Yes, I do use a password manager. Yes, I do use complicated long passwords, a la XKCD.
However, sometimes I fail repeatedly when entering the master password to my password manager. Which has no "show" button, presumably due to security concerns about cameras.
Cameras that are just not there - I don't this in public.
So what I instead do after 3 or 4 bad attempts is:
- type in password in terminal app (macos if you must know)
- don't enter it
- copy it to the clipboard
- paste it into the password manager (local one, not online)
- if if fails, go and correct the capitalization - is it HorseBattery or horseBattery? again don't enter it.
- once successful, erase terminal characters
As I can think of it, I am at risk of keyboard sniffers (but no more so than just by entering in the password manager apps. I am also at risk of cameras, but don't consider that a realistic threat. It's not in the command history as I never entered it. Yes, something capturing clipboards is a problem, but by the time my system allows that, I am done for already.
Am I missing something? Writing this up I can think of 2 extra steps:
- copy something to clipboard right after, to replace password in it
- minimize open browser windows, just in case there is JS clipboard exploit running, somehow
Is there a better way to deal with typos on really complicated passwords?