4

I use LastPass and love it. My girlfriend creates her own long, complex, unique, and thus difficult to remember passwords for every site. She frequently forgets them and has to rest the password. The passwords are "organized" on various post-it notes and scraps of paper in her notebook.

LastPass is too complex for her to use plus she doesn't trust "the cloud".

Can anyone suggest a relatively low-tech yet secure method to store her passwords? Maybe a file on an encrypted USB drive? maybe a book code or something?

|improve this question
  • 1
    How can LastPass be considered more "complex to use" than post-it notes scattered in a notebook? – Marcel Oct 6 '14 at 12:01
  • 2
    Trusts post-it notes but not an audited and validated password manager? Sounds like your gf is being obtuse, let her figure it out. – Andrew Hoffman Oct 6 '14 at 18:37
12

If her sole objection to LastPass is that the passwords are "out there", then I recommend using KeePass instead. It works similar to LastPass, but keeps the password database locally instead.

If she needs the passwords to be handy on-the-go, you can use KeePass as a portable app on a USB drive.

If you're really paranoid as to what might happen if the storage media containing the passwords is compromised, (even though the KeePass database is already encrypted) you can store the KeePass database within another encrypted container (TrueCrypt was previously recommended, but now defunct). Some encryption solutions have portable versions of the tools needed for using their containers on the go.

|improve this answer
  • 1
    Just make sure you keep backups. – Stephen Touset Dec 2 '13 at 18:57
  • @StephenTouset Agreed. My personal preference is to use KeePass with a separate cloud storage account (e.g.: DropBox, Google Drive, SkyDrive, etc.). That way my database is backed up and accessible online, but I'm not reliant upon the cloud provider for its security since I'm guaranteed to be the only one with credentials to unlock the file. (i.e.: If the online account gets hacked, or subverted by a malicious insider, the database file is still useless to the attacker without my key.) – Iszi Dec 2 '13 at 19:16
  • 1
    +1 for KeePass. At work we use it to store over 300 hundred passwords xD – eez0 Oct 6 '14 at 6:30
  • @yzT Not sure I'd really recommend that, depending on what the passwords are for. Keep in mind that any employee with read access probably can just copy the KeePass database and walk out the door with those passwords. You could change the key for the database on your server, but that won't affect their copy - you'd have to change all 300 passwords. – Iszi Oct 6 '14 at 17:48
  • @Iszi only the sysadmins have access to it. – eez0 Oct 7 '14 at 6:25
2

An alternative to keeping a file on a memory stick is using something like IronKey which has its own onboard browser and a password manager. It costs to get the IronKey, but it is solid. Some time ago I switched to LastPass for most of my passwords, but I still keep all my account info for banks, financial institutions, and few other very sensitive accounts on my IronKey. I like LastPass a lot, but not for everything.

IronKey self destructs (zap's its storage) after about 20 failed logon attempts, if someone tries to guess its password.

|improve this answer
  • hmm this is is more along the right path I think. her objection to LastPass is that her passwords are "out there"; if it can be synced across devices, then someone can crack it. Maybe a biometric USB with a word file on it? Can those be easily defeated if lost? – Vidro3 Dec 1 '13 at 3:46
1

Your girlfriend may use Off The Grid by grc.com, which is

"a paper-based system for encrypting domain names into secure passwords"

.

This is entirely off line, low tech and secure. However, probably a little more inconvenient than post-it notes. But then, hey, security always comes at the expense of convenience.

|improve this answer
  • Unless its a password manager that implements browser plugins and native apps for every major browser and platform, and binds your usernames and passwords by domain, and automatically dom-injects a dropdown list into the website. ;) – Andrew Hoffman Oct 6 '14 at 18:42
  • @AndrewHoffman Um, it's not. Have you really read the doc's from the link? – Marcel Oct 7 '14 at 5:14
  • 1
    I was alluding to lastpass, which is what his gf finds too complex. They do all of that, its super convenient. – Andrew Hoffman Oct 7 '14 at 15:11
  • @AndrewHoffman Yeah, I use LastPass all the time, even for data not used on the internet, as replacement to other password managers. – Marcel Oct 8 '14 at 5:41
-3

Here is really low tech:

She should come up with one or two passwords such as one easy and one way hard but that she can remember. Assign each a name like EASY and HARD. Now use a small address book to list websites with one of the names for the passwords. For sites that require changing the password just attach a number to the end of the password and write it in pencil in the book ie: HARD7. Don't write the actual words down anywhere.

I'm sure your girlfriend carries a purse so this method is portable too. I started this before the tech solutions were available and it is so simple I have stuck with it.

|improve this answer
  • 5
    No - this is incredibly bad advice. A fixed password+number is a godsend to attackers as once one password is discovered (eg through a website user database attack - relatively common) all the rest are at high risk as they are easy to get. – Rory Alsop♦ Jan 18 '14 at 19:23
  • 1
    Seconded. Awful, awful advice. – Ian Oct 6 '14 at 13:02
  • Alternatively, "p@$$w0rd" plus a number, then just cycle them 0 to 9. xD – Andrew Hoffman Oct 6 '14 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.