5 ms·

This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that pas

by ben174 10y ago

This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.

serf 10y ago
honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?
- ben174 10y ago
  Back in 2013 I wasn't using the password generator feature for some reason. I was just using it as a vault for my memorized passwords. A bit silly I realize and now generate passwords.
- deleted 10y ago
  [deleted]
- fencepost 10y ago
  In my case, it's because I still have some very old accounts in there. Accounts that predate not only this password manager (LastPass) but the previous one (KeePass) and which in fact go all the way back to something that started with "Yet Another (YA)" back on a Palm device. I really ought to go through and do some janitorial work in there, but some of those are for sites that actually still exist and for which those logins are likely still valid. I don't care enough about them to go log in on each and change passwords, but I also don't want to simply delete them and leave yet another orphaned account.
  - golf1052 10y ago
    I recently did this after I found a password manager that works with the devices I use. Took me a few hours to remember and track down all the accounts I use. Managed to get close to 70 accounts and even then I missed some. I think it was worth it though.
  - kingosticks 10y ago
    Lastpass can report which sites are sharing the same passwords (and also which are not using a random password generated by it). For some sites it even automates the password changing for you. It doesn't work for all sites (including this one) but it saved me a load of time just recently.
- username223 10y ago
  honest answer: one of those sites is your recovery email, the one way back into your digital life if something goes deeply wrong. It's the password reset email if another site is hacked. It's the "bootstrap myself from some other computer" account if your machine dies or your house burns down. IMHO you should memorize one very strong password for one somewhat-trustworthy site.
  - tesseract 10y ago
    I've struggled with this, the issue to me is by their very nature I want those passwords that can be used for bootstrapping/resetting everything else to be very strong ones. I've settled with making a list, encrypting it with a memorized moderately-strong passphrase, and storing copies (flash drive or base64-on-paper) in a few physically secure locations that probably won't all get destroyed at once. Maybe this is overly paranoid but it wasn't a huge amount of effort, either. At least I am pretty confident the weak links are now the security of those services themselves (and my client computers) and not the passwords.
  - newscracker 10y ago
    > IMHO you should memorize one very strong password for one somewhat-trustworthy site. This would be necessary if one is using a password manager, which is something everyone should use for multiple reasons and benefits. As an alternative, you could also invent a scheme for passwords. Have a prefix, body and suffix for every password. You decide which ones should be static and which ones should be something that's easy to derive just by looking at the website name (part of the name, few letters from specific positions). You can also have different static pieces based on the nature of the site - email vs. bank vs. online store. This may not be as good as using a unique password per site that's a random strong password generated by a password manager, but is easy to remember depending on how you construct it.
djsumdog 10y ago
I hate having a secondary system just to get access to my accounts. I use a password algorithm. This ensures I have a unique, easy to remember (or derive), hard to guess password for every account: http://penguindreams.org/blog/my-accounts-been-hacked-no-it-hasnt/ http://penguindreams.org/blog/my-accounts-been-hacked-no-it-...
- newscracker 10y ago
  It seems like you're getting downvoted (not sure why). I use "password algorithms" like you've blogged about (but very different in nature) to have memorable passwords for some sites. For many other sites in the last several years, I have started moving to creating unique passwords and using a password manager to store and use them.

by ben174 10y ago

serf 10y ago

honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?

ben174 10y ago
Back in 2013 I wasn't using the password generator feature for some reason. I was just using it as a vault for my memorized passwords. A bit silly I realize and now generate passwords.
deleted 10y ago
[deleted]
fencepost 10y ago
In my case, it's because I still have some very old accounts in there. Accounts that predate not only this password manager (LastPass) but the previous one (KeePass) and which in fact go all the way back to something that started with "Yet Another (YA)" back on a Palm device. I really ought to go through and do some janitorial work in there, but some of those are for sites that actually still exist and for which those logins are likely still valid. I don't care enough about them to go log in on each and change passwords, but I also don't want to simply delete them and leave yet another orphaned account.
- golf1052 10y ago
  I recently did this after I found a password manager that works with the devices I use. Took me a few hours to remember and track down all the accounts I use. Managed to get close to 70 accounts and even then I missed some. I think it was worth it though.
- kingosticks 10y ago
  Lastpass can report which sites are sharing the same passwords (and also which are not using a random password generated by it). For some sites it even automates the password changing for you. It doesn't work for all sites (including this one) but it saved me a load of time just recently.
username223 10y ago
honest answer: one of those sites is your recovery email, the one way back into your digital life if something goes deeply wrong. It's the password reset email if another site is hacked. It's the "bootstrap myself from some other computer" account if your machine dies or your house burns down. IMHO you should memorize one very strong password for one somewhat-trustworthy site.
- tesseract 10y ago
  I've struggled with this, the issue to me is by their very nature I want those passwords that can be used for bootstrapping/resetting everything else to be very strong ones. I've settled with making a list, encrypting it with a memorized moderately-strong passphrase, and storing copies (flash drive or base64-on-paper) in a few physically secure locations that probably won't all get destroyed at once. Maybe this is overly paranoid but it wasn't a huge amount of effort, either. At least I am pretty confident the weak links are now the security of those services themselves (and my client computers) and not the passwords.
- newscracker 10y ago
  > IMHO you should memorize one very strong password for one somewhat-trustworthy site. This would be necessary if one is using a password manager, which is something everyone should use for multiple reasons and benefits. As an alternative, you could also invent a scheme for passwords. Have a prefix, body and suffix for every password. You decide which ones should be static and which ones should be something that's easy to derive just by looking at the website name (part of the name, few letters from specific positions). You can also have different static pieces based on the nature of the site - email vs. bank vs. online store. This may not be as good as using a unique password per site that's a random strong password generated by a password manager, but is easy to remember depending on how you construct it.

djsumdog 10y ago

I hate having a secondary system just to get access to my accounts. I use a password algorithm. This ensures I have a unique, easy to remember (or derive), hard to guess password for every account: http://penguindreams.org/blog/my-accounts-been-hacked-no-it-hasnt/ http://penguindreams.org/blog/my-accounts-been-hacked-no-it-...

newscracker 10y ago
It seems like you're getting downvoted (not sure why). I use "password algorithms" like you've blogged about (but very different in nature) to have memorable passwords for some sites. For many other sites in the last several years, I have started moving to creating unique passwords and using a password manager to store and use them.