Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

tldr; How do people manage their myriad passwords safely and easily?

Personally I have about 4 different accounts to supercomputers that are 'high security', 3 different e-mail accounts with sensitive personal information, 2 online bank accounts, maybe 10 online accounts which have access to financial information, and then probably 100 additional accounts to random webpages (etc).

Each of these wants me to have a 'high strength' password, i.e. letters + numbers + symbols + cases - whole words or phrases. The important accounts shouldn't be written down anywhere, and none of them should be duplicates. And finally the supercomputer accounts generally have to be changed every few months.

I'm looking for a system, or procedure that I should be employing to manage, organize, or otherwise deal with all of my passwords. I think this is a topic that would be useful to most people. Perhaps there is no solution that doesn't break one (or more) password good-practice rules.

share|improve this question

2 Answers 2

keepass and lastpass apps come to mind. But they involve you storing the passwords in a portable platform (like a USB key or on your cell phone etc.) and showing you the password, from which point you can type it on the proper location (browsers, the modern ones) have plugins but other apps, requiring passwd autheinticaton, not so much luck.

And there is the mooltipass project at hackaday.com, Link here, but I am not sure what stage this project is, in its lifecycle. At best it is at an infant stage but something you might want to keep in your radar for future use if not immediate.

share|improve this answer

And I must add another, more pragmatic than technical answer here. The passwords for any kind of sensitive information should not be trusted to any application, hardware, software or whatever else. Hardware can be stolen. Software can be hacked. Apps ? Don't even get me started with those. Say, you are a contractor for DoD and were trusted and given access to the mainframe in NORAD. Regardless how complex the rules for this password, the only place you can trust with this password is your brain. If you don't want your bank account to be emptied by a script kiddie, don't store that password anywhere but in your memory. Human brain is amazing and given enough mind jogging exercises, one can remember things that otherwise make no sense to him. So, if you are storing the password for your gaming clan in the browser password cache, that is fine. But anything more sensitive shouldn't belong to any platform for storage but your brain.

Do what I do. Come up with an algorithm. Dates, numbers, names which are important to you, run through a process of chopping and concatenating, generate pretty spiffy passwords and algorithms are easier to remember than random strings, as well as harder to crack by outsiders.

Just my 2 cents

share|improve this answer
    
Random strings are hard to crack. Manipulating important dates and names into a password is actually far less safe than trusting a well-known application to store good passwords. –  Marcks Thomas Mar 12 '14 at 17:08
    
I am not suggesting the use of dates and names directly. My suggestion is to mush them thru a strainer algorithm, rules of which are only known to you. Such as: take the second digit of the street number at my first address, add my college student ID transposed, add my fathers childhood nickname (converted to ascii if we are staying in numeric realm) and the add the digits in my mother's birthday date and append the result to this string. The final product will not make much sense to anyone, even if they know the intrinsic details about your life. –  MelBurslan Mar 12 '14 at 17:15
    
I understand, but I think it's a bad advice because it's hard to gauge how complicated the algorithm should be. If you're confident no human will ever come close to cracking your system, a computer may still be able to do so in seconds. Moreover, you cannot assume the rules are secret. The algorithm could be (partially) broken if a single password is brute forced, stored in plain-text, observed over the shoulder, or if you're spotted consulting an ascii table or if you voluntarily publish it in a comment on Super User. Suddenly, all your passwords are comprimised. –  Marcks Thomas Mar 12 '14 at 22:01
    
I see your point but I am in this field long enough not to disclose my actual password generation algorithm in public forums. This was just a suggestion. Considering the number of irrelevant pieces of information one might have could be practically countless and the methods chosen to mush them can be even much more, anyone with half-a-brain can come up with passwords that are harder to crack by brute force. –  MelBurslan Mar 13 '14 at 1:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.