6 ms·

I keep my passwords in my head. This has worked for over 30 years.

by c22 4y ago

c22 4y ago
I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game? My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc. Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?
- camgunz 4y ago
  As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons: - people forget - you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords - this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because: - you don't store passwords - you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password) - your users can't forget their passwords - it's pretty much just as secure as your email, which is probably gmail, which is fine I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.
  - c22 4y ago
    Your assertion that you need a "system" to remember multiple passwords is simply false. In fact, I generate passwords with a random generator I wrote in python, just like any software "solution". You did touch on one of my secrets, I don't maintain hundreds of superfluous "accounts". I'm not going to count them, but I suspect I'm at around 30. If I don't log into a service for a long time then I just go ahead and transition that to "never" in which case it doesn't matter if I remember the password or not since it's clear I don't need that account anyway. I also use unique logins and emails with each service which I guess is even more to remember. For throwaway accounts and things that really don't matter I use an easier to guess (and crack) leetspeak pw and/or a post-it note. I suspect people who are not techies have even fewer accounts to remember so this may actually work for many (though I agree, not all) of them. Probably more than you give credit. In fact I assume that most non-techies are simply keeping credentials in their memory in which case the best advice is probably just to remind them to use unique ones, at least for their email and their bank... I've also worked help desk and no one ever called to report that everything was hunky dory. Anyway, I appreciate you taking the time to address the issue rather than just leaving another drive-by downvote.
    - camgunz 4y ago
      Yeah I mean, there may be a goldilocks zone of sophisticated enough to remember 30 random strings of text but not sophisticated enough to need to remember 300 random strings of text, and yeah if it works for you that's awesome (I keep thinking I'll try and get my memory back to where it was when I was in college, but I keep forgetting to do it!! :P) And yeah I think the big bad we're working against is people using the same password (or a password with some very small variations that's super easy to guess from a variant) across all their services. I'm sure almost everyone does this, I even know sophisticated engineers who do it, I also do it for accounts I don't care about. "Use a password manager browser extension" is the easiest thing for us former help deskers to tell people, and as long as that person didn't choose LastPass (which you should never have chosen, how many breaches will it take) they'll be in great shape.
- saberience 4y ago
  So you’ve memorized multiple hundred passwords of high complexity and uniqueness? I’m impressed if so but kind of doubtful.
  - c22 4y ago
    So you log into hundreds of unique accounts each month? Why?
    - subjectsigma 4y ago
      Maybe not every month, but having hundreds of unique accounts is quite trivial to do. For example I manage dozens of accounts for friends and family for a variety of reasons. The fact that I don’t log into these accounts every month makes it even harder to remember them. “Just have less accounts so you can remember your passwords!” is not real advice
      - c22 4y ago
        I'll warrant that if you have hundreds of accounts you rarely log in to then it may behoove you to record them somewhere. However in this case I'm not sure a password vault is superior to just keeping them on an encrypted volume on a thumb drive. And I'd still argue its best to keep these rarely-used credentials siloed from your day-to-day passwords, especially if they're being held in trust for someone else (really each client should have their own silo).
        subjectsigma 4y ago
        That’s a good point about siloed credentials, I honestly never thought about that. However I’d say give that the password vault is open-source and can be self-hosted (like Bitwarden) there are many reasons to use it over an encrypted flash drive. It can be automatically backed up easily, is supported on every device (including mobile) via a web browser. It also includes useful tools like a configurable password generator, versioning, and auto fill. For the average person that is much better than an encrypted flash drive volume, which IME are platform locked (LUKS doesn’t work on Windows, Bitlocker doesn’t work on Linux), are much less convenient, and are much more fragile. Of course, use whatever works best for you, I don’t know your situation.
- jcpham2 4y ago
  I do the same. I have iterations written down in a safe but my family will have a hard time accessing my digital identity when I’m gone
ls15 4y ago
How many?
- c22 4y ago
  Around 30.
  - dymk 4y ago
    That’s too few to be secure by about an order of magnitude, for me

I keep my passwords in my head. This has worked for over 30 years.

by c22 4y ago

I keep my passwords in my head. This has worked for over 30 years.

c22 4y ago

I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game? My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc. Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?

camgunz 4y ago
As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons: - people forget - you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords - this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because: - you don't store passwords - you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password) - your users can't forget their passwords - it's pretty much just as secure as your email, which is probably gmail, which is fine I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.
- c22 4y ago
  Your assertion that you need a "system" to remember multiple passwords is simply false. In fact, I generate passwords with a random generator I wrote in python, just like any software "solution". You did touch on one of my secrets, I don't maintain hundreds of superfluous "accounts". I'm not going to count them, but I suspect I'm at around 30. If I don't log into a service for a long time then I just go ahead and transition that to "never" in which case it doesn't matter if I remember the password or not since it's clear I don't need that account anyway. I also use unique logins and emails with each service which I guess is even more to remember. For throwaway accounts and things that really don't matter I use an easier to guess (and crack) leetspeak pw and/or a post-it note. I suspect people who are not techies have even fewer accounts to remember so this may actually work for many (though I agree, not all) of them. Probably more than you give credit. In fact I assume that most non-techies are simply keeping credentials in their memory in which case the best advice is probably just to remind them to use unique ones, at least for their email and their bank... I've also worked help desk and no one ever called to report that everything was hunky dory. Anyway, I appreciate you taking the time to address the issue rather than just leaving another drive-by downvote.
  - camgunz 4y ago
    Yeah I mean, there may be a goldilocks zone of sophisticated enough to remember 30 random strings of text but not sophisticated enough to need to remember 300 random strings of text, and yeah if it works for you that's awesome (I keep thinking I'll try and get my memory back to where it was when I was in college, but I keep forgetting to do it!! :P) And yeah I think the big bad we're working against is people using the same password (or a password with some very small variations that's super easy to guess from a variant) across all their services. I'm sure almost everyone does this, I even know sophisticated engineers who do it, I also do it for accounts I don't care about. "Use a password manager browser extension" is the easiest thing for us former help deskers to tell people, and as long as that person didn't choose LastPass (which you should never have chosen, how many breaches will it take) they'll be in great shape.
saberience 4y ago
So you’ve memorized multiple hundred passwords of high complexity and uniqueness? I’m impressed if so but kind of doubtful.
- c22 4y ago
  So you log into hundreds of unique accounts each month? Why?
  - subjectsigma 4y ago
    Maybe not every month, but having hundreds of unique accounts is quite trivial to do. For example I manage dozens of accounts for friends and family for a variety of reasons. The fact that I don’t log into these accounts every month makes it even harder to remember them. “Just have less accounts so you can remember your passwords!” is not real advice
    - c22 4y ago
      I'll warrant that if you have hundreds of accounts you rarely log in to then it may behoove you to record them somewhere. However in this case I'm not sure a password vault is superior to just keeping them on an encrypted volume on a thumb drive. And I'd still argue its best to keep these rarely-used credentials siloed from your day-to-day passwords, especially if they're being held in trust for someone else (really each client should have their own silo).
      - subjectsigma 4y ago
        That’s a good point about siloed credentials, I honestly never thought about that. However I’d say give that the password vault is open-source and can be self-hosted (like Bitwarden) there are many reasons to use it over an encrypted flash drive. It can be automatically backed up easily, is supported on every device (including mobile) via a web browser. It also includes useful tools like a configurable password generator, versioning, and auto fill. For the average person that is much better than an encrypted flash drive volume, which IME are platform locked (LUKS doesn’t work on Windows, Bitlocker doesn’t work on Linux), are much less convenient, and are much more fragile. Of course, use whatever works best for you, I don’t know your situation.
jcpham2 4y ago
I do the same. I have iterations written down in a safe but my family will have a hard time accessing my digital identity when I’m gone

ls15 4y ago

How many?

c22 4y ago
Around 30.
- dymk 4y ago
  That’s too few to be secure by about an order of magnitude, for me