3 ms·

Use a password archive (e.g. KeePassX) encrypted with one really, REALLY good password you'll memorize (plus a keyfile, should you feel paranoid). Each passwor

Use a password archive (e.g. KeePassX) encrypted with one really, REALLY good password you'll memorize (plus a keyfile, should you feel paranoid). Each password for a service is then randomly generated and stored in the archive; you don't need to remember them, you just need to access the archive. For default, I have chosen 60-character password length, upper-lower-numbers-spaces-special characters mix (as a rule of thumb, a longer password is preferable to a more complex password). For whatever reasons, some services refuse this combination - and that's a huge red flag: if the service at least hashes the password, it should get a uniform, eminently storable string out. If they care what characters go in ... well I ain't saying they're storing the plaintext, but it's close enough to arouse suspicion. One of the worst offenders seems to be Skype, with its "maximum password length: 20 characters, no weird characters allowed." If that happens, well, you can override the default and generate a weaker password for that one service, or vote with your feet and not provide your account details to such a suspicious contraption.

GotAnyMegadeth 13y ago
Hotmail also limits your password to 16 characters
- cerberusss 13y ago
  It's enough. Everybody uses "hunter2" as the password.
grimgrin 13y ago
If my main password was: Teeter!Coin!Statue! is that "really good"? I ask because I wonder if I should go more complex with that one password I remember. Mine is about as complex as the example I gave.
- Piskvorrr 13y ago
  That's "mediocre" at best. This should be The One Password To Rule Them All, the only one you'd actually need to remember (or be completely locked out of the password archive if you forget!). So: using a pass_phrase_ would definitely be good, but it would need to be a good deal longer. I'd suggest at least eight to ten words. (Note that this is The Key to all your other passwords - it needs to be both strong AND memorable; no point in compromising one for the other.)
cyphax 13y ago
The reason I like to use a key file isn't so much paranoia, but ease of certain types of use. If I use a key file, I could upload my KeePass database to a cloud service, but keep the key file elsewhere. I could also keep the database on a usb drive and keep the key file somewhere else and not worry as much about passwords I have to remember or how strong it is. There are WAY too many services that don't allow for 60 character passwords though. I use much shorter passwords by default (24 characters or so, I'm not even sure of the exact length) but it's not uncommon for a service to not accept my generated (by KeePass) password due to its length.
sehrope 13y ago
> Use a password archive (e.g. KeePassX) encrypted with one really, REALLY good password you'll memorize (plus a keyfile, should you feel paranoid). One more vote from me for KeepassX with both a long, unique passphrase and a keyfile. Once you start using a password manager it's impossible to go back to trying to memorize individual passwords (which is a good thing) and you'll be hooked for life at the convenience. One tip: make sure to increase the number of rounds of key derivation for the master password (should be under "Database settings"). The default is relatively low. There's a handy button with a clock on it that will perf test your computer and pick a number of rounds that is approximately 2 seconds of CPU time. > For default, I have chosen 60-character password length, upper-lower-numbers-spaces-special characters mix (as a rule of thumb, a longer password is preferable to a more complex password). Yep when it comes to passwords, long beats strong. For answers to "secret questions" (which arguably are one of the stupidest concepts in account security) I follow the same rule. Long, random gibberish answers. Ex: Q: What's your first pet's name? A: gVr5nlLy0BLPu6OpW5YUPVMtHXqy5xxr2UMUbCoSTIR3KmPTfdl8Ml8ckfbDC7Pw Q: Where did you go to high school? A: Wdn3hohFxq2H4f7y8n501gwlPGZLlKDIDusWA0dGm9NEaabwogh9DUKngDy2zabC I think it'll be pretty funny if I ever have to read one of those over the phone. >One of the worst offenders seems to be Skype, with its "maximum password length: 20 characters, no weird characters allowed." Yes that's pretty stupid and it's not just Skype, it's also Hotmail/Outlook and "Microsoft accounts" in general (ex: Windows Azure). I don't remember if it was always like that for Skype or if it happened after the Microsoft acquisition though.
T-hawk 13y ago
What do you folks using password managers/archives do for access from other machines that don't have the password tool and database? Cloud-based password storage (either in a Dropbox-like service or built in with the password manager) doesn't feel kosher. This is what's stopped me from adopting a password manager so far - I want to always have access to things like my webmail and forum accounts from any internet client without a dependency on a stored database.
- yen223 13y ago
  Ain't nothing wrong with using KeePassX + Dropbox. In any case, if the attacker can crack KeePassX's encryption, he can probably crack your forum accounts directly.
ereckers 13y ago
> I have chosen 60-character password length, upper-lower-numbers-spaces-special characters mix (as a rule of thumb, a longer password is preferable to a more complex password). For whatever reasons, some services refuse this combination - and that's a huge red flag: That would be the websites of nearly every financial institution I've ever come across.

GotAnyMegadeth 13y ago

Hotmail also limits your password to 16 characters

cerberusss 13y ago
It's enough. Everybody uses "hunter2" as the password.

grimgrin 13y ago

If my main password was: Teeter!Coin!Statue! is that "really good"? I ask because I wonder if I should go more complex with that one password I remember. Mine is about as complex as the example I gave.

Piskvorrr 13y ago
That's "mediocre" at best. This should be The One Password To Rule Them All, the only one you'd actually need to remember (or be completely locked out of the password archive if you forget!). So: using a pass_phrase_ would definitely be good, but it would need to be a good deal longer. I'd suggest at least eight to ten words. (Note that this is The Key to all your other passwords - it needs to be both strong AND memorable; no point in compromising one for the other.)

cyphax 13y ago

The reason I like to use a key file isn't so much paranoia, but ease of certain types of use. If I use a key file, I could upload my KeePass database to a cloud service, but keep the key file elsewhere. I could also keep the database on a usb drive and keep the key file somewhere else and not worry as much about passwords I have to remember or how strong it is. There are WAY too many services that don't allow for 60 character passwords though. I use much shorter passwords by default (24 characters or so, I'm not even sure of the exact length) but it's not uncommon for a service to not accept my generated (by KeePass) password due to its length.

sehrope 13y ago

> Use a password archive (e.g. KeePassX) encrypted with one really, REALLY good password you'll memorize (plus a keyfile, should you feel paranoid). One more vote from me for KeepassX with both a long, unique passphrase and a keyfile. Once you start using a password manager it's impossible to go back to trying to memorize individual passwords (which is a good thing) and you'll be hooked for life at the convenience. One tip: make sure to increase the number of rounds of key derivation for the master password (should be under "Database settings"). The default is relatively low. There's a handy button with a clock on it that will perf test your computer and pick a number of rounds that is approximately 2 seconds of CPU time. > For default, I have chosen 60-character password length, upper-lower-numbers-spaces-special characters mix (as a rule of thumb, a longer password is preferable to a more complex password). Yep when it comes to passwords, long beats strong. For answers to "secret questions" (which arguably are one of the stupidest concepts in account security) I follow the same rule. Long, random gibberish answers. Ex: Q: What's your first pet's name? A: gVr5nlLy0BLPu6OpW5YUPVMtHXqy5xxr2UMUbCoSTIR3KmPTfdl8Ml8ckfbDC7Pw Q: Where did you go to high school? A: Wdn3hohFxq2H4f7y8n501gwlPGZLlKDIDusWA0dGm9NEaabwogh9DUKngDy2zabC I think it'll be pretty funny if I ever have to read one of those over the phone. >One of the worst offenders seems to be Skype, with its "maximum password length: 20 characters, no weird characters allowed." Yes that's pretty stupid and it's not just Skype, it's also Hotmail/Outlook and "Microsoft accounts" in general (ex: Windows Azure). I don't remember if it was always like that for Skype or if it happened after the Microsoft acquisition though.

T-hawk 13y ago

What do you folks using password managers/archives do for access from other machines that don't have the password tool and database? Cloud-based password storage (either in a Dropbox-like service or built in with the password manager) doesn't feel kosher. This is what's stopped me from adopting a password manager so far - I want to always have access to things like my webmail and forum accounts from any internet client without a dependency on a stored database.

yen223 13y ago
Ain't nothing wrong with using KeePassX + Dropbox. In any case, if the attacker can crack KeePassX's encryption, he can probably crack your forum accounts directly.

ereckers 13y ago

> I have chosen 60-character password length, upper-lower-numbers-spaces-special characters mix (as a rule of thumb, a longer password is preferable to a more complex password). For whatever reasons, some services refuse this combination - and that's a huge red flag: That would be the websites of nearly every financial institution I've ever come across.