Passwords

[colinjm]

How do people store their usernames/passwords for everything internet these days. My PH login is just one of many different accounts that I have online, ranging from software registration, to myspace, to internet banking. Does anyone else find it difficult keeping track of these details.

I've thought about putting it all (minus the most important/sensitive ones) into an excel spreadsheet, but i'm very aware of the fact thats it's all in one place, and if someone else gets in, they have access to a large part of my life.

I try to stick to a few specific usernames, and along with those, a few specific passwords, but it's still difficult keeping track, especially when some of these accounts are either permanently signed in, or not used very often.

I've looked at password managers, but i'm not sure how good these are. Also, it would be useful to have this info with me on my laptop, but again it's a bit of a security risk. Alternatively I could just write it down, i suppose any way of storing them is open to attack/abuse from someone else.

Any tips or details of how you deal with this??

[Scraggles]

colinjm said:

How do people store their usernames/passwords for everything internet these days. My PH login is just one of many different accounts that I have online, ranging from software registration, to myspace, to internet banking. Does anyone else find it difficult keeping track of these details.

I've thought about putting it all (minus the most important/sensitive ones) into an excel spreadsheet, but i'm very aware of the fact thats it's all in one place, and if someone else gets in, they have access to a large part of my life.

I try to stick to a few specific usernames, and along with those, a few specific passwords, but it's still difficult keeping track, especially when some of these accounts are either permanently signed in, or not used very often.

I've looked at password managers, but i'm not sure how good these are. Also, it would be useful to have this info with me on my laptop, but again it's a bit of a security risk. Alternatively I could just write it down, i suppose any way of storing them is open to attack/abuse from someone else.

Any tips or details of how you deal with this??

currently have a range of default passwords for sites that not really worry about too much, the rest go on a passworded file in some place on the drive, not in the usualy my documents area either

maybe get a small book and call it passwords, if someone gets the book, they will probably take the pc anyway, important passwords are not written anywhere, but remembered

[ThePassenger]

Swap to passphrases.

45Gfv5y4 is hard to remember.
D3struct0Mupp3t is both longer and easier to remember (for me at least).

[zaktoo]

I keep all non-sensitive throw-away type passwords in the firefox password manager. Anything important is remembered or stored electronically away from the PC - without any way for people to know what they're for exactly, of course. Exceptionally important passwords are simply remembered though, these are generally anything to do with root-level access or internet banking stuff.

Ciao

Zak

[sjg]

I use (free and open source) Keepass - http://keepass.info/ - which I keep synced to every machine I use, plus a copy on a USB stick.

The password database is heavily encrypted, and you can optionally use a keyfile which you'd keep with you on some kind of removable storage. It does some very good password generation, and is excellent at clearing up after itself (like blanking the clipboard straight after you've copied and pasted a password). You don't even need to see the passwords most of the time, in case someone is looking over your shoulder.

As long as you have (and can remember) a good, strong password to protect the database in the first place, you're fine should a copy fall into the wrong hands.

[SneakyNeil]

You can write a password down if its innocuous, not right next to the computer and not immediatley below the username

[meeja]

Or come up with your own encryption key, makes things very easy to memorise.

You dream up your own key.

Example: p15TonH34D5

Then for every password, you use a combination of the name of the site or business you are logging into, and your key.

Use eBay for example.....

You put the first four digits of your key

p15T

Then the first character from the business

e

Followed by the next four digits of your key

onH3

Followed by the last character from the business

y

Follwed by the remainder of your key

4D5

Making your password for eBay: p15TeonH3y4D5

The beauty with this kind of system is that every account you have has a unique password, and unless you reveal your key, and also the way in which you use it, then every password for every site is different, and pretty secure.

Once you have memorised your key, logging in to different sites is a doddle.

[zumbruk]

Password Safe. Origianlly written by Bruce Schneier.

www.schneier.com/passsafe.html

[road2ruin]

Ok how about this one. Most people remember thier email passwords so email yourself a spreadsheet with your usernames and passwords on it (or some reminders for these to jog your memory)in some form of simple encryption devised by yourself (similar to codes you use to do as children). You can then keep the key to the encryption on say your phone or your computer so it is seperate from the original just incase someone gets hold of your email password and address. Then if you forget one you can always look up your email and remind yourself.It is a bit complicated but simple enough to organise.

[arfur]

General sites with nothing sensitive will use a /dev/null email username and fairly simple 10 char mixed upper/lower/numeric password ... One of 3 i normally use so I dont lock out

Anything sensitve, both usernames and passwords / phrases ... Is in my head

[rich1231]

started using roboform pro recently and changed all my passwords to randomly generated nonsense.

[timsta]

I haven't found anything better than Roboform.

www.roboform.com/

It adds a toolbar to your browser. You can pull down a list of sites and login with 1 click. It navigates to the site and fills in all the details. It will also fill forms for you with all your details.

[speedchick]

I use Roboform, and all my important passwords are password protected so I only need to remember one

[marcel.micallef]

Personally would not store any password on a pc or anywhere other thean in my head. I keep em all in my head. and use a key scrambler that works at kernel level. To defeat most keylogers. Just in case you pick one up.

[mph999]

steganos locknote - not been cracked yet apparently.

https://www.steganos.com/en/products/

Edited by mph999 on Friday 16th February 23:53

[marcel.micallef]

mph999 said:

steganos locknote - not been cracked yet apparently.

https://www.steganos.com/en/products/

Edited by mph999 on Friday 16th February 23:53

I use pgp whole disk encryption thats more secure than locknote but nether would stop a key loger

[roadsweeper]

marcel.micallef said:

Personally would not store any password on a pc or anywhere other thean in my head. I keep em all in my head. and use a key scrambler that works at kernel level. To defeat most keylogers. Just in case you pick one up.

What key scrambler do you use?

I use PGPDisk and have Firefox put all its temporary files, etc. in the mounted folder. That way Firefox Password Manager can store all my passwords and someone would need to either crack PGP (in which case they'd be far more interested in banks and governments than me!) or somehow steal my key file and private passphrase, get a copy of the PGP encrypted file and then crack Firefox Password Manager.

[spidydude]

ThePassenger said:

.
D3struct0Mupp3t is both longer and easier to remember (for me at least).

D3struct0Mupp3t

[MissPHit]

colinjm said:

How do people store their usernames/passwords for everything internet these days. My PH login is just one of many different accounts that I have online, ranging from software registration, to myspace, to internet banking. Does anyone else find it difficult keeping track of these details.

I've thought about putting it all (minus the most important/sensitive ones) into an excel spreadsheet, but i'm very aware of the fact thats it's all in one place, and if someone else gets in, they have access to a large part of my life.

I try to stick to a few specific usernames, and along with those, a few specific passwords, but it's still difficult keeping track, especially when some of these accounts are either permanently signed in, or not used very often.

I've looked at password managers, but i'm not sure how good these are. Also, it would be useful to have this info with me on my laptop, but again it's a bit of a security risk. Alternatively I could just write it down, i suppose any way of storing them is open to attack/abuse from someone else.

Any tips or details of how you deal with this??

Trust me, the best thing you can do is to learn your passwords and logins. And make your passwords alpha-numeric, alternating between caps-lock on and off. Try writing them down on paper and reading from that like a prompt-sheet until you learn them in your mind. Anything stored on your pc with access to the internet is always a risk. It depends how much you value your personal details etc.

[marcel.micallef]

roadsweeper said:

marcel.micallef said:

Personally would not store any password on a pc or anywhere other thean in my head. I keep em all in my head. and use a key scrambler that works at kernel level. To defeat most keylogers. Just in case you pick one up.

What key scrambler do you use?

I use PGPDisk and have Firefox put all its temporary files, etc. in the mounted folder. That way Firefox Password Manager can store all my passwords and someone would need to either crack PGP (in which case they'd be far more interested in banks and governments than me!) or somehow steal my key file and private passphrase, get a copy of the PGP encrypted file and then crack Firefox Password Manager.

No they wouldn't need too crack PGP. If they manged too get in your pc and install a key loger.
The key loger is still able too log you passwords when you have entered your pgp key and are useing them.

by using a key scrambler that scrambles the key press at kernel level as well as PGP that would also defeat most keylogers


I use this key scrambler plug in for firefox.
https://addons.mozilla.org/firefox/3383/