On line passwords becoming the pain of my life

[Tuvra]

I was asked today to set up an Ebay & Paypal account for someone. The person gives me a random unusual name that she uses as her password for all her on line activities, lets assume the name is "Antonina". Ebay tells me I also have to have a number in the password, fine "Antonina1", sorry password not acceptable, I eventually get it set on "Antonina1111". Job done.

On to Paypal, try to set it up exactly the same, "Sorry you can't use four numbers consecutively", fine, "Antonina1" it is. There's two different passwords that essentially lets her do the same thing, buy and sell on Ebay, annoying but not the end of the world.

Now I try to download ebay on her Ipad where again she doesn't know the fking password so I have to try and reset it, it rejects the following for being too easy to guess:

• Antonina1
• Antonina1111
• Buffalo1
• Buffalo11
• Buffalo1111
• Buffalo2

Eventually letting me set it at "Antoninabuffalo1". Which of course she won't remember so it has to be written down therefore reducing the security level. (the names / animals have been changed but represent a similar formula)

At this point I am just brushing it off by remembering she should really have remembered her password.....

Then I try to log into my microsoft account that I rarely use, I can't remember the password so request to reset, no problem, well actually there is "The password you have used has already been used, please choose another....", Ahh yes thats why I can't remember the fking password because I have to reset it every time I log in because I forgot it once. They may as well rephrase the error message to say "Please use a password that you cannot remember so we can annoy you next time by resetting it again".

It then has me thinking back to last week, SSE, Sky & BT all needed passwords to access my accounts, in the end I reset them all as "Icannotremember1" because they all had me jumping through fking hoops to change my password. What's going to happen if someone gets my BT password? Someone going to pay my fking line rental?!?!?

The stupid thing is, I have never forgotten my most important password and never had any security issues. "You shouldn't have the same password for everything...", no, I'll just remember 42 different fking passwords in 13 different formats to please the various companies, saying that, I suppose I could always write them down or store them somewhere

I feel better after that little rant....

[0000]

Tuvra said:

I suppose I could always write them down or store them somewhere

I see nothing wrong with that, as long as it's secured appropriately.

FWIW, I use an encrypted password vault stored on a local hard disk. Just the one, long, password to remember then.

[essayer]

Just get 1Password. It's amazing.

There is no excuse for reusing passwords any more, you simply must use different passwords on every site.

[SHutchinson]

Try working in IT!

Logging on to things makes up 20% of my day.

[BoRED S2upid]

I share your frustration I generally have the same one for everything that's full of letters numbers and other #%^^%# so if someone hacked that then good on them they can shop on eBay, Amazon, pay my phone bill for me post on here fill your boots. No online banking or payment though I use guest PayPal or enter my card details so the hacker will have to pay for stuff themselves.

[Mr Pointy]

Try Lastpass, I find it works very well. I even use it to store pdfs of stuff like insurance certificates so I can show them if it need to when travelling.

[sjg]

Lastpass.

The problem with using the same complex password everywhere is the weakest sites - maybe some web forum, maybe some poorly written ecommerce store you bought something from years ago. They may well store your password unencrypted because no-one knew better at the time. They get hacked or inadvertently leave a copy of a database backup somewhere and now someone has your details and your password, and they can jump on any of the hundreds of other sites you use with the same details.

Password managers are the way to go.

[TEKNOPUG]

https://lastpass.com/

Stores all you username/accounts/passwords. You just have to remember the one password to https://lastpass.com/ itself. It then opens and logs into your websites automatically when you open them. It can also auto-generate new passwords for you.

[Greshamst]

Tuvra said:

It then has me thinking back to last week, SSE, Sky & BT all needed passwords to access my accounts, in the end I reset them all as "Icannotremember1" because they all had me jumping through fking hoops to change my password. What's going to happen if someone gets my BT password? Someone going to pay my fking line rental?!?!?

Well, if they get your BT password, it sounds like they've probably then got most of your passwords for everything else if you're using the same series of passwords, and adding simple 1's. Maybe you've got an iphone with a similar password. Once they have that, they can access your appled ID, and clone your phone onto a blank handset.
Also, they can then print off your bt phone bill, which can be used as a form of address verification if they were to take out a store card in your name.
Maybe they use the access to your BT account to set up a phone redirect, which can then be used to bypass security measures on bank accounts payments.

One simple peice of information like a BT password can be very useful to fraudsters, as they can human engineer other information.

[Targarama]

One question: if you trust lastpass or a similar site, what happens if they get hacked?

[98elise]

SHutchinson said:

Try working in IT!

Logging on to things makes up 20% of my day.

Agreed. I have about 30 passwords to remember

[TEKNOPUG]

Targarama said:

One question: if you trust lastpass or a similar site, what happens if they get hacked?

I don't store my bank account etc on their. Neither do I allow any websites to save my payment details (although 99% of them still require verification). What's the worst that can happen, someone takes over my PH account?

[Major Fallout]

I use ex's names, I always remember them and find it easy to associate them to different things.

Remember money grabbing wore = Paypal
Remember the girl that got her glasses frames second hand = Ebay
Remember the fatty = supermarket
Remember the singer = iTunes
Remember the underwear model = Love honey
Remember the one that never stopped talking = Email
Remember the one with the weird friends = Facebook
Remember the one that collected classic cars = piston heads

And so on.

[SpudLink]

I use KeePass on the MacBook, and MiniKeePass on the iPhone. The encrypted file is stored on DropBox.
Proved useful when previous MacBook was nicked. I had access to all my accounts and login detail from my phone, which meant I could change all the passwords.
If it was just stored on the MacBook I would have struggled to remember what needed changing, let alone remember all the passwords.

That does mean if DropBox is hacked, they will get hold of the encrypted file. I just have to trust the KeePass encryption I suppose.

[Hooli]

98elise said:

SHutchinson said:

Try working in IT!

Logging on to things makes up 20% of my day.

Agreed. I have about 30 passwords to remember

That's solved here. All the secure systems/switches/etc that need passwords have them written in a spreadsheet everyone has access too

[MikeGoodwin]

Keepass is free to use. Try that.

If you work in IT, use RADIUS or TACACS hooked up to AD

[RizzoTheRat]

I've started using True Key, which is Intel's one. Functionality's great but I need to change to something else as sometimes it refuses to log in for no apparent reason meaning I still have to remember my passwords.


Which is going to be better out of Lastpass, 1password or Keypass if I want something I use on both my phone and my PC, and be able to look up the actual password on my phone if I want to log in to another machine?

[hairyben]

apart from a couple of particularly important accounts like email/banking I use the same password for everything.

[boyse7en]

hairyben said:

apart from a couple of particularly important accounts like email/banking I use the same password for everything.

Same here.

I don't really get the password managers. What happens when you want/need to log into some account when you are not at home? For example, I was helping out a friend's issues with her laptop, had to log into my email on her machine to get some info. I log into ebay/paypal/facebook/Amazon etc at home on the desktop, the missus' laptop, work's computer, my phone, work laptop.

I've, on occasion, had to use public access computers (hotel, library, colleagues laptop), so how do you use a manager on those too?

Or am I missing the concept of how they work?

[0000]

Targarama said:

One question: if you trust lastpass or a similar site, what happens if they get hacked?

In theory I believe it just gives access to encrypted passwords. I get encryption generally, I don't get how that works though.