Passwords And Security Questions

[TaG]

I have a question for all you knowledgeable people out there.

What with work, home, web, banking etc I seem to be drowning under a sea of passwords, PINs, security questions and even usernames. Just lately I seem to have added loads more and it is becoming a real pain to keep track and have them available at the right time and place.

It seems dumb to write them all down and carry them around.
I haven't found a single, secure, electronic storage that I can access from either a linux or windows pc or even a seperate device (eg phone).

I can't be the only one with a large volume of security information I need to store securely and also be accessible. So does anyone have any pearls of wisdom?

 

[Squidge]

I just make it habbit to use them all at least once a week, that way I don't forget any of them.

The ones I can change are normally a complete mash up of various song positions when played on a guitar and/or synth, so I just remember the songs and know instantly what the password is

Much easier to remember them that way than the complete jumble of letters and numbers that they are (and of course are more secure than dictionary-based passwords).

 

[sam fisher]

Somehow I manage to remeber all of mine but I did today realise I have forgotten my postcode :S

 

[todd]

KeePassX works well and is cross-platform. I like it. As long as I'm sitting at the computer, I might as well let it do the dirty work of remembering passwords. Just keep backups! I keep a copy on USB, but I avoid actually using that stick with strange computers. My machine at work (which I set up from scratch) is OK, but not much else. I'm looking forward to having KeePassX on the Pandora.

Passwords I need frequently when not on my home computer I use memorable stuff. Just pick some ways to scramble that would be easy and peculiar to you.

Some have suggested using some characteristic of the website (e.g., the 1st, 3rd, and 5th letters of the URL) combined with a common "base" password in order to arrive at a unique password for each site you use.

--Todd

 

[PoisonedV]

I use roboform, and for passwords not on that I keep it in my identity information under 'extra' on roboform so I can copy and paste if need be.

 

[Username]

All of my passwords are variations of about 3 of mine, for example my password for this site would be aladdin2 (don't try it) and my gmail password would be aladdin57. I don't really care about people finding out my passwords though.

 

[klikklak]

pwdhash for Firefox is good. You get proper strength passwords while you only have to remember a simple generic password. Of course you have to install it where ever you are, so it's not optimal. Other then that, I just remember them.

 

[Hooka]

My solution to this dilemma was to create my own 1337-speak style cryptography... while no form of cryptography that can be mentally thought up and used by a person easily can be too complex, I've found it to help. An example of this kind of simple cryptography would be to use a letter lower (wrapping so a would be z) for every letter in a word and attaching a number to some part of it, say after the 3rd letter. Then you can use a word that has a very easy to remember link to the site or program, yet not be too obvious. Mind you, a fast machine and a brute force cracker can get through most anything nowadays

 

[gp32rich]

+1 to !33t $P34k

Mixing it up with upper/lower case and symbols - find a combination that's easy to type so you can enter it while people are watching and they still can't work it out.


Sometimes it takes two or three guesses at my own password though

 

[craigix]

Clever variations of 3 password sources joined together (to make pretty long passwords it has to be said, but each is unique). Each password then is unique but even if I forget one I can usually guess it with a few tries.

I don't use the net for banking or anything like that, I just could not be arsed with the trouble if something happened/went wrong. I still like to drive down to the bank and use their services 'you could do this online you know!'. Every time. Lazy bankers.

 

[djrose]

Password safe is good for me.

Opensource, (apparently) pretty secure and easily portable - Application and password database can simply run from a USB stick.

http://passwordsafe.sourceforge.net/

 

[TaG]

Some interesting responses here - thanks folks.

I like the guitar idea Squidge - I just got to learn guitar first. I think I often try something that combines Craig's/gp32rich's ideas but it has got out of hand right now, I just can't remember all of them now. Whatever I do has to work for me regardless of whether I'm using Linux or Windows.

KeePassX is something I tried a while ago and it didn't work for me then though I can't remember why, but it might be worth trying again especially as it is also available as a PortableApp.

PwdHash seems a similar idea to SuperGenPass, so I'll give that a try too.

Three or four years ago I had an app called Code Wallet which was good but Windows only - although it worked on pocketpc / windows mobile, which was well handy. It worked reasonably well until I changed to linux at home and a Nokia phone...

I'm beginning to think I might have to use more than one tool/technique, unless someone finds that perfect idea.

 

[Username]

Well, you can use PwdHash to remember your password for SuperGenPass to remember your password for Password safe which will store the passwords for all of them. For bonus points, have the very last one only give you hints as to where the location of your password may be hidden (maybe coordinates?), and have it so that it can only remember your password on a certain day of the Aztec calender that only comes once a century.

 

[Goity]

I use the word Joan Rivers for all of my passwords

 

[satanic virus]

I use HandySafe which is a commercial app on my Pocket PC which I always have with me.

Just one password to remember, and then I have access to all my passwords, PIN's etc. My password on HandySafe is a combination of my favourite animal and a number which has a special significance to me .... & no, it's not goat666

 

[dsraa]

I can remember most of mine as well, as I do exactly as other have said, use a common word, and then add some extra numbers or letters to the front or back.

But to just to be safe, I have an old password program that is very small, and doesn't require any installing, and has a master password, and is quite configurable. I store all my stuff in that.



DSR

 

[atomicthumbs]

I use three passwords. All are around 30 characters and alphanumeric with caps. They are easy to remember mnemonically, though.

 

[Esn]

I tend to use the model numbers of objects I own or used to own. For example, let's say that I'm currently using a "ASUS VK192T" monitor (I don't actually use that one). The letters are right in front of me every time I use the computer, so it's easy reference. Add in your name or something, and you have a password that's long and hard to guess.

I guess it doesn't work so well if you frequently access the internet from different computers. But if you need to go somewhere, just take a scrap paper with you saying something like "buy ASUS VK192T monitor". Even if it should fall out, no-one will suspect anything.