5 ms·

Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my

Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?

staticelf 10y ago
Switch to SpiderOak: https://spideroak.com/ https://spideroak.com/
tehbeard 10y ago
Xkcd's correct-horse-battery-staple technique?
arianvanp 10y ago
Check out diceware. Easy technique to memorise a lot of entropy
deleted 10y ago
[deleted]
cm2187 10y ago
Keep your password written on a piece of paper in your wallet, with a few extra characters you need to remember to ignore.
- loup-vaillant 10y ago
  Here's the advanced version, that let you use different, mostly uncorrelated passwords for different services. http://blog.jgc.org/2010/12/write-your-passwords-down.html http://blog.jgc.org/2010/12/write-your-passwords-down.html I have implemented a little program to generate such a square: http://loup-vaillant.fr/projects/password-generator http://loup-vaillant.fr/projects/password-generator Though by now, I find this a little tedious. I'm thinking of using an encrypted password database, protected with a diceware generated password. That way I will be able to copy&paste my passwords instead of typing them by hand.
- jethro_tell 10y ago
  or a few extra characters you need to add. As much as people say this is a bad idea, most of the people you would be trying to keep out, don't have access to your wallet. I did this for a few months for a master password and set everything to forget the password so I used it several times a day. After a little while I can get rid of the paper and have a LONG random password that is committed to memory.
  - cm2187 10y ago
    And the average mugger most likely wouldn't know what to do with a long random string (or multiple). The bank notes next to them are much more interesting.
stephengillie 10y ago
Use 2 factor authentication and rotate both passwords. I have the opposite setup - Dropbox password is random and the password manager (stored inside) is memorized. It would be harsh to lose access, but not unrecoverable.
have_faith 10y ago
All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website. This way I don't ever remember a password, I just remember the system.
- chii 10y ago
  Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...
  - DominikSerafin 10y ago
    What can be better alternative? IMO using something like 1Password/Lastpass is less secure because it then only takes someone to get my master password to get all my other passwords.
    - ntlve 10y ago
      They would also need access to the machine which you have your vault stored on which would be your laptop and your phone and nothing else.
    - Shank 10y ago
      Your master password shouldn't really be something that's going to be in either a dictionary, or brute forcible. Nobody is going to "get" it unless you make it insecure. If you're using their sync services, however (especially LastPass), you're more vulnerable to phishing attacks, and the vault can potentially be stolen and crack attempts run offline. However, both services use a heavy level of encryption that requires the passphrase to unlock, so as long as that's not dictionary based or brute forcible, you're totally fine.
  - fastball 10y ago
    In order to determine the algo have_faith is using, an attacker would probably need a sample size of at least 4 passwords from different sites (at least, my algo definitely would). If an attacker has access to 4 of your passwords in plaintext, you have bigger fish to fry.
gwbas1c 10y ago
As long as your Dropbox password is unique, you're all set.
wepple 10y ago
You can keep 1pass on an iOS device, and auth using fingerprint. Ultimately you're still going to need/want to know the actual underlying passwords to both iOS and 1pass, however.
crummel 10y ago
Are 1Password's files not encrypted? Store it publicly on your web site, email it to your friends, print it out in base64 in a machine-readable font and keep copies pinned on the wall of your cube. You still have to remember one password but at least you're depending on crypto instead of Dropbox's security.
- marco1 10y ago
  Exactly this. Or just store a copy on another device of yours, on a USB flash drive, etc.

staticelf 10y ago

Switch to SpiderOak: https://spideroak.com/ https://spideroak.com/

tehbeard 10y ago

Xkcd's correct-horse-battery-staple technique?

arianvanp 10y ago

Check out diceware. Easy technique to memorise a lot of entropy

deleted 10y ago

[deleted]

cm2187 10y ago

Keep your password written on a piece of paper in your wallet, with a few extra characters you need to remember to ignore.

loup-vaillant 10y ago
Here's the advanced version, that let you use different, mostly uncorrelated passwords for different services. http://blog.jgc.org/2010/12/write-your-passwords-down.html http://blog.jgc.org/2010/12/write-your-passwords-down.html I have implemented a little program to generate such a square: http://loup-vaillant.fr/projects/password-generator http://loup-vaillant.fr/projects/password-generator Though by now, I find this a little tedious. I'm thinking of using an encrypted password database, protected with a diceware generated password. That way I will be able to copy&paste my passwords instead of typing them by hand.
jethro_tell 10y ago
or a few extra characters you need to add. As much as people say this is a bad idea, most of the people you would be trying to keep out, don't have access to your wallet. I did this for a few months for a master password and set everything to forget the password so I used it several times a day. After a little while I can get rid of the paper and have a LONG random password that is committed to memory.
- cm2187 10y ago
  And the average mugger most likely wouldn't know what to do with a long random string (or multiple). The bank notes next to them are much more interesting.

stephengillie 10y ago

Use 2 factor authentication and rotate both passwords. I have the opposite setup - Dropbox password is random and the password manager (stored inside) is memorized. It would be harsh to lose access, but not unrecoverable.

have_faith 10y ago

All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website. This way I don't ever remember a password, I just remember the system.

chii 10y ago
Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...
- DominikSerafin 10y ago
  What can be better alternative? IMO using something like 1Password/Lastpass is less secure because it then only takes someone to get my master password to get all my other passwords.
  - ntlve 10y ago
    They would also need access to the machine which you have your vault stored on which would be your laptop and your phone and nothing else.
  - Shank 10y ago
    Your master password shouldn't really be something that's going to be in either a dictionary, or brute forcible. Nobody is going to "get" it unless you make it insecure. If you're using their sync services, however (especially LastPass), you're more vulnerable to phishing attacks, and the vault can potentially be stolen and crack attempts run offline. However, both services use a heavy level of encryption that requires the passphrase to unlock, so as long as that's not dictionary based or brute forcible, you're totally fine.
- fastball 10y ago
  In order to determine the algo have_faith is using, an attacker would probably need a sample size of at least 4 passwords from different sites (at least, my algo definitely would). If an attacker has access to 4 of your passwords in plaintext, you have bigger fish to fry.

gwbas1c 10y ago

As long as your Dropbox password is unique, you're all set.

wepple 10y ago

You can keep 1pass on an iOS device, and auth using fingerprint. Ultimately you're still going to need/want to know the actual underlying passwords to both iOS and 1pass, however.

crummel 10y ago

Are 1Password's files not encrypted? Store it publicly on your web site, email it to your friends, print it out in base64 in a machine-readable font and keep copies pinned on the wall of your cube. You still have to remember one password but at least you're depending on crypto instead of Dropbox's security.

marco1 10y ago
Exactly this. Or just store a copy on another device of yours, on a USB flash drive, etc.