Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

Maybe it was already discussed. After browsing through some alike questions here about password management, I still would like to ask this question.

If there are 100 sites which require username password to login. It would be a nightmare to make up another username and password just for the uniqueness. However if we use the same username and password, we expose ourselves to crossite attack. Maybe we can make 100 different username and password, but how can we remember it?

Brain is not trustworthy. Professionals recommend not to write down any password on paper. And there are those password management software. I've never used these software so I am rather blind there. Do you trust those things? Imagine if someone stole your computer and try to break into these software, do you has the risk to lose all your identity?

share|improve this question

closed as off topic by Karl Bielefeldt, Michael K, Caleb, Anna Lear Oct 10 '11 at 5:19

Questions on Programmers Stack Exchange are expected to relate to software development within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

Some people use the same password tweaked slightly w/ the site name in a consistent way. (eg, bar1netflix2rycar6ter for netflix, and change netflix to the sitename). Not super secure, but maybe better than nothing. –  barrycarter Oct 10 '11 at 4:16
Can you somehow relate this question to software development beyond the obvious fact that programmers use computers and may need to remember a variety of passwords? The password issue would seem to affect anyone who uses computers. –  Caleb Oct 10 '11 at 5:12
Hi gunbuster363, this has been asked several times on IT Security.SE: have a look through the password-management tag there. –  user8 Oct 10 '11 at 7:28
I'm shocked... SHOCKED... no one posted this xkcd.com/936 –  CamelBlues Oct 10 '11 at 16:48

5 Answers 5

That's exactly what OpenID is about, and that's why it is implemented in SE websites.

an open standard that allows users to be authenticated by certain co-operating sites (known as Relying Parties or RP) using a third party service, eliminating the need for webmasters to provide their own ad hoc systems and allowing users to consolidate their digital identities...

share|improve this answer
But there is only 1 site use openid. Well, among all the sites I've used. It is like telling people to use IPv6 for the future - people just won't do it. –  lamwaiman1988 Oct 10 '11 at 2:33
I'm not sure about the meaning of your comment. According to Wikipedia, "OpenID authentication is now used and provided by several large websites. Providers include AOL, BBC, Google, IBM, MySpace, Orange, PayPal, VeriSign, LiveJournal, and Yahoo!." Does it address your concern? –  MainMa Oct 10 '11 at 2:34
Well that only covers a subset of all the sites I would use. And can I transfer the data of my existing account to an account created with openid? –  lamwaiman1988 Oct 10 '11 at 2:40
And do you mean they provide openid authentication service for other sites, or they use openid authentication for their own site? I went to Yahoo! a few minutes ago, they accept id of facebook and google, but I haven't seen openid. –  lamwaiman1988 Oct 10 '11 at 2:46
"Well that only covers a subset of all the sites I would use": so for you, the solution would be to encourage other websites to implement OpenID, or rather to discourage users to choose OpenID over ordinary authentication. "can I transfer the data of my existing account": I believe it depends on the providers, but I'm not sure. –  MainMa Oct 10 '11 at 2:46

Online password storage program like LastPass might be what you'd be looking for.

From a different perspective, you can go with an offline method like Off the Grid: https://www.grc.com/offthegrid.htm

Using this would allow you to create infinite amount of passwords for different domains, and no one can steal your password electronically. Methods to circumvent stealing your password physically would be to modify the method stated on the site for creating the password.

share|improve this answer

I have no experience of many of the numerous password storage programs, as unless open source, therefore available for peer review, they cannot be trusted. Look for one written by a person held in high regard in the security industry, that is open source, light weight and portable.

I use passwordsafe, have done for years. Initially written by Bruce Schneier, now open source. (if you don't know who he is, you have not read anything about computer security over the 30+ years).

As for not writing down password, depends on who you are protecting yourself from. Kid bro or boss, don't write it down where they can read it. Hacker on other side of world, write it down. NSA - doesn't matter what you do. I write down lots of passwords, no way you can steal them across wire, always there when I need them.

Anything you can remember is crackable in a few minutes to hours, depending how well funded your attacker is. For most of us, don't use passwords, pass-phrases are easier to remember and have more entropy. (i.e. "password" vs "row row row your boat").....

You should have levels of password. Highest level is about your bank, money and email (email gives access to all now days). Next tier is "reputation" - things you care about that will hurt a little, but not a lot, financially if they get compromised. Next tier is "because they demanded one". Tier one passwords/phrases must be in no way related to tier 2 and 3. If you use you pets name for tier 1, don't use your kids names for tier 3 etc. they must be tough, very tough, and never, ever reused, not even a little. Relax the rules a little for tier 2, and a lot for tier 3.

share|improve this answer

Professionals recommend not to write down any password on paper.

File (encrypted or on cryptoFS) is not open paper

Do you trust those things?

In some (considerable) extent

Imagine if someone stole your computer and try to break into these software


uses the standard, military grade, peer-reviewed AES/Rijndael in CBC mode, with a 256-bit keysize

MyPadlock, with slightly less power than fSekrit, still have strong security (128-bit AES encryption)

I'll say "Good look!" to this <censored>

share|improve this answer

The short answer is there is not a way that is both immune to human fallibility and cryptographically sound in terms of using passwords. Jeff Atwood addressed the subject recently.

share|improve this answer
Yes, I've read the post by Jeff Atwood already. –  lamwaiman1988 Oct 10 '11 at 2:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.