Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm going to ask this question at the risk of someone exposing me their own personal algorithm, if that's what you do please don't post that!

I'm interested in learning what software you use to manage your passwords on various sites. If you do use software, what is it? What features do you like/hate/want?

The other day I discovered a vendor that offers a "Hosted Cloud" platform to manage your passwords. Would you consider such a thing? What would your requirements be?

share|improve this question

closed as off topic by Steve Evers, Terence Ponce, ChrisF Nov 8 '10 at 22:37

Questions on Programmers Stack Exchange are expected to relate to software development within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

8  
This question is more suited to superuser.com, and has already been asked there. –  finnw Sep 6 '10 at 14:54
    
I make them all the same, "SO-ROX!123". [D'oh!] –  Steven A. Lowe Jun 27 '11 at 16:06

13 Answers 13

up vote 13 down vote accepted

This is my method:

I use KeepassX (it's free and multiplatform) and I share keepassX password database between pcs using Dropbox.
With KeepassX, I usually protect the database password with a master password and a key file (that i do not share on Dropbox) .

I always let KeepassX picking a password for me, this rule does not apply for services I use frequently like Gmail or Ebay for example; in this case I usually choose a reasonable long password with upper and lower case but not "too hard" to remember.
Something like: "MaradonaBestNumber10".

Keepass Autofill feature is supported on linux and unofficially on OSX.

share|improve this answer
1  
+1 And it can fill in the password automatically. –  Ikke Sep 6 '10 at 6:15
3  
This is exactly what I do. Just some extra info - KeePassX is a port of KeePass. Version 2 of which is now compatible with Mono and works great on Windows, Linux & Mac. –  Simon P Stevens Sep 6 '10 at 9:34
1  
+1 for keepassx, anyone else worry about dropbox security ? –  Chris Sep 6 '10 at 17:39
1  
Love KeePassX, but use my own generator. –  Roger Pate Sep 9 '10 at 15:23

For password storage I really like Lastpass to replace the old shared Keypass DB. In Lastpass your vault exists online. To speed up the process of logging in, Lastpass comes as plugins for various browsers, OS specific installs, and even mobile apps. If you have access to the internet, you can get your passwords. Its fast, easy, and accessible everywhere. I recommend it to anybody who uses more than 1 computer for multiple sites.


For a password algorithm, I use a very simple one: Just repeat a short password multiple times. You can make a simple 8 character password 32 characters long. And when you add entropy between the passwords (eg password1password12password123) it becomes even longer and more secure since now people have to figure out your repeated password + entropy.

However you do have to consider what the website/program is using for password storage. If there using a pretty weak algorithm (Eg MD5), then longer is better. If they are using a pretty strong one (Eg Truecrypt in AES-Twofish mode with Whirlpool), then you can get away with short ones.

How? Think about it, even if you limit it the possible keys to 62 (a-z, A-Z, 0-9) and know the password is 9 characters long, your still talking about 9^62, or 145,557,834,293,068,928,043,467,566,190,278,008,218,249,525,830,565,939,618,481 possible combinations. Even if you could do a billion passwords a second (which you can't), your talking about 145,557,834,293,068,928,043,467,566,190,278,008,218,249,525,830,565 seconds, or 4,615,608,647,040,491,122,636,592,027,850,012,944,515,776 years. Our sun will explode before you can guess all the combinations. I think I'm safe

What do I use? Well, thats for you to figure out. See you in a few billion billion billion years when you guess it

share|improve this answer
3  
Unless quantum computers see daylight before then. –  zneak Sep 9 '10 at 0:47

I HAVE software but rarely use it. I have 1Password. It was fine when I worked only on a Mac but these days, I jump among the big 3 so I basically use 2 unique, randomly generated passwords plus a tag from whatever site I'm logging into.

For example, if my main password were "sh58@fhy", I'd log into amazon.com with a password of sh58@fhyAM. That way, the password is random, easy to remember & unique for each site.

share|improve this answer
1  
yea... I was hoping to avoid this kind of answer which could be considered social engineering. I think some can now infer how to get access to your wamu account –  makerofthings7 Sep 5 '10 at 19:36
    
True..I think it depends on how you go about it tho. I've certainly thought about what happens if someone finds out my "salt" so I sleep at night by deviating from that basic premise. The site-specific bit can be chosen from any portion of the domain and not always appended as a suffix. My personal algorithm also changes based on the context of the site. I was going for simplicity but I forget - I AM amongst programmers here, LOL. –  TyKisha Sep 5 '10 at 20:10
1  
ooh a salted algorithm, nice. –  makerofthings7 Sep 5 '10 at 21:01
    
Did you know that 1Password for Windows is now in public beta? –  Dori Sep 6 '10 at 2:27
    
@Dori - No, I didn't! That's awesome! –  TyKisha Sep 6 '10 at 2:37

Just remember them. It's not too hard:

  • Use passphrases. "TheComputerIsGreenSometimes" is easy to remember than "Fo84rz" and more secure.
  • Reuse about a handful, along with a handful of usernames. Just keep things partitioned such that if one password gets discovered, you don't lose everything. For example, my banking accounts use passwords that I don't use for anything else, but most of my email accounts use the same password. Reuse means your more likely to remember them.
  • Pick passwords that have meaning to you (but are not obvious, like your birthday or something). Eg, your second favorite brand of beer, or your the summer camp your wife visited as a kid.
share|improve this answer
    
how do you deal with the fact that some websites require numbers and special characters? –  grokus Sep 5 '10 at 21:15
    
When constructing passphrases, try for one that has a number in it. Eg, "ThereAre13DucksInThePond". As for special characters, some people I know use underscores for spaces, but it's rare that a site actually requires those. –  Fishtoaster Sep 5 '10 at 21:22
3  
Just remember them? Really? How does a sysadmin who manages a few thousand boxes "just remember them"? –  Chris Sep 6 '10 at 17:39

I just rely on my brain. I have 3 categories of passwords that I use; one for banking (not used anywhere else), one that's fairly hardened and one I don't care if anyone got a hold of. I don't find it too hard to remember which one to use.

share|improve this answer

Usually, taking a small phrase and writing it in 1337 is a good way of making very tough passwords.

For instance, take "I love my cat" (be afraid of nothing! use spaces!). You can turn this into | <3 |\/|y <47, and as long as you keep a consistent "algorithm" for 1337ifying words, you get an unlimited supply of very strong passwords.

share|improve this answer

I use 1Password/Mac and love it. The password database is stored on my Dropbox, which then automagically propagates to my iPhone and iPad, so my current password list is both always backed up and always with me.

As I mentioned above, a Windows version is now in public beta.

share|improve this answer

LastPass is great, works everywhere, and has tons of extra options for crazy good security. A comprehensive review and analysis was done by GRC.

share|improve this answer

For web passwords, I use Firefox's Password Hasher extension, which takes a "Master password," a site tag, and several options (Password length, Require special characters, require upper and lower case, require digits, etc.). Given the same entry data, the same password is always generated, but it's presumably difficult to go from the hash back to the password, even given the site tag.

The thing is, the Master Password can be changed on different sites. To determine my Master Password for a particular site, I first group sites into three categories: low security, medium security, high security. Each category has a "base" password. Then, I insert some element from the source site into the password. So facebook and digg, for example (medium security) could be "I like to browse facebook while I'm at work." and "I like to browse digg while I'm at home."

share|improve this answer

I keep then in the Notes section of Outlook.

share|improve this answer
    
This made me smile. –  Rayne Nov 8 '10 at 9:28

I use the Windows version of Keepass, with a reasonable password and key file. I store the file in a 'secure' FTP location that is accessible from anywhere, and I have a obfuscated and encrypted copy of the key file elsewhere on the web, in case I need to access it from a new location. I also have it on USB stick (minus the key file).

share|improve this answer

Although other answers mentioned keepass and I agree for those rarely used passwords however, for day to day use passwords I find it easier to remember the placement on the keyboard.

Typing them to me is easier than repeating the characters so to be honest I dont know my password explicitly rather I know the finger movements to type it.

This brings up a great problem with it though, what happens when the keyboard layout changes, cell phones and the like sometimes have special characters in interesting places so it makes it quite challenging for me to type some passwords of mine in these devices.

as12$%ty for example looks fairly random however it is really pairs of keys pressed side by side with a shift tossed in if you look at the movement to type it. In this regard it becomes second nature.

share|improve this answer

I use RoboFormPro and love it. Works well with IE, FireFox and Chrome. It has a companion program called GoodSync, so if you change a password when visiting a site on one computer, it can be synced with your other ones. Also handles credit cards and filling in address fields. I have no connection with the company, just a happy customer.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.