up vote 6 down vote favorite
1
share [g+] share [fb]

I want to improve my personal password management. I usually use secure passwords, but overuse them for too many different places.

My questions:

  • What methods do you use to create passwords, e.g. for different online sites/logins?
  • What methods do you use to remember those passwords? Memory? Pen&Paper? Software storage?
  • Is there some good way to store my passwords somewhere, so I can always have access to them when I need them (e.g. a webbased solution on my own server) but at the same way keep them away from unwanted access?

Edit: Someone on another site mentioned http://passwordmaker.org/. Have you had any good or bad experiences with that software?

link|improve this question
This is for superuser.com – anthares Mar 4 '10 at 11:42
Post-It Notes - Stuck to your monitor – Robin Day Mar 4 '10 at 11:45
3  
That's ridiculous, you're supposed to put the post-its under your keyboard. – Stephen Jennings Mar 4 '10 at 12:11
Post-Its? Just use a sharpie! ;-> – GreenMatt Mar 4 '10 at 14:57
feedback

migrated from stackoverflow.com Mar 4 '10 at 11:44

This question came from our site for professional and enthusiast programmers.

7 Answers

up vote 8 down vote accepted

Use an online password service like LastPass! Plugs into almost any browser or portable device, and is pretty nifty.

Best way to generate passwords, for me, was to write a short python script that would take the domain of the site as an argument and generate a string of pseudorandom numbers from it. That way it's very difficult to guess, and I can figure it out again if ever something goes wrong with whatever password-remember you use.

link|improve this answer
LastPass looks great - much better than last time I visited the site :) – Danilo Bargen Mar 4 '10 at 14:35
So your python script is a determinate algorithm, meaning that if someone got the program they would get your passwords? I'm not suggesting this is a problem, just curious. – Yar Mar 4 '10 at 14:38
@Yar; Absolutely! Sorta. There's an additional argument aside from the domain that goes into the initial hash generation, but it'd only be a matter of time before that was cracked by a particularly dedicated attacker. The way I figure it is if I can't keep my PC safe, I have bigger issues than a few site logins being compromised :P – Phoshi Mar 4 '10 at 15:13
@Phoshi, it's an interesting idea, though, I might consider something like that.. it's kind of security through obscurity, which is wrong, but I can't figure out any particular problems with it except for those we mentioned thus far. – Yar Mar 5 '10 at 14:37
@Yar; Security through obscurity might not be as secure as it can be, but I'm willing to give up a little security for the ease of use. I wouldn't be for anything important, but for simple website logins and so on, it's really easy to use :D – Phoshi Mar 5 '10 at 15:31
show 1 more comment
feedback
up vote 7 down vote

KeePass is the best password management software I've used, and it's free. There is a web-based port of it also that I've have tried.

link|improve this answer
+1, I use keepass both at home and at work. Just make sure you keep the kepass DB properly backed up and that you don't lose/forget all copies of the master password and/or key file you choose. – David Spillett Mar 4 '10 at 11:53
feedback
up vote 2 down vote

One solution, described by Joel Spolsky, is to use a combination of PasswordSafe and Dropbox. There are alternatives to PasswordSafe, particularly for platforms other than Windows, but Dropbox can automatically sync the (encrypted) password file to a PC on any platform (and it is backed-up in the cloud). PasswordSafe can generate secure passwords for you, so that you only need to remember one master password.

link|improve this answer
that sounds good for home and work computers, but is pretty complicated when i'm e.g. in an internet cafe... – Danilo Bargen Mar 4 '10 at 12:26
1  
@danilo: If you need this on computers not under your control you should definitely say so in the question. – Joey Mar 4 '10 at 12:42
@danilo Well, a slightly different solution would be to keep the portable version of KeePass on a USB drive (portableapps.com/apps/utilities/keepass_portable). You can then use Dropbox's web interface to download the latest password file (or you could just keep a copy on the USB drive). It's not entirely automatic, but should work. – sblair Mar 4 '10 at 13:43
feedback
up vote 1 down vote

May favorite approach is this:

Every password of mine is a combination of a complicated part and a service dependent part:

<complicated-part><service-part>

For example, the complicated part is !85HeLoN%9. The service part is the name of the website or service I use. For Facebook it would be !85HeLoN%9facebook then.

Remembering the complicated part is easy as you use it always in every password, so typing it gets a routine. The service part is obvious. You don't really need to remember your password.

One way to improve this is to have two versions of your complicated part, e.g. 85helon9 without capital letters and without special characters. When the service does not transfer your password via a secured connection, you still don't expose your real password and thus your really important accounts like online banking are still safe.

link|improve this answer
the problem with this is that if someone sees two of your passwords, he instantly sees the system behind it, and can guess the passwords of other accounts... – Danilo Bargen Mar 4 '10 at 12:22
@danilo: That is true, that is why the two versions are necessary. And an attacker still needs your username. Of course you still have to take care of your password. You can also vary the pattern. – Felix Mar 4 '10 at 13:03
feedback
up vote 1 down vote

One word. Lastpass.com

Its the best single step I ever made in password management and security.

link|improve this answer
feedback
up vote 0 down vote

For years I've used the STRIP program for the Palm (part of why I've stayed with a Palm). I see it's no longer supported, but the tool works well and I've never had problems with it. STRIP keeps the passwords on the Palm in encrypted form and requires a password to access them, so they're secure from others who might get into your Palm, as long as you keep that one password secure.

Having the passwords in something like a Palm allows me to access them even when I don't have Internet access. That may seem like a small thing, but if your connection is down but you still have work to do it becomes a big deal.

As for schemes, I usually use first letters from phrases, songs, or nursery rhymes. Then I modify it with leet speak and some punctuation. For example, the phrase "This is my password!" might become t1mP$.

link|improve this answer
feedback
up vote 0 down vote

There are one combo and one software for you :

  • Keepass + Dropbox
  • Lastpass

They all have the features you request . I'll better use lastpass because it's simple and it works on every system . You don't have to setup anything :)

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.