46 ms·

I have couple of ways of dealing with the problem. -- Pen and paper? It is still a thing and cannot be stolen online. -- If you are afraid your family will ac

I have couple of ways of dealing with the problem. -- Pen and paper? It is still a thing and cannot be stolen online. -- If you are afraid your family will access it without your knowledge, use tamper evident bag and a notepad to make notes of bag serial numbers. This prevents anybody from accessing it without your knowledge. -- Split the password into components so that even if somebody gets access to the piece of paper with the password they still can't log in. I make a note of the variable part of the password and remember a different prefixes/suffixes. I use different prefixes/suffixes for different classes of accounts. For most critical accounts I don't reuse anything. -- Use hardware (yubikeys) as second factor, to lessen pressure on the password. Unfortunately almost nobody implements these well. In most cases it is possible to turn off the second factor without presenting second factor which basically nullifies the value of it. If you use second factor on a site that implements it well, remember to have MULTIPLE copies of it. Keep it in triplicate, one with you, one in tamper evident bag and one offsite.

StavrosK 6y ago
Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.
- swiley 6y ago
  You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.
  - CarelessExpert 6y ago
    Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android + browser plugins + syncthing. The idea of storing my passwords in someone else's cloud gives me the heebie jeebies...
    - jjav 6y ago
      If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secure.
      - jfrunyon 6y ago
        > A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. A browser is too complex but an OS and SSH aren't? There are vulnerabilities in both disclosed regularly.
        cutemonster 6y ago
        Different types of vulnerabilities, not that much comparable
        jjav 6y ago
        > A browser is too complex but an OS and SSH aren't? Yes, most certainly. A browser is running adversarial third party code all the time as a matter of course. While browsers do a good job at isolating, expecting this to be perfect is way too fragile for a security critical requirement like putting all passwords in one basket. An isolated and minimized OS install, much easier to harden. Never runs any code you don't know about.
      - EVa5I7bHFq9mnYK 6y ago
        Not sure I can call clipboard a very secure communication protocol.
        cutemonster 6y ago
        If your OS is owned (hostile apps have access to the clipboard), you're doomed anyway? You can use different computers / VMs
  - bosie 6y ago
    No notepad for me unfortunately. how do you use your setup on mobile?
    - swiley 6y ago
      I have a hard time imagining getting any useful (maybe I could review PRs?) work done on a smartphone, also my company didn't give me one and both they and I have a strict policy of not mixing personal and work devices.
      - CarelessExpert 6y ago
        Okay, but what about your personal accounts? Do you just not use them on your phone? Manually key in passwords while looking at them on a PC?
  - Too 6y ago
    They don't rely on transferring the password via an insecure channel - your clipboard. Other applications can sniff the clipboard, you might accidentally copy another of your credentials into website or you might forget to clear it after use and then later accidentally paste it into an irc-channel. There is also risk of visually exposing the password in the text editor, either to someone else in the room, screen sharing or screenshot from another malicious app. A bit into the tinfoil-hat side, but it's passwords we are talking about after all.
    - atat7024 6y ago
      Malicious JavaScript can sniff the clipboard.
jobigoud 6y ago
Pen and paper doesn't work when you have hundreds of 20-char good passwords and it doesn't work for backups if you regularly create new ones. You need search and you need to sync the new entries to offsite backup as they are created.

StavrosK 6y ago

Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.

swiley 6y ago
You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.
- CarelessExpert 6y ago
  Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android + browser plugins + syncthing. The idea of storing my passwords in someone else's cloud gives me the heebie jeebies...
  - jjav 6y ago
    If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secure.
    - jfrunyon 6y ago
      > A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. A browser is too complex but an OS and SSH aren't? There are vulnerabilities in both disclosed regularly.
      - cutemonster 6y ago
        Different types of vulnerabilities, not that much comparable
      - jjav 6y ago
        > A browser is too complex but an OS and SSH aren't? Yes, most certainly. A browser is running adversarial third party code all the time as a matter of course. While browsers do a good job at isolating, expecting this to be perfect is way too fragile for a security critical requirement like putting all passwords in one basket. An isolated and minimized OS install, much easier to harden. Never runs any code you don't know about.
    - EVa5I7bHFq9mnYK 6y ago
      Not sure I can call clipboard a very secure communication protocol.
      - cutemonster 6y ago
        If your OS is owned (hostile apps have access to the clipboard), you're doomed anyway? You can use different computers / VMs
- bosie 6y ago
  No notepad for me unfortunately. how do you use your setup on mobile?
  - swiley 6y ago
    I have a hard time imagining getting any useful (maybe I could review PRs?) work done on a smartphone, also my company didn't give me one and both they and I have a strict policy of not mixing personal and work devices.
    - CarelessExpert 6y ago
      Okay, but what about your personal accounts? Do you just not use them on your phone? Manually key in passwords while looking at them on a PC?
- Too 6y ago
  They don't rely on transferring the password via an insecure channel - your clipboard. Other applications can sniff the clipboard, you might accidentally copy another of your credentials into website or you might forget to clear it after use and then later accidentally paste it into an irc-channel. There is also risk of visually exposing the password in the text editor, either to someone else in the room, screen sharing or screenshot from another malicious app. A bit into the tinfoil-hat side, but it's passwords we are talking about after all.
  - atat7024 6y ago
    Malicious JavaScript can sniff the clipboard.

jobigoud 6y ago

Pen and paper doesn't work when you have hundreds of 20-char good passwords and it doesn't work for backups if you regularly create new ones. You need search and you need to sync the new entries to offsite backup as they are created.