5 ms·

TL;DR Get a password manager The first part is interesting, if you had been less verbose an ALL the different accounts you had it would have been a more intere

TL;DR Get a password manager The first part is interesting, if you had been less verbose an ALL the different accounts you had it would have been a more interesting read. There are still undeniable issues of using a password manager if you lose the data (or your master password is compromised but lets not get into that).

deleted 15y ago
[deleted]
shabble 15y ago
The problem with password managers (or any scheme that creates unique, non-memorable passwords) is that should you need to access a particular service when you don't have your manager available, you're SOL. Being able to pull things out of dropbox and whatever on your phone are nice, but it's another thing to have to rely on. I've thought a bit about this in the past, mostly relating to setting remote shhd to disable passwords entirely, and only accept PKI logins - what if you need to get in, and don't have your key? The google 2-factor with optional 'emergency 1-time use codes' that you can print and carry in your wallet is a nice solution to half of the problem (the other half being, if you're not using a computer you control, how do you securely access your password manager?) I don't really have a solution, other than "remember to take your phone with you", and possibly "ensure that at least your primary email is accessible via 1-time codes or a memorable (and strong) password."
- injekt 15y ago
  I agree this is an issue, and one I've come across a couple of times. I use 1Password for OS X and iOS. I have the database synced with my Dropbox and backed up locally too. I have two strong passwords that I remember. One is to open up 1Password, and the other is for my personal email address. Now's the time people start yelling at me telling me I should use 1Password for my personal email login too, but that proved, many times, extremely inconvenient. I use the Chrome and Safari 1Password extensions for 1-click logins, and it's a setup I'm extremely happy with. On the few occasions I've needed to access an account without access to my 1Password, I've reset my password via my personal email address and changed the password when I next have access to 1Password. I'm not going to pretend password managers solve all problems, but they certainly help.
- rimantas 15y ago
  I have three long and complex passwords memorized: my private key passphrase, my 1Password master password and my email password. Everything else is generated by 1Password and kept there. Because I still know my email password, even when 1Password is unavailable I can request a password reset.

deleted 15y ago

[deleted]

shabble 15y ago

The problem with password managers (or any scheme that creates unique, non-memorable passwords) is that should you need to access a particular service when you don't have your manager available, you're SOL. Being able to pull things out of dropbox and whatever on your phone are nice, but it's another thing to have to rely on. I've thought a bit about this in the past, mostly relating to setting remote shhd to disable passwords entirely, and only accept PKI logins - what if you need to get in, and don't have your key? The google 2-factor with optional 'emergency 1-time use codes' that you can print and carry in your wallet is a nice solution to half of the problem (the other half being, if you're not using a computer you control, how do you securely access your password manager?) I don't really have a solution, other than "remember to take your phone with you", and possibly "ensure that at least your primary email is accessible via 1-time codes or a memorable (and strong) password."

injekt 15y ago
I agree this is an issue, and one I've come across a couple of times. I use 1Password for OS X and iOS. I have the database synced with my Dropbox and backed up locally too. I have two strong passwords that I remember. One is to open up 1Password, and the other is for my personal email address. Now's the time people start yelling at me telling me I should use 1Password for my personal email login too, but that proved, many times, extremely inconvenient. I use the Chrome and Safari 1Password extensions for 1-click logins, and it's a setup I'm extremely happy with. On the few occasions I've needed to access an account without access to my 1Password, I've reset my password via my personal email address and changed the password when I next have access to 1Password. I'm not going to pretend password managers solve all problems, but they certainly help.
rimantas 15y ago
I have three long and complex passwords memorized: my private key passphrase, my 1Password master password and my email password. Everything else is generated by 1Password and kept there. Because I still know my email password, even when 1Password is unavailable I can request a password reset.