passwords (where to save them)

hello

my question is very simple!
everyone that uses the internet has to remember or save passwords, for websites, forums, etc... of course that you can have one password for every website but thats something you should really avoid!

you can also have a simple password for each website like "antionline" to use in anti-online.com or mailhot to use in hotmail.com...

but if you want a secure password you must have a "strange" password for each website, a random password. this makes you have to save passwords and remember the ones you use most.

my question is... where to save the passwords? im using a pen and paper that i keep with me, but this is becoming boring and some times not useful because i leave them at home... is there a free and good password saving website online or something?

what can you do?

thanks!

Writing them down or creating "sticky gardens" (monitors filled with yellow stickies) aren't necessarily the best way of password management on a personal/user level. I'd recommend using pass-phrases. The key here is to ensure the password is rememberable but strong enough. For example, if I create a password like this:

Quote:

---

gH78|?!6345REtxnFd

---

It has no meaning to me and requires a fair amount for me to remember. Creating a mnemonic would also be difficult. Note that the password above has 18 characters (rather lengthy and difficult to break). Now, try this one:

Quote:

---

DaMnG0fLif42!?!

---

Very well known phrase and likely rememberable, far more so than the one above it. While I've changed the original phrase someone ("The meaning of life is 42" to "Da meaning of life is 42!?!"), I'm likely to remember it. The trick then becomes as to what I used to create the sentence. Again, this can be a challenge for some of us older folks, dont'cha know (Memory is the 2nd thing to go as you get older)

That said, why not actually use a phrase that you'd remember but is unique and not necessarily identifying as to who you are:

Quote:

---

The 3-way handshake is always represented by SYN, SYN/ACK and ACK!

---

63 characters! And I'd bet I can remember this, without writing it down. It also uses all the available characters (lower-case, upper-case, numbers and special characters). Some machines might have issue with spaces so you can do the same thing without the spaces.

So rather than looking for a potential way of recording your passwords that someone might find (online or offline) why not just use better password creation? ;)

HTH

I'm using some sentenced-based passwords too, but I've wondered what whould happen if instead of bruteforcing using every combination of, say, the letters of the alfabet, someone whould write something that'd bruteforce every combination of most-likely used words. With the increase of processor power and available memory, this should become more of a thread over time.

Oh, and I found that when you use a sentence for a password, you're more likely to type something wrong when entering your password. Generally, you type words faster than random concattinations of letters. Not being able to read back (most password-prompts don't have a local echo, or display *'s) can be a pain with 40 character+ passwords :)

I've mentioned this before and recommend this highly. Please see my original post on the subject here .

As far as the online part...you could have the installer for password safe and your .dat file hosted on one of the online storage services...or you could simply email them to your hotmail/yahoo/gmail account.

/* Edit */
Also, see my article on "Creating Safe Passwords" for help in choosing strong but easy to remember passwords.

i use pwd's made up of combinations of words that are easy to remember ie. ---color----pet---number

reddog11
bluecat75
pinkhorse00

that way i can pretty much remmember all the pwd's to all the sites i visit

Doing a little Googling would show up many password managers utilities.

I usually save my passwords {I have more than 20 Passwords}, in my PDA, with also a password-protected file. {This is the easiest}

I also use my mobile phone {Symbian} to save some of my passwords, with a hidden-attribute file. So no one would know its place but me.

I do belive that using mixed-wise password approach is the best {Like n6o6one6}, as well as none-dictionary words.

Read Zonecoder's tutorial, yo will find so many things to consider.


Cheers

thank you for your time

my question was not really about "secure passwords" but more about how to save/remember all passwords you use in the internet, for example, i have already registered over 34 websites that ask me for a password.

maybe i will just use my hotmail account to save the passwords as plain text, i know its not the best option...

Quote:

---

Originally posted here by username100
my question was not really about "secure passwords" but more about how to save/remember all passwords you use in the internet

---

We got that. Did you read the whole post that I linked to? Yes, the general topic is about creating safer passwords...but I also discuss a utility that can store user names/passwords in a safely encrypted format. I simply add the password strength comment/link for further information. Go read the part particularly about Password Safe

Quote:

---

maybe i will just use my hotmail account to save the passwords as plain text, i know its not the best option...

---

That's up to you. We've given you the path to some information that should answer your question, but the choice is ultimately yours.

Cheers.

Have a look at Password Agent It's a little freeware (for 25 entries) that is quite functional. It safely stores your passwords and even allows you to place the URL in the entry for easy access.

Cheers:

I use a handful of strong passwords for everything. I currently have 10 passwords that are used for all non-vital information and accounts. To avoid someone discovering one and getting into everything I rotate them. Perhaps not the best solution but it works for me. All of the passwords in question were randomly generated in the first place.

Falcis

I like to have them secure, because even with a nice phrase like "Two all beef patties special sauce lettuce cheese pickles onions on a seseme seed bun" you tend to forget exactly how they are arranged, especially if you only use them once in a while while tweaking that obscure router in some remote office. Besides not everything supports a large password like that. So I love to use Turbo Passwords. It keeps a copy on a machine and another on my Palm. Both encrypted so it is critical to make a decent key for the main software access, which is shared between desktop and palm.

Why do I like it? I have my palm with me all the time and I can access anything with the database. It comes with a random password generator that pops out some serious passwords. You could build your own very easy but incorporating it into the engine is pretty sweet. For instance, I am in an airport and I need to set up a wireless access point while at the bar... in arms with an Ice cold Fosters, I go to Turbo Pass, hit new. Peck out the url of the site that desires a password, peck out a username.... "GodzillaVSMothra" and hit "generate password" then type that into the URL hit save or done or continue or next and I have a totally random password stored in the palm.

The backside is if I lose that palm during the trip I have no way to recover the password. So internet based storage could be desireable. That is really a small risk and can be rectified but that is extra work so as soon as possible I sync with the laptop that has the software on it. In addition I sync my desktop and then home computer each day. The down side of internet based storage is, when you need it a lot of times it's because you are at a remote site and there is no internet.

But just in case; I FTP the encrypted export file to a couple of sites I own. I call it something.txt and stick it away in some directory. In the past I have even stuck it in a hotmail type aco**** just for safe keeping. And there is a (last resort or accidental death)print out stuck away in a bank deposit box with instructions to those who may open it. Call it a way to mitigate "key person" risk. And hey, I get a free deposit box in the deal. :D

Why go through all that trouble... I have over 200 passwords and I don't really subscribe to "single sign on" I take comfort in knowing my random exchange password is different from the domain administrator password, which is different from my user password, which is not the same as any other password. That is alot of work but, so is changing every single password every 30 days. That is NOT practical. So I rely on very random, very long passwords that get changed when I can and I try and monitor abuse.

If you really want to go cheap hotmail could work, I don't think you are using anything critical that could take down a whole block of IPs or customers, so hotmail could work. Just change them as often as possible and use a good password on the mail box.