How do you keep track of all your passwords? [closed]

Question

I'm going to ask this question at the risk of someone exposing me their own personal algorithm, if that's what you do please don't post that!

I'm interested in learning what software you use to manage your passwords on various sites. If you do use software, what is it? What features do you like/hate/want?

The other day I discovered a vendor that offers a "Hosted Cloud" platform to manage your passwords. Would you consider such a thing? What would your requirements be?

Answer 1

This is my method:

I use KeepassX (it's free and multiplatform) and I share keepassX password database between pcs using Dropbox.
With KeepassX, I usually protect the database password with a master password and a key file (that i do not share on Dropbox) .

I always let KeepassX picking a password for me, this rule does not apply for services I use frequently like Gmail or Ebay for example; in this case I usually choose a reasonable long password with upper and lower case but not "too hard" to remember.
Something like: "MaradonaBestNumber10".

Keepass Autofill feature is supported on linux and unofficially on OSX.

Answer 2

I use the Windows version of Keepass, with a reasonable password and key file. I store the file in a 'secure' FTP location that is accessible from anywhere, and I have a obfuscated and encrypted copy of the key file elsewhere on the web, in case I need to access it from a new location. I also have it on USB stick (minus the key file).

Answer 3

I keep then in the Notes section of Outlook.

Answer 4

I use RoboFormPro and love it. Works well with IE, FireFox and Chrome. It has a companion program called GoodSync, so if you change a password when visiting a site on one computer, it can be synced with your other ones. Also handles credit cards and filling in address fields. I have no connection with the company, just a happy customer.

Answer 5

LastPass is great, works everywhere, and has tons of extra options for crazy good security. A comprehensive review and analysis was done by GRC.

Answer 6

For web passwords, I use Firefox's Password Hasher extension, which takes a "Master password," a site tag, and several options (Password length, Require special characters, require upper and lower case, require digits, etc.). Given the same entry data, the same password is always generated, but it's presumably difficult to go from the hash back to the password, even given the site tag.

The thing is, the Master Password can be changed on different sites. To determine my Master Password for a particular site, I first group sites into three categories: low security, medium security, high security. Each category has a "base" password. Then, I insert some element from the source site into the password. So facebook and digg, for example (medium security) could be "I like to browse facebook while I'm at work." and "I like to browse digg while I'm at home."

Answer 7

Although other answers mentioned keepass and I agree for those rarely used passwords however, for day to day use passwords I find it easier to remember the placement on the keyboard.

Typing them to me is easier than repeating the characters so to be honest I dont know my password explicitly rather I know the finger movements to type it.

This brings up a great problem with it though, what happens when the keyboard layout changes, cell phones and the like sometimes have special characters in interesting places so it makes it quite challenging for me to type some passwords of mine in these devices.

as12$%ty for example looks fairly random however it is really pairs of keys pressed side by side with a shift tossed in if you look at the movement to type it. In this regard it becomes second nature.

Answer 8

For password storage I really like Lastpass to replace the old shared Keypass DB. In Lastpass your vault exists online. To speed up the process of logging in, Lastpass comes as plugins for various browsers, OS specific installs, and even mobile apps. If you have access to the internet, you can get your passwords. Its fast, easy, and accessible everywhere. I recommend it to anybody who uses more than 1 computer for multiple sites.

---

For a password algorithm, I use a very simple one: Just repeat a short password multiple times. You can make a simple 8 character password 32 characters long. And when you add entropy between the passwords (eg password1password12password123) it becomes even longer and more secure since now people have to figure out your repeated password + entropy.

However you do have to consider what the website/program is using for password storage. If there using a pretty weak algorithm (Eg MD5), then longer is better. If they are using a pretty strong one (Eg Truecrypt in AES-Twofish mode with Whirlpool), then you can get away with short ones.

How? Think about it, even if you limit it the possible keys to 62 (a-z, A-Z, 0-9) and know the password is 9 characters long, your still talking about 9^62, or 145,557,834,293,068,928,043,467,566,190,278,008,218,249,525,830,565,939,618,481 possible combinations. Even if you could do a billion passwords a second (which you can't), your talking about 145,557,834,293,068,928,043,467,566,190,278,008,218,249,525,830,565 seconds, or 4,615,608,647,040,491,122,636,592,027,850,012,944,515,776 years. Our sun will explode before you can guess all the combinations. I think I'm safe

What do I use? Well, thats for you to figure out. See you in a few billion billion billion years when you guess it

Answer 9

I just rely on my brain. I have 3 categories of passwords that I use; one for banking (not used anywhere else), one that's fairly hardened and one I don't care if anyone got a hold of. I don't find it too hard to remember which one to use.

Answer 10

I use 1Password/Mac and love it. The password database is stored on my Dropbox, which then automagically propagates to my iPhone and iPad, so my current password list is both always backed up and always with me.

As I mentioned above, a Windows version is now in public beta.

Answer 11

Usually, taking a small phrase and writing it in 1337 is a good way of making very tough passwords.

For instance, take "I love my cat" (be afraid of nothing! use spaces!). You can turn this into | <3 |\/|y <47, and as long as you keep a consistent "algorithm" for 1337ifying words, you get an unlimited supply of very strong passwords.

Answer 12

I HAVE software but rarely use it. I have 1Password. It was fine when I worked only on a Mac but these days, I jump among the big 3 so I basically use 2 unique, randomly generated passwords plus a tag from whatever site I'm logging into.

For example, if my main password were "sh58@fhy", I'd log into amazon.com with a password of sh58@fhyAM. That way, the password is random, easy to remember & unique for each site.

Answer 13

Just remember them. It's not too hard:

• Use passphrases. "TheComputerIsGreenSometimes" is easy to remember than "Fo84rz" and more secure.
• Reuse about a handful, along with a handful of usernames. Just keep things partitioned such that if one password gets discovered, you don't lose everything. For example, my banking accounts use passwords that I don't use for anything else, but most of my email accounts use the same password. Reuse means your more likely to remember them.
• Pick passwords that have meaning to you (but are not obvious, like your birthday or something). Eg, your second favorite brand of beer, or your the summer camp your wife visited as a kid.