Path: csiph.com!usenet.pasdenom.info!aioe.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Tim Watts <tw_usenet@dionic.net>
Newsgroups: comp.misc
Subject: Re: Ask Usenet: How do you manage your passwords?
Date: Tue, 11 Mar 2014 17:20:14 +0000
Lines: 44
Message-ID: <e7t3va-vg8.ln1@squidward.local.dionic.net>
References: <lfnd0s$61k$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net GGoz0A5V/jDwwGKAWDFbngkEKV8W3ih3oM/QTdvvtORpDzt5SV
X-Orig-Path: squidward.local.dionic.net!not-for-mail
Cancel-Lock: sha1:W0cJU0SvGVSsnyX803yxhyENHW4=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
In-Reply-To: <lfnd0s$61k$1@dont-email.me>
Xref: csiph.com comp.misc:1469

On 11/03/14 16:18, Randy Westlund wrote:
> My parents had their ebay account hacked last night, and the guy who
> had control of it was buying dodgecoin and litecoin as fast as he
> could.  I'm helping them deal with the situation, and finally
> convinced them not to use the same dictionary word as a password on
> all their accounts.  The incident has caused me to reflect on how I
> can better manage my own passwords.
>
> Currently, I use a common crappy password on unimportant sites, and
> a serious one for important accounts with a common base that varies
> based on the domain name.  But I'm worried that if a human were to
> recover the plaintext of my password for one site, they may be able
> to figure out my passwords for other sites as well.
>
> I'm really curious about password managers such as LastPass,
> KeePass, and pass.
>
> https://lastpass.com/
> http://keepass.info/
> http://www.zx2c4.com/projects/password-store/
>
> I really like the ability to use ridiculously strong passwords, but
> I'm concerned about limited accessibility to them.  What if I need
> to check my account balance on my phone when I'm out at a store
> somewhere?  What if I'm on someone else's windows machine and can't
> ssh into my server (assuming I use pass) or my browser plugins
> (assuming I use a browser-based utility).  This is the trade-off
> between security and convenience, and finding the right balance is
> difficult.
>
> For those of you who use password managers, how do you handle these
> situations?  For those of you who don't, what password management
> strategy do you use?
>

I use KeePassX - and a compatible app for Android. I keep the master 
file on a USB stick (Corsair Survivor - nearly indestructible) and a 
second copy on my phone.

I use it so often I never forget my mentally long passphrase. This means 
I can have loads of weird and non dictionary passwords for sites that 
matter.

Works for me and SWMBO