the letters and you have a pretty strong passphrase. For the next system you may use the next sentence of the song or a sentence from another song.

Whatever you do, though, I would suggest that you coin a method about how you derive such passphrases, so that your passphrases are consistent and make sense to you and you don't get locked out of your data eventually.