4 ms·

Not the person you're responding to, but: My keepass database has over 250 entries over the last decade. There's no way I could remember a unique password for e

Not the person you're responding to, but: My keepass database has over 250 entries over the last decade. There's no way I could remember a unique password for each entry. If you could explain how "monthly" is relevant to the discussion, that'd be great.

nixgeek 4y ago
I’m a happy user of 1Password for Families, which I only mention since it means >1 person is storing in our vaults (and 1P isn’t as vulnerable to “my backup has unencrypted URLs stored in it” — one of my main issues with LastPass’ latest breach). Like you we have TONS of credentials (and other supported items), around 2800 vault items in total, some of which we definitely only use once a year, others we use multiple times per day. Probably started using a password manager and some technique to share some vaults around 2010, so also a decade.
- c22 4y ago
  > "... around 2800 vault items in total... " This is absolutely insane to me. The number of people reporting needing access to multiple hundreds or more of required credentials is blowing my mind. If this is the reality of how people are using the internet these days then we desperately need a better cross-platform solution to identity management and authentication than can ever be offered by passwords. These vault programs are sounding more like a horrendous bandaid than the mere unnecessary convenience I viewed them as. If you need to share passwords amongst multiple people I guess I can see some of the appeal of these networked vaults, but it strikes me that even this is a drastically subpar situation that ought to be handled on a deeper architectural level (like with sub-accounts and ACLs).
  - thefurdrake 4y ago
    > This is absolutely insane to me. What's absolutely insane to ME is how consistently your responses seem to ignore that other people have different use cases for passwords. Nobody cares if something seems "insane" to you. It may surprise you to discover that services like these exist, perhaps, because people interact with passwords in a different way than your "I only keep passwords that I use monthly" brain database paradigm.
    - c22 4y ago
      You can't seriously be telling me that managing 2800 secrets for a single "family" isn't evidence of a broken system. Unless GP is doing IT for the actual mafia I stand by my assertion that this is nuts and we ought to consider whether there's a better paradigm we could be pursuing.
      - nixgeek 4y ago
        To whoever is reading this: I am not doing IT for the Mafia. ;) I mean, this is all apples and oranges, but if you could, examine your browser history across all devices as a household going back let's say 10 years. Lots of sites, right? How many did you ever create an account on for whatever reason? Are those all in your vault today? They essentially are for us. To the very best of my knowledge (and there's functionality in 1Password to analyze this, obviously anything not in vaults is invisible to it however) we have no duplicated passwords, anywhere on the internet. To give some examples of how we do use 1Password, in terms of "Online Shopping" (just one of our shared vaults) that has 100's of credentials for everything from Amazon through Walmart and covering whatever we buy online from groceries to ammunition. Tons of more specialist or niche suppliers like Christmas Designers also make you 'Create Account' to have order histories and to be able to track shipments - this one in particular is a great place for garland, lighting and other holiday items, tis the season! 1Password also stores all our rewards programs (i.e. Store Cards, Airline, Hotels). I'd guess we are signed up with 40-50 merchants for some kind of "Rewards" (i.e. Fred Meyer or QFC, and where the ROI for signing up for their program is some items will be $2.49 instead of $4.49 on offer). I have traveled a lot for business and so can't always fly one carrier alliance or stay entirely within one hotel chain, so I guess that's another ~20 (airlines) and ~20 (hotel chains) for you. I'm not going to memorize software licenses (serial numbers or license files for e.g., Bartender for macOS), nor other access tokens (i.e. SSH Keys, API Tokens) to various geekery. Two other things which end up helping a lot, one of which adds lots of vault items: the integration story with Privacy [1] and Fastmail [2]. We've used and loved Privacy for a long time, and this integration stores the unique per-merchant credit card details in a vault. With Fastmail you can create 'Masked Emails' so you've got a unique email for each place you signed up. We've easily rotated both card details and emails on accounts when we find out someone was compromised, and with these integrations we're only rotating that site, not potentially 100+ sites using say the same Chase Sapphire card. So, your own approach may vary, and I see from other comments that you memorize all your accounts (?) and commented on the frequency of access ("monthly") being relevant to you, so I'd assume frequency/recency plays a part, and you duplicate credentials for less important sites or rely on 'Forgot Password' functionality for less used sites? How do you deal with accounts you didn't need in the last 60 days? In any case, 1Password works amazingly for us, and quite a large number of our friends too, although anecdotally they've usually got 100's not 1000's of items in vaults. :) [1] https://blog.1password.com/privacy-virtual-cards/ https://blog.1password.com/privacy-virtual-cards/ [2] https://1password.com/fastmail/ https://1password.com/fastmail/
  - nixgeek 4y ago
    "sub-accounts and ACLs" sounds just as awful to me, if not worse, quite honestly. Imagine managing an "Account" at each of 100's of online merchants and other sites like Netflix, where each has >= 1 "User", and "ACLs" (permissions). I am entirely happy for my family to just have access to the Amazon or Netflix email addresses (logins) and passwords without any of that overhead.
c22 4y ago
Monthly is just a simple test to see if you're actually using these accounts. I'd say start by reconsidering if you need these accounts at all and if you decide you do, go ahead and keep them in a software vault. But I still recommend keeping the ones you use once a month or more in your head. It will be more secure (and possibly more convenient) and if you are using them this frequently it will also be easy to remember them. I'd also posit that these frequently-accessed accounts are likely to be your most important ones, deserving of a little extra security.

nixgeek 4y ago

I’m a happy user of 1Password for Families, which I only mention since it means >1 person is storing in our vaults (and 1P isn’t as vulnerable to “my backup has unencrypted URLs stored in it” — one of my main issues with LastPass’ latest breach). Like you we have TONS of credentials (and other supported items), around 2800 vault items in total, some of which we definitely only use once a year, others we use multiple times per day. Probably started using a password manager and some technique to share some vaults around 2010, so also a decade.

c22 4y ago
> "... around 2800 vault items in total... " This is absolutely insane to me. The number of people reporting needing access to multiple hundreds or more of required credentials is blowing my mind. If this is the reality of how people are using the internet these days then we desperately need a better cross-platform solution to identity management and authentication than can ever be offered by passwords. These vault programs are sounding more like a horrendous bandaid than the mere unnecessary convenience I viewed them as. If you need to share passwords amongst multiple people I guess I can see some of the appeal of these networked vaults, but it strikes me that even this is a drastically subpar situation that ought to be handled on a deeper architectural level (like with sub-accounts and ACLs).
- thefurdrake 4y ago
  > This is absolutely insane to me. What's absolutely insane to ME is how consistently your responses seem to ignore that other people have different use cases for passwords. Nobody cares if something seems "insane" to you. It may surprise you to discover that services like these exist, perhaps, because people interact with passwords in a different way than your "I only keep passwords that I use monthly" brain database paradigm.
  - c22 4y ago
    You can't seriously be telling me that managing 2800 secrets for a single "family" isn't evidence of a broken system. Unless GP is doing IT for the actual mafia I stand by my assertion that this is nuts and we ought to consider whether there's a better paradigm we could be pursuing.
    - nixgeek 4y ago
      To whoever is reading this: I am not doing IT for the Mafia. ;) I mean, this is all apples and oranges, but if you could, examine your browser history across all devices as a household going back let's say 10 years. Lots of sites, right? How many did you ever create an account on for whatever reason? Are those all in your vault today? They essentially are for us. To the very best of my knowledge (and there's functionality in 1Password to analyze this, obviously anything not in vaults is invisible to it however) we have no duplicated passwords, anywhere on the internet. To give some examples of how we do use 1Password, in terms of "Online Shopping" (just one of our shared vaults) that has 100's of credentials for everything from Amazon through Walmart and covering whatever we buy online from groceries to ammunition. Tons of more specialist or niche suppliers like Christmas Designers also make you 'Create Account' to have order histories and to be able to track shipments - this one in particular is a great place for garland, lighting and other holiday items, tis the season! 1Password also stores all our rewards programs (i.e. Store Cards, Airline, Hotels). I'd guess we are signed up with 40-50 merchants for some kind of "Rewards" (i.e. Fred Meyer or QFC, and where the ROI for signing up for their program is some items will be $2.49 instead of $4.49 on offer). I have traveled a lot for business and so can't always fly one carrier alliance or stay entirely within one hotel chain, so I guess that's another ~20 (airlines) and ~20 (hotel chains) for you. I'm not going to memorize software licenses (serial numbers or license files for e.g., Bartender for macOS), nor other access tokens (i.e. SSH Keys, API Tokens) to various geekery. Two other things which end up helping a lot, one of which adds lots of vault items: the integration story with Privacy [1] and Fastmail [2]. We've used and loved Privacy for a long time, and this integration stores the unique per-merchant credit card details in a vault. With Fastmail you can create 'Masked Emails' so you've got a unique email for each place you signed up. We've easily rotated both card details and emails on accounts when we find out someone was compromised, and with these integrations we're only rotating that site, not potentially 100+ sites using say the same Chase Sapphire card. So, your own approach may vary, and I see from other comments that you memorize all your accounts (?) and commented on the frequency of access ("monthly") being relevant to you, so I'd assume frequency/recency plays a part, and you duplicate credentials for less important sites or rely on 'Forgot Password' functionality for less used sites? How do you deal with accounts you didn't need in the last 60 days? In any case, 1Password works amazingly for us, and quite a large number of our friends too, although anecdotally they've usually got 100's not 1000's of items in vaults. :) [1] https://blog.1password.com/privacy-virtual-cards/ https://blog.1password.com/privacy-virtual-cards/ [2] https://1password.com/fastmail/ https://1password.com/fastmail/
- nixgeek 4y ago
  "sub-accounts and ACLs" sounds just as awful to me, if not worse, quite honestly. Imagine managing an "Account" at each of 100's of online merchants and other sites like Netflix, where each has >= 1 "User", and "ACLs" (permissions). I am entirely happy for my family to just have access to the Amazon or Netflix email addresses (logins) and passwords without any of that overhead.

c22 4y ago

Monthly is just a simple test to see if you're actually using these accounts. I'd say start by reconsidering if you need these accounts at all and if you decide you do, go ahead and keep them in a software vault. But I still recommend keeping the ones you use once a month or more in your head. It will be more secure (and possibly more convenient) and if you are using them this frequently it will also be easy to remember them. I'd also posit that these frequently-accessed accounts are likely to be your most important ones, deserving of a little extra security.