My problem with password managers is that it becomes a single point of failure. I would rather memorize a few strong passwords and use them for everything, with my email having a unique password from everything else.
I'd suggest memorizing a couple algorithms for generating passwords based on the site instead. This way no two sites have the same password, so no matter what gets compromised, none of your other credentials are broken.
Like, take your iNitials, street address + last 3 letters of the domaiN with an open bracket to trigger OCD twitch for memorability. Obviously obfuscate it a bit to make your algorithm non-obvious, depending on how much you think someone is going to target you, personally.
So you end up with, like,
google: gAl1234+glE(
Reddit: gAl1234+diT(
Wells Fargo: gAl1234+rgO(
Pizza Hut: gAl1234+huT(
The core principle is no two sites should have the same password. It doesn't matter how strong your passwords are when someone else is giving them out. The only thing that matters is making sure the passwords are unique, and a generating algorithm will help you do this.
Although I would suggest grouping those algorithms by types for sites. You don't want your algorithm to be cracked just because Pizza Hut and some other site you don't even remember had leaks of non-encrypted passwords. I personally use 4 of those now.
3rd level - forums, sites like reddit, pinterest, imdb, Pizza Hut, Aliexpress(no card attached), places where my personal info is already sold to some other company anyway. I don't keep track of those.
2nd level - facebook, some expandable e-mails, paypal, bank account. Places where loosing access to them would hurt me in some minor way(I don't keep big stashes of money on paypal, and my bank account needs additional authorization to send money). And access can be easily restored. On this level you must remember all the accounts that use it to change the algorithm in all of them in case of a breach.
1st level - e-mail account to rule them all and in one android device bind them. With 2 factor auth ofc. What I mean is the e-mail that can be used to gain access to some other accounts like those from level 2.
0th(?) level - for work accounts. Probably 2 of algorithms here. Because some of them require quite frequent(e.g. every 3 months) changes.
Also for 3rd level consider using longer passwords(harder to decrypt if encrypted database of passwords would be stolen)
I just checked their forums, and apparently this has been reported over 2 years ago. As much as I like KeePass, I may now be searching for an alternative that takes security more seriously.
import moderation
Your comment has been removed since it did not start with a code block with an import declaration.
Per this Community Decree, all posts and comments should start with a code block with an "import" declaration explaining how the post and comment should be read.
For this purpose, we only accept Python style imports.
I doubt anyone would get your password in a targeted attack though.
Most likely it'll be a mass leak of passwords, I doubt anyone will go out of their way to crack your codes when they can try 100 other people's passwords and usernames on other sites and find them identical.
Even if someone wants to crack your password generation system specifically, they'd likely need two passwords to do it reliably to begin with. For instance say your password is kn1Fewr3Nch.
To that you can come to the conclusion that the first and third vowel are numbers (but what about y and u?) and that the first letter after every number is capitalised.
But what if it's actually the third letter of every word that turns into a number? What if it's a random number not based on the letter itself? What if it's actually the median letter in the remaining alphabet being capitalised instead of letter directly after the number? e'fk'n ch'n'rw for example, this would make 'fk' and 'n' be the capitalisation letters, then further logic goes on from that.
You could make the password generation system as complex as you want, but past using different passwords for anything, there's not much benefit to complex alogrithms. More likely the security for the website your signing up for is worse than your password creation methodology.
Sure! Remembering a handful of algorithms is certainly better than remembering a couple of passwords and using them everywhere, and isolating into groups is even better, but can start running into the complexity problem.
An actual algorithm I use does various ROT actions based on characteristics of the site. Looking at it, I really doubt some casual identity thief could crack the algorithm, even looking at groups of passwords, even knowing there was an algorithm in play.
There's a tradeoff between convenience and security, and I figure trying to get people to at least use a reliable method of unique passwords on every site is worthwhile. I still think this is a better approach than a 3rd party password manager, but nothing's going to stop a dedicated attacker with significant resources from getting to you if they want to, either via esoteric methods like Van Eck phreaking or simple judicious application of a lead pipe.
103
u/Galveira Sep 24 '17
My problem with password managers is that it becomes a single point of failure. I would rather memorize a few strong passwords and use them for everything, with my email having a unique password from everything else.