Secure way to remember usernames and passwords [closed]

Question

Maybe it was already discussed. After browsing through some alike questions here about password management, I still would like to ask this question.

If there are 100 sites which require username password to login. It would be a nightmare to make up another username and password just for the uniqueness. However if we use the same username and password, we expose ourselves to crossite attack. Maybe we can make 100 different username and password, but how can we remember it?

Brain is not trustworthy. Professionals recommend not to write down any password on paper. And there are those password management software. I've never used these software so I am rather blind there. Do you trust those things? Imagine if someone stole your computer and try to break into these software, do you has the risk to lose all your identity?

Answer 1

That's exactly what OpenID is about, and that's why it is implemented in SE websites.

Answer 2

Online password storage program like LastPass might be what you'd be looking for.

From a different perspective, you can go with an offline method like Off the Grid: https://www.grc.com/offthegrid.htm

Using this would allow you to create infinite amount of passwords for different domains, and no one can steal your password electronically. Methods to circumvent stealing your password physically would be to modify the method stated on the site for creating the password.

Answer 3

The short answer is there is not a way that is both immune to human fallibility and cryptographically sound in terms of using passwords. Jeff Atwood addressed the subject recently.

Answer 4

Professionals recommend not to write down any password on paper.

File (encrypted or on cryptoFS) is not open paper

Do you trust those things?

In some (considerable) extent

Imagine if someone stole your computer and try to break into these software

fSekrit

uses the standard, military grade, peer-reviewed AES/Rijndael in CBC mode, with a 256-bit keysize

MyPadlock, with slightly less power than fSekrit, still have strong security (128-bit AES encryption)

I'll say "Good look!" to this <censored>

Answer 5

I have no experience of many of the numerous password storage programs, as unless open source, therefore available for peer review, they cannot be trusted. Look for one written by a person held in high regard in the security industry, that is open source, light weight and portable.

I use passwordsafe, have done for years. Initially written by Bruce Schneier, now open source. (if you don't know who he is, you have not read anything about computer security over the 30+ years).

As for not writing down password, depends on who you are protecting yourself from. Kid bro or boss, don't write it down where they can read it. Hacker on other side of world, write it down. NSA - doesn't matter what you do. I write down lots of passwords, no way you can steal them across wire, always there when I need them.

Anything you can remember is crackable in a few minutes to hours, depending how well funded your attacker is. For most of us, don't use passwords, pass-phrases are easier to remember and have more entropy. (i.e. "password" vs "row row row your boat").....

You should have levels of password. Highest level is about your bank, money and email (email gives access to all now days). Next tier is "reputation" - things you care about that will hurt a little, but not a lot, financially if they get compromised. Next tier is "because they demanded one". Tier one passwords/phrases must be in no way related to tier 2 and 3. If you use you pets name for tier 1, don't use your kids names for tier 3 etc. they must be tough, very tough, and never, ever reused, not even a little. Relax the rules a little for tier 2, and a lot for tier 3.