Passwords In A Paperless World

[belizesailor]

Originally Posted by Suijin

I have two algorithms for all of my passwords. One is for passwords I don't change often or at all, the other for those I change monthly (finances, email, identity stuff). It's easier for me than storing them somewhere with cryptic hints.

I do the same. One "algorythm" for things of less security concern and another for higher concern things.

[maxingout]

Wow.

Lots to think about in this thread. I will have to research all these methods to see what works the best for me.

With all the hacking that is going on, the digital solutions seem less secure than they were a few years ago. In the past two years, I have had my personal information hacked in the federal government, my credit agency report, and yahoo just to name a few.

If a master digital password fails and blocks access to all the other passwords, that would be a fairly challenging situation to unravel if you were in Bongo Congo. I would think some type of a paper back up would be required in the event of a digital disaster of some sort.

Thanks for all the recommendations and suggestions. More study definitely necessary to sort this one out.

[john61ct]

Originally Posted by belizesailor

Yes, complex passwords are self defeating I think, because how people remember them...they write them down! Totally defeating the purpose.

No, you use a password manager.

I've never kept a written password note in 40 years of professional ICT work.

[senormechanico]

Originally Posted by sailorboy1

and what do you do when the site requires capital letters and special characters

Add whatever you like? like !+*?

[john61ct]

Originally Posted by maxingout

If a master digital password fails and blocks access to all the other passwords, that would be a fairly challenging situation to unravel if you were in Bongo Congo. I would think some type of a paper back up would be required in the event of a digital disaster of some sort.

No.

Stored with strong encryption and sync'd across all your devices **and** available via the web.

Seriously just use LastPass.

If you also want to sent encrypted emails of each one to your lawyer to print out and store in a safety deposit box, go for it.

But you'll never need anything but LastPass.

[Dsanduril]

One other security tip, do not answer password recovery questions truthfully! Too much of that can now be found online. Mother's maiden name is a joke. So is the name of your elementary school, or your high school, or...

Use a nonsensical answer you can remember.

Q. "Make and model of your first car?"
A. "Tie-dyed rutabaga"

You do need to come up with a way of remembering your answers, but that's modern life. One method, less secure than nonsense, is to swap answers:

Q: "Mother's maiden name?
A: "Ford Pinto"

Q: "Make and model of first car?"
A: "Miss Goodnight"

Find something that works for you, but above all don't use answers that can be found by digging around on Facebook or Ancestry.com

[leboyd]

I store mine in a password protected excel spreadsheet on Dropbox. I can get to the file from my computer, iPad or iPhone. I have a random generated password that I can remember from repetition and that is the password on the file.

Each line stores the name of the site, the site address, the password, any pin or additional questions that I had to answer, etc.

This makes it at least two hacks to get to the file. One for any of my devices or Dropbox and one for the file.

[Dsanduril]

Originally Posted by john61ct

...Stored with strong encryption and sync'd across all your devices **and** available via the web.

Seriously just use LastPass.

Ahhh, that's the beauty of internet forums, I couldn't disagree more. But we each have our opinions and our reasons. As recently as this March Lastpass warned users to avoid using their system while they fixed vulnerabilities.

I prefer a local only database on a thumb drive. Nothing stored on my computer (in case it gets stolen). Double encrypted (the drive and then the database itself - in case the drive gets stolen). Backed up to a separate thumb drive stored safely.

Is it as convenient as LastPass? Not in a million years. It's complicated and clunky by comparison but offers fewer points of failure. To each his own, you have to evaluate your risk profile and your comfort with the various solutions.

[belizesailor]

Originally Posted by john61ct

No, you use a password manager.

I've never kept a written password note in 40 years of professional ICT work.

Niether have I, but the average Joe is likely to write them down. Many hacks are not due to technical cleverness but poor security measures.

[john61ct]

Yes nothing is perfectly secure, but for average users, it **does have to be** very convenient.

[Bruce K]

You can write them down in cypher. Choose a 10 letter word with no repeated letters eg PATHFINDER then write numbers under each letter either 0 to 9 or 9 to 0. p a t h f i n d e r the simply write down the opposite symbol. Never
1 2 3 4 5 6 7 8 9 0 write the word or direction of numbers. Use upper case o for 0 , 1 for i or I, $ for S, 8 for B etc. Just make it up yourself, and dont write down any clues

[StuM]

I always keep my passwords encrypted using ROT13.
For security, I encrypt them twice.

[john61ct]

Cute! 8-)

[CaptTom]

Storing all your passwords in a cloud-based system just doesn't seem to make sense nowadays.

Look at the hacks which have made the news lately. Equifax. DOD. The list goes on. A password storage server has GOT to be like the holy grail for hackers. Surely they are trying hard to hack one. And are these companies really putting the necessary resources into defense?

I can't answer that, so the whole idea is a non-starter for me.

[sailorboy1]

Originally Posted by senormechanico

Add whatever you like? like !+*?

Which leads us full circle on how to keep track of those