3 ms·

What do you advise instead for non-technical people? No password manager sounds like an awful idea, who can memorize all their passwords? How can I keep passw

What do you advise instead for non-technical people? No password manager sounds like an awful idea, who can memorize all their passwords? How can I keep passwords on 2 computers, an iPhone and iPad all in sync?

christophilus 3y ago
You can keep a physical password book. For someone to get it, they need to physically steal it. If you keep it at home in a fairly safe location, it seems fine to me. If someone breaks into my home, they’ve got it. But that’s not a threat model that scales, so it’s not a major concern to me.
- jasode 3y ago
  >You can keep a physical password book. [...] If you keep it at home in a fairly safe location, But people are often away from home and want to log into websites and apps from their smartphone. A physical password book sitting at home is useless for that very common scenario. That "login from anywhere" is the typical motivation of gp's comment: "How can I keep passwords on 2 computers, an iPhone and iPad all in sync?"
  - jrm4 3y ago
    Right, and instead of companies promising safety they can't deliver, it would be better to just be honest about the fact that it is hard. And again, to take it a level further -- I would absolutely use a company's software under one, and only one condition -- indemnity/warranty. Any company that is willing to go "If you get breached, we will pay for the harm" can absolutely take my money.
throw__away7391 3y ago
I have a system known only to me for assigning passwords based on things like the color of the company's logo and the number of vowels in their name. I have a complex and unique password for every site, I don't have to "remember" them because I can recreate them on the fly. This works really well imo, the main hiccup is companies that force you to change your password every x days and don't let you reuse old passwords.
- r_hoods_ghost 3y ago
  Until the company changes their logo...
  - juahan 3y ago
    Or one is cracked and the others are easy to figure out. Because these types of algorithms tend to feel complicated, but are not as you still have to remember it.
- noman-land 3y ago
  This technique sounds great but has some challenges. Firstly, companies change logos, change names, force password resets or your password will leak in a breach. How does this system accommodate those scenarios? Also, once a few of your passwords are in data breaches, anyone who wants to target you can derive your admittedly less complex formula. It is not out of the question that there already is or will be technology to compare multiple passwords from the same person from different leaks and derive the formula.
  - shadowgovt 3y ago
    > once a few of your passwords are in data breaches, anyone who wants to target you can derive your admittedly less complex formula. It's true that's a hypothetical attack vector. In practice, so few people use this approach that you're not going to see a general-purpose deployable attack suite based on this principle. It'd be useful for a targeted attack, but if you're under a persistent, targeted threat there are better tools (spear-phishing, social engineering, physical compromise, etc.).
lelandbatey 3y ago
You can use an offline password manager (keepass) that's saved to a file and put that file in Dropbox. There's a keepass-compatible app with a Dropbox/etc integrations so your private password store is synced between all your phones.
jrm4 3y ago
Grandma's piece of paper next to the computer is better than most everything.

christophilus 3y ago

You can keep a physical password book. For someone to get it, they need to physically steal it. If you keep it at home in a fairly safe location, it seems fine to me. If someone breaks into my home, they’ve got it. But that’s not a threat model that scales, so it’s not a major concern to me.

jasode 3y ago
>You can keep a physical password book. [...] If you keep it at home in a fairly safe location, But people are often away from home and want to log into websites and apps from their smartphone. A physical password book sitting at home is useless for that very common scenario. That "login from anywhere" is the typical motivation of gp's comment: "How can I keep passwords on 2 computers, an iPhone and iPad all in sync?"
- jrm4 3y ago
  Right, and instead of companies promising safety they can't deliver, it would be better to just be honest about the fact that it is hard. And again, to take it a level further -- I would absolutely use a company's software under one, and only one condition -- indemnity/warranty. Any company that is willing to go "If you get breached, we will pay for the harm" can absolutely take my money.

throw__away7391 3y ago

I have a system known only to me for assigning passwords based on things like the color of the company's logo and the number of vowels in their name. I have a complex and unique password for every site, I don't have to "remember" them because I can recreate them on the fly. This works really well imo, the main hiccup is companies that force you to change your password every x days and don't let you reuse old passwords.

r_hoods_ghost 3y ago
Until the company changes their logo...
- juahan 3y ago
  Or one is cracked and the others are easy to figure out. Because these types of algorithms tend to feel complicated, but are not as you still have to remember it.
noman-land 3y ago
This technique sounds great but has some challenges. Firstly, companies change logos, change names, force password resets or your password will leak in a breach. How does this system accommodate those scenarios? Also, once a few of your passwords are in data breaches, anyone who wants to target you can derive your admittedly less complex formula. It is not out of the question that there already is or will be technology to compare multiple passwords from the same person from different leaks and derive the formula.
- shadowgovt 3y ago
  > once a few of your passwords are in data breaches, anyone who wants to target you can derive your admittedly less complex formula. It's true that's a hypothetical attack vector. In practice, so few people use this approach that you're not going to see a general-purpose deployable attack suite based on this principle. It'd be useful for a targeted attack, but if you're under a persistent, targeted threat there are better tools (spear-phishing, social engineering, physical compromise, etc.).

lelandbatey 3y ago

You can use an offline password manager (keepass) that's saved to a file and put that file in Dropbox. There's a keepass-compatible app with a Dropbox/etc integrations so your private password store is synced between all your phones.

jrm4 3y ago

Grandma's piece of paper next to the computer is better than most everything.