4 ms·

- Convincing/forcing their users to use separate passwords per system. I have to disagree that this one is really a best practice at all. I have dozens of dif

- Convincing/forcing their users to use separate passwords per system. I have to disagree that this one is really a best practice at all. I have dozens of different accounts on different computer systems, if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible. With that said, I absolutely think passwords on critical systems must be unique and strong. But I have maybe three systems I consider critical and dozens that not. My bank password for instance is unique and long. But I am more worried about being able to remember my passwords than whether or not someone who gets into the account I use to play Go online can also get into the account I use to play chess online.

sigil 16y ago
> I have to disagree that this one is really a best practice at all. I have dozens of different accounts on different computer systems, if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible. Yes, it's a pain in the ass (at present), but yes, you should be using different passwords for everything, and pubkey authentication where possible. The problem of maintaining an encrypted master password list for many different accounts is just a technical one. It will be solved. Keyring managers already do this. I noticed the latest Chrome linux builds use the desktop keyring manager now for saved passwords, rather than storing them unencrypted in the browser's password store. Personally, until these keyring managers are mature enough, I use a few simple scripts: one which generates a new semi-pronounceable password with random chars, one that adds a new account to a gpg-encrypted master password file, and one that queries the gpg-encrypted master password file when I've forgotten a password to an account.
- timwiseman 16y ago
  You make good points and I think I may have to work more on using more distinct passwords. Though, as you alude, this will become easier as keyring managers mature. I am also hoping that as security technology matures more places will move to forms for two factor authentication.
stcredzero 16y ago
if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible. There are a variety of good password vault programs out there. I keep my passwords in a KeePass 1 file on Dropbox. I can run Keepass on Windows, Linux, OS X, and my iPhone and iPad. There are a variety of low-cost and free options that are about this good or better. Sometime, I'll be working on a Keepass compatible iPhone program that can access Dropbox directly.

sigil 16y ago

> I have to disagree that this one is really a best practice at all. I have dozens of different accounts on different computer systems, if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible. Yes, it's a pain in the ass (at present), but yes, you should be using different passwords for everything, and pubkey authentication where possible. The problem of maintaining an encrypted master password list for many different accounts is just a technical one. It will be solved. Keyring managers already do this. I noticed the latest Chrome linux builds use the desktop keyring manager now for saved passwords, rather than storing them unencrypted in the browser's password store. Personally, until these keyring managers are mature enough, I use a few simple scripts: one which generates a new semi-pronounceable password with random chars, one that adds a new account to a gpg-encrypted master password file, and one that queries the gpg-encrypted master password file when I've forgotten a password to an account.

timwiseman 16y ago
You make good points and I think I may have to work more on using more distinct passwords. Though, as you alude, this will become easier as keyring managers mature. I am also hoping that as security technology matures more places will move to forms for two factor authentication.

stcredzero 16y ago

if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible. There are a variety of good password vault programs out there. I keep my passwords in a KeePass 1 file on Dropbox. I can run Keepass on Windows, Linux, OS X, and my iPhone and iPad. There are a variety of low-cost and free options that are about this good or better. Sometime, I'll be working on a Keepass compatible iPhone program that can access Dropbox directly.