ShyWriter Posted March 8, 2011 ID:397852 Share Posted March 8, 2011 Ask Ars: Where should I store my passwords? By Casey Johnston | Last updated about 24 hours ago Ask Ars was one of the first features of the newly born Ars Technica back in 1998. And now, as then, it's all about your questions and our community's answers. Each week, we'll dig into our bag of questions, answer a few based on our own know-how, and then we'll turn to the community for your take. To submit your own question, see our helpful tips page. Question: What are the best practices when using a password-keeping service, and what are the merits and disadvantages of local vs. cloud-based password storage? With every website requiring users to register a password-protected account to see its content, password management systems have become very popular. We probably don't need to tell you that one of the most popular strategies for managing passwords Link to post Share on other sites More sharing options...
ThexDarksider Posted March 8, 2011 ID:397858 Share Posted March 8, 2011 The only password storage system that's secure enough is your brain, except it's possibly prone to data corruption. But if you use a password every day (or every few days), chances are very low that you'll forget it. Some of my passwords are over 35 characters long (A-Z, a-z, 0-9 and symbols) and I remember them all, just because I use them very often. Link to post Share on other sites More sharing options...
ShyWriter Posted March 9, 2011 Author ID:397903 Share Posted March 9, 2011 The only password storage system that's secure enough is your brain, except it's possibly prone to data corruption. But if you use a password every day (or every few days), chances are very low that you'll forget it. Some of my passwords are over 35 characters long (A-Z, a-z, 0-9 and symbols) and I remember them all, just because I use them very often.Youth has its advantages when it comes to memory. I'm 67 and sometimes forget between getting out of my chair, in my home office, and arriving in the next room I was headed for, I have no idea of what I was going to do. Most times, walking back and starting over again, "jogs" my memory.. My wife and I go through a 4-pak of post-it notes every few weeks as we write reminders about so many things. If I could have a third wish, after one and two being wealth and health, it'd be for a "photographic" memory. ~Shy Link to post Share on other sites More sharing options...
DarkSnakeKobra Posted March 9, 2011 ID:397908 Share Posted March 9, 2011 I often don't remember after 10 minutes. Got back after a long weekend and I couldn't remember how to unlock my safe. Fortunately it came with an emergency key so I can just open and reset it. Link to post Share on other sites More sharing options...
ThexDarksider Posted March 9, 2011 ID:397963 Share Posted March 9, 2011 Youth has its advantages when it comes to memory. I'm 67 and sometimes forget between getting out of my chair, in my home office, and arriving in the next room I was headed for, I have no idea of what I was going to do.Oh I know what you mean. My grandparents often call me by my uncle's name and take a while to realize it. lolIf I could have a third wish, after one and two being wealth and health, it'd be for a "photographic" memory. I don't have photographic memory either. I just have a thing for numbers. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 9, 2011 Root Admin ID:397983 Share Posted March 9, 2011 I've been using KeePass Password Safe {in the list above} for many years now and have over 1,800 passwords stored. Excellent program and highly recommended. Link to post Share on other sites More sharing options...
ShyWriter Posted March 9, 2011 Author ID:398076 Share Posted March 9, 2011 I use the Secure Login extension for Firefox in conjunction with KeyScrambler personal which works well for sites that don't allow one to store passwords; I use Paste Email Plus, another Firefox extension to store user-names and passwords for those sites which I can then just "paste" into the text input boxes. Since my bank uses Trusteer Rapport, I use the home user companion (along with Online Armor's "banking mode") for business there.I'll have to take a look at the one you use Ron, http://keepass.info/ . Sounds interesting.. Forget that - you have to be a friggin' IT professional to use the darn thing. I'll stay with what I have..Steve Link to post Share on other sites More sharing options...
ShyWriter Posted March 9, 2011 Author ID:398113 Share Posted March 9, 2011 Oh I know what you mean. My grandparents often call me by my uncle's name and take a while to realize it. lolI don't have photographic memory either. I just have a thing for numbers. Me too.. the more numbers after the $$ the better - if it's coming my way, that is.. If it's going out, that's different. Link to post Share on other sites More sharing options...
Guest Code Hunter Posted March 9, 2011 ID:398125 Share Posted March 9, 2011 Youth has its advantages when it comes to memory. I'm 67 and sometimes forget between getting out of my chair, in my home office, and arriving in the next room I was headed for, I have no idea of what I was going to do. Most times, walking back and starting over again, "jogs" my memory.. My wife and I go through a 4-pak of post-it notes every few weeks as we write reminders about so many things. If I could have a third wish, after one and two being wealth and health, it'd be for a "photographic" memory. ~ShyDon't believe all this nonsense from Shy. He stays logged on to everything because he can't remember his passwords, Got to pick @ ya Shy!!! Link to post Share on other sites More sharing options...
ShyWriter Posted March 9, 2011 Author ID:398131 Share Posted March 9, 2011 Don't believe all this nonsense from Shy. He stays logged on to everything because he can't remember his passwords, Got to pick @ ya Shy!!!It works! And such a time-saver as well.. Link to post Share on other sites More sharing options...
ThexDarksider Posted March 9, 2011 ID:398177 Share Posted March 9, 2011 Me too.. the more numbers after the $$ the better - if it's coming my way, that is.. If it's going out, that's different. lol, I see what you mean. Yeah, it's probably a good thing. I personally don't like having lots of money, enough to cover the basic expenses... although what I see as basic some see as insane. hahaAbout the passwords, well, I have to say that I do use the browser's password saving feature on my phone for some sites, but that's because they're very complex (all kinds of symbols) and take forever to enter on the phone so it's actually more secure to keep them stored. I log in manually on my home PC every time on those same sites. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 10, 2011 Root Admin ID:398303 Share Posted March 10, 2011 So you don't like the KeePass eh Steve. Then I guess you wouldn't like my main password to open it either. Currently 32 characters but I change it once a month too.Is a PITA at times when you're in a hurry to find a password. Link to post Share on other sites More sharing options...
Relics Posted March 12, 2011 ID:399277 Share Posted March 12, 2011 Realistically, 2-factor (something you have/something you know) are about the most secure methods possible. These extend beyond biometrics as access methods primarily becuase most biometrics are simply single-factor (something you have; iris, finger, voice, etc). The problem is that regardless of how you access a password storage program the program itself is likely problematic in general. Look to PCI rules about not storing CC numbers in a single database, breaking/chunking data, and having a program that hashs multiple routines over a password and the resulting hashes to make rainbow table attacks pointless (or require the yet-realized quantum computer). Bottom line, nothing like that exists so the decision will come down to what you value most about securing the password and the programs that offer similar features. None really exist that I'd be willing to use - so passwords are left trapped in the mind only. Link to post Share on other sites More sharing options...
ShyWriter Posted March 12, 2011 Author ID:399296 Share Posted March 12, 2011 Realistically, 2-factor (something you have/something you know) are about the most secure methods possible. These extend beyond biometrics as access methods primarily becuase most biometrics are simply single-factor (something you have; iris, finger, voice, etc). The problem is that regardless of how you access a password storage program the program itself is likely problematic in general. Look to PCI rules about not storing CC numbers in a single database, breaking/chunking data, and having a program that hashs multiple routines over a password and the resulting hashes to make rainbow table attacks pointless (or require the yet-realized quantum computer). Bottom line, nothing like that exists so the decision will come down to what you value most about securing the password and the programs that offer similar features. None really exist that I'd be willing to use - so passwords are left trapped in the mind only.Say what? Link to post Share on other sites More sharing options...
Relics Posted March 12, 2011 ID:399329 Share Posted March 12, 2011 Well...ummm...Not sure where I went wrong on that reply... I started off by talking about the credentials needed to access the passwords you've stored. Anything less than 2-factor is probably something attackable by brute-force. So, I won't assume anything here...http://en.wikipedia.org/wiki/Two-factor_authenticationMost common implementation is RSA SecureID cards. You need a PIN, plus a auto-rotating time-based code (something you have, the card, something you know, the PIN).I guess the biggest concern I would have as a security-person is that the passwords are still stored in a single place by all the software I've ever seen. PCI compliance (credit card industry requirements) have something going for them by requiring key data be split on completely different systems. Compromising any 1 piece doesn't reveal enough to provide any good data...but I'm sort of out on the extreme maybe on this stuff. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 13, 2011 Root Admin ID:399351 Share Posted March 13, 2011 Yes I think you're a bit on the too complex for most readers here. If you need to be that secure then nothing on the computer is really secure enough. However the reality of even reading the mind is probably not too far off either so even that secure safe will be in danger before not too long. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now