evan_tech -- password management

11:30 pm, 22 Feb 06

password management

I have all these different passwords for various sites. Some I don't especially care about, but others (banking in particular) are important enough to use strong passwords that are distinct. But how can I remember them all? What do you use? I've considered getting e.g. a usb pen drive and encrypting that, but that means there's a single point of failure to either theft or just plain losing it somewhere...

caladri	I've always wanted to switch to having one password which nobody knew and using something like old DES-CRYPT to encrypt that concatenated with the name of the site the password is for, or something like that, and never store the actual password for the site or the actual password in my head, but greatly reduce the number of passwords to remember.
reply to this

evan	Here's a paper about the approach. (They point out that if your hashing function is cheap and the combination function is known, the master password can be brute-forced if someone steals one of the site-specific passwords. They try to addresss this and other issues.)
reply to this

caladri	I'd planned to use a non-known (i.e. personal, non-obvious) hashing function, of a unique identifier for the site and the password itself. That means you have to know or guess both of those, their order, and the operation of the hash function. I'm relatively comfortable with that level of security.
reply to this

herbie non-known == security through obscurity? I dunno - unless you're a cryptographer/cryptanalist, I feel like rolling your own is dangerous.

reply to this

idealisms	Skimming through that paper, the brute force attack argument seems weak. They make it sound easy by assuming there are only lower case letters in your password. Even if you use a weak hash (hmac at 10^6/sec) and if you assume upper case, lower case and numbers (no punctuation), a 10 character password would take about 26614 years to brute force.
reply to this

decklin ooh, thanks. will read later. I'm doing this with SHA-1 at the moment.

reply to this

eaterofhands I use a variant of the encrypted pen drive idea.

reply to this

jwz

For most sites, the ones I don't really care about, I just use the same password everywhere. That includes online stores, since A) most stores will only let you ship to your billing or shipping address anyway, and B) even if someone got my CC number somehow, I'm only liable for like $50 or something, so who cares.

For things I care more about, like my bank, I have random passwords and just let MacOS remember those passwords in my keychain, and assume that if keychain ever gets scorched, that just means ten minutes of messing around with the web sites' password recovery mechanism. (Since I do online banking no more often than once a month, I never need to know that PW when I'm not at home.)

Anyway, are you sure you need to use strong passwords for your banks, and different ones for each? Do crooks defraud banks by guessing passwords? I doubt it; I think they do it by walking off with bank employees' laptops, or by dumpster-diving receipts. And if someone uses your online banking, are you liable?

I don't know the answers to these questions, but I suspect it's like credit cards, and it's the banks' problem and not yours.

reply to this

evan	Those are all very good points. I'm glad I asked this! (I sorta suspect the main attack vector of theives is based on the password recovery you mention: the sorts of questions the bank asks me before sending my password are scarily easy for someone else to find the answers to. Thankfully, I don't have much money so I don't think I'm as much of a target.)
reply to this

jwz	I don't actually remember how my bank's pw recovery works, but a pretty common recovery mechanism is to email you a long url, and when you click that URL, you can type in a new password. So that requires that someone intercept your email, which raises the required skill level quite a bit.
reply to this

halkeye	crooks defraud banks by finding peices of your id and claiming that they are you and getting the bank to reset your online password. so what your password actually is means nothing.
reply to this

naruto_nerd

i use the same password for stupid things like delicious, bank passwords i actually commit to memory. semi-important password, sometimes i write them down and put the paper into into my wallet.

i'd read somewhere (was it freakonomics? anyway) that most crooks steal passwords and account info by the thousands straight from the bank; not by hacking passwords. I think having a difficult password is more for deterring the nosy ex-boyfriend/frenemy/mother in law /whatever singular malicious entity that's not a professional crook. My bank info is probably in some crook's laptop already.

reply to this

flipzagging Pen and paper in a safe place, just like Bruce Schneier.

reply to this

edm

I have three strategies depending on the "value" of the thing the password is protecting.

For very low value things (eg, access to random subscribe-to-read websites) I let my web browser remember it (and do step two, below, just in case). For mailman lists and the like I just have a "lists" folder with all the subscription gunk.

For intermediate things, I store them on my Palm in Keyring (http://gnukeyring.sourceforge.net/).

For significantly important things (ssh/gpg passphrases, banking stuff, passphrase to the keyring) I just remember them. Which works only if I use them regularly (I came pretty close to forgetting the details of a couple of these at one point by not using them for several weeks).

My web browser config and my Palm are both backed up, which eliminates the single point of failure. If the web browser config is stolen, then nothing critical is lost. If the Palm is stolen I figure the keyring encryption (3DES) and passphrase is strong enough for me to have time to change anything that matters before it gets broken.

Essentially all my passwords these days are randomly generated. Especially for ones where my web browser is remembering them so I don't have to, they're straight out of pwgen or similar.

If I were doing it again, and didn't have a Palm handy (I'm still using the one I bought 7 years ago), I'd probably use a USB keyring and GPG. Or go back to a pen and paper, carried with me (which I did for about the 10 years prior to getting the Palm). But I was finding a pen and paper didn't scale to many dozens of different random passwords.

Ewen

reply to this

Anonymous

reply to this
- legolas Rent a little vault at a bank? Shouldn't cost all that much, and you can put lots of other valuables in...
  
  reply to this
  - evan But then you have to visit the bank when you need a password...
    
    reply to this
    - legolas Most vaults I know work with a key! (And if you were to forget where you rented one, I guess you'd just have to wait for the monthly bill ;-)
      
      reply to this
Anonymous DIY PDA steganography

reply to this

solri	I have passwords in Lojban or Sanskrit - easy to remember for me, but unlikely to succumb to a simple dictionary attack. And I always add punctuation if allowed. Come to think of it, if the service provider allows punctuation in passwords, then one of your favourite lines in Perl would be good ;-)
reply to this

herbie	non-known == security through obscurity? I dunno - unless you're a cryptographer/cryptanalist, I feel like rolling your own is dangerous.
reply to this

decklin	ooh, thanks. will read later. I'm doing this with SHA-1 at the moment.
reply to this

eaterofhands	I use a variant of the encrypted pen drive idea.
reply to this

flipzagging	Pen and paper in a safe place, just like Bruce Schneier.
reply to this

legolas	Rent a little vault at a bank? Shouldn't cost all that much, and you can put lots of other valuables in...
reply to this

evan	But then you have to visit the bank when you need a password...
reply to this

legolas	Most vaults I know work with a key! (And if you were to forget where you rented one, I guess you'd just have to wait for the monthly bill ;-)
reply to this

Anonymous	DIY PDA steganography
reply to this