How many passwords do you have to remember?

maccored · 15-06-2017 01:35PM

isnt the idea of a password manager a bit silly? All anyone needs to know then is the password to your password manager.

Der Stier · 15-06-2017 01:39PM

I have about 3 basic passwords that I do little algoriths with in my head when I need to change them, fortunately I have a good memory for these things.

But I must check out that lastpass.

Send In The Robots · 15-06-2017 01:39PM

maccored wrote: »

isnt the idea of a password manager a bit silly? All anyone needs to know then is the password to your password manager.

Agree, and wasn't one of those major password site managers on the news as being hacked recently making it a null option.

Alun · 15-06-2017 01:45PM

maccored wrote: »

isnt the idea of a password manager a bit silly? All anyone needs to know then is the password to your password manager.

Not really. The master password isn't stored anywhere accessible to an attacker, it's used locally to scramble your passwords before uploading to the password manager server, and the password manager company themselves don't know your master password either. Plus any potential hacker has to log in to the password manager in the first place and there are all kinds of hurdles you can put in the way of that happening such as device restrictions, 2FA and geographic limits.

....... · 15-06-2017 01:46PM

This post has been deleted.

Alun · 15-06-2017 01:51PM

Send In The Robots wrote: »

Agree, and wasn't one of those major password site managers on the news as being hacked recently making it a null option.

If you're referring to Lastpass that was a vulnerability that was discovered in one of the browser extensions which AFAIK would require the attacker to have physical access to a computer running the extension and logged in under your user name. It was disclosed to Lastpass without being made publicly known and fixed pretty quickly anyway.

Send In The Robots · 15-06-2017 01:51PM

Can't link but 'OneLogin' was on the news recently, it suffered a serious data breach.

Alun · 15-06-2017 01:55PM

....... wrote: »

This post has been deleted.

Because the bad guys know that people do this. When, not if, one of your passwords makes it onto a list of hacked passwords through a security breach like the recent Yahoo breach, they'll try that password on a variety of other sites along with simple variations of the same with, say 2 digits at the end. Having the base password available gives them a better chance of striking lucky.

maccored · 15-06-2017 01:56PM

Alun wrote: »

Not really. The master password isn't stored anywhere accessible to an attacker, it's used locally to scramble your passwords before uploading to the password manager server, and the password manager company themselves don't know your master password either. Plus any potential hacker has to log in to the password manager in the first place and there are all kinds of hurdles you can put in the way of that happening such as device restrictions, 2FA and geographic limits.

a password you make up that can get hacked is also not 'stored anywhere accessible to an attacker'. A bad password is a bad password, so if you have a crap password for a password manager then the hacker has a list to all the other account passwords. how they get to the password manager etc etc is totally irrelevant

Alun · 15-06-2017 02:04PM

Send In The Robots wrote: »

Can't link but 'OneLogin' was on the news recently, it suffered a serious data breach.

Yes, I saw that. Information is a bit patchy but there's evidence that they may have stolen some encrypted password vault data along with other user information. They wouldn't have had access to master passwords though, so the only danger may be from weak master passwords, possibly based on user names which they may try to exploit.

Alun · 15-06-2017 02:10PM

maccored wrote: »

a password you make up that can get hacked is also not 'stored anywhere accessible to an attacker'. A bad password is a bad password, so if you have a crap password for a password manager then the hacker has a list to all the other account passwords. how they get to the password manager etc etc is totally irrelevant

But they still have to actually physically log on to the password manager website to access them. I have mine set up so that only the devices I've authorized (PC plus phone) have access to it, require a one off code from a 2FA device and are geographically limited to Irish IP's. I'll also get an immediate email and SMS if any attempt to log in to my account from any other device or country is even attempted.

spoonbadger · 15-06-2017 02:21PM

stimpson wrote: »

Not really true anymore https://diogomonica.com/2014/10/11/password-security-why-the-horse-battery-staple-is-not-correct/

If it hasn't been posted yet, this is an excellent resource https://haveibeenpwned.com/

Deise Vu · 15-06-2017 02:32PM

spoonbadger wrote: »

If I searched your hard drive for the username or email of an account of yours I wanted the password for, would I find that file

I don't really understand the question. My email user name, as an example, would be contained within the excel file which is password protected but it obviously wouldn't appear in the excel file name. Is it the case that forensic searches can bypass file encryption and drill into the files? (Genuine question again!). My email user name will also appear on a million emails going in and out but very few excel files I suppose.

citytillidie · 15-06-2017 02:34PM

I have a few email addresses that have different passwords.

One for Xbox
One for personal use
One for online sensitive use
One for online sign ups

....... · 15-06-2017 02:41PM

This post has been deleted.

spoonbadger · 15-06-2017 02:55PM

Deise Vu wrote: »

I don't really understand the question. My email user name, as an example, would be contained within the excel file which is password protected but it obviously wouldn't appear in the excel file name. Is it the case that forensic searches can bypass file encryption and drill into the files? (Genuine question again!). My email user name will also appear on a million emails going in and out but very few excel files I suppose.

Thought I'd edited that in time :P Sorry, I didn't fully read your post and didn't realize your file was encrypted. If it wasn't though, storing account names with passwords somewhere searchable is a bad idea. Search for the account name is a very easy, lazy way of trying to find account details on a site, hard drive etc. etc.

stimpson · 15-06-2017 02:56PM

Deise Vu wrote: »

I don't really understand the question. My email user name, as an example, would be contained within the excel file which is password protected but it obviously wouldn't appear in the excel file name. Is it the case that forensic searches can bypass file encryption and drill into the files? (Genuine question again!). My email user name will also appear on a million emails going in and out but very few excel files I suppose.

What version of Excel?

Gone Drinking · 15-06-2017 03:07PM

Don't understand password managers, you've one password then for all your passwords. What if someone looks over your shoulder and sees it, or puts a key logger on your machine? Just never understood it.

I've between 6-10 passwords. Only the weakest couple that I've been using since I was a kid contain a dictionary word, these are only used for sites i don't care about. I've a complex one that I use for my important secure sites (online banking, secure payment authentication, main email etc). I've lesser complex ones I use for sites that I'm not too bothered by (social media) and then I've a few for work related items.

The companys or services I use my main/important password with would never ever be saving my password in plain text. It's been encrypted since the day I registered. Even if they were to fall victim of a hack where the passwords are leaked, the likelihood of them encrypting my password is nil.

Would probably be the same sort of security on social media/boards but I use a couple of passwords for those accounts because there's a greater chance they'll fall victim to a security flaw or hack.

Deise Vu · 15-06-2017 03:08PM

stimpson wrote: »

What version of Excel?

Office 2010. Version 14.0.7128.500 (32Bit) I got fed up with the constant change for the sake of it and never upgraded since. Don't tell me I have to cave in now?

Hotblack Desiato · 15-06-2017 03:36PM

Deise Vu wrote: »

Someone would have to hack into our system, locate the file (which has a harmless sounding name),and break the encryption.

All very easily done and it only takes one phishing email sent to a user of an unpatched system to manage it - all your files can be sucked down to the attacker's system and examined at their leisure for juicy stuff. Although it's usually a lot more lucrative for them these days to just encrypt your files and look for a ransom...

Office encryption is not really encryption, think of it as one of those novelty 'padlocks' you get in a christmas cracker. Absolutely trivial to crack open.

Is that less safe than trusting some anonymous corporation in Cyber Space as most of the techies here seem to have done? (That's a genuine question, I'm not being smart assed, I consider myself tech-savvy but am most definitely not a tech).

Whatever about the others KeePass isn't an anonymous corporation, it's an open source project and you retain your password store yourself (although you could put it on a cloud service if you wanted.)

ALL software has flaws and ALL software must be patched promptly when flaws are discovered. Amateur admins who don't know what they are doing and don't like patching will sooner or later get caught out badly, and it only takes one bad cybercrime incident to destroy a business for good.

Deise Vu · 15-06-2017 04:04PM

Hotblack Desiato wrote: »

All very easily done and it only takes one phishing email sent to a user of an unpatched system to manage it - all your files can be sucked down to the attacker's system and examined at their leisure for juicy stuff. Although it's usually a lot more lucrative for them these days to just encrypt your files and look for a ransom...

Office encryption is not really encryption, think of it as one of those novelty 'padlocks' you get in a christmas cracker. Absolutely trivial to crack open.

I take the point but there is an accumulation of files since the year dot. Even if there was no encryption it would take a small army to look through every file.

Ransomware is straying off the point into general security. If we got hacked we would be exposed regardless of how we stored our passwords.I am assured our offsite backups will be protection enough. (Thats probably wrong too!)

Hotblack Desiato wrote: »

Whatever about the others KeePass isn't an anonymous corporation, it's an open source project and you retain your password store yourself (although you could put it on a cloud service if you wanted.)

ALL software has flaws and ALL software must be patched promptly when flaws are discovered. Amateur admins who don't know what they are doing and don't like patching will sooner or later get caught out badly, and it only takes one bad cybercrime incident to destroy a business for good.

To a techie I am sure the phrase 'open source' is 100% reassuring. To us non-techies I can only say :eek::eek::eek::eek:

Alun · 15-06-2017 04:10PM

Gone Drinking wrote: »

Don't understand password managers, you've one password then for all your passwords. What if someone looks over your shoulder and sees it, or puts a key logger on your machine? Just never understood it.

If anyone tries to use my master password on any device other than my main desktop PC or my phone, for a start they won't get access and secondly I'll be immediately alerted.

lawred2 · 15-06-2017 04:16PM

I use password generator to create passwords...

and I store them all in an encrypted folder on dropbox

I must have hundreds at this stage

stimpson · 15-06-2017 04:32PM

Deise Vu wrote: »

Office 2010. Version 14.0.7128.500 (32Bit) I got fed up with the constant change for the sake of it and never upgraded since. Don't tell me I have to cave in now?

2010 passwords are fairly easy to crack iirc. Seriously, get a password manager and turn on 2 factor authentication and stop stressing over it all.

Fathom · 15-06-2017 04:35PM

Six passwords. Which change.

Permabear · 15-06-2017 05:29PM

This post has been deleted.

Deise Vu · 15-06-2017 05:56PM

Thanks for all the suggestions guys but at the end of the day, I am not looking for security solutions, my point is that for ordinary, every day people e-commerce in all it's various forms will collapse unless someone comes up with something unique and, preferably, biometric, that can be transferred across all technologies. Looking back on the thread I think it would be fair to say that Joe Soap has too many simple and exposed passwords while Joe Hacker is getting ever more sophisticated. That can only end one way and that's very, very badly.

stimpson · 15-06-2017 06:01PM

Deise Vu wrote: »

Thanks for all the suggestions guys but at the end of the day, I am not looking for security solutions, my point is that for ordinary, every day people e-commerce in all it's various forms will collapse unless someone comes up with something unique and, preferably, biometric, that can be transferred across all technologies. Looking back on the thread I think it would be fair to say that Joe Soap has too many simple and exposed passwords while Joe Hacker is getting ever more sophisticated. That can only end one way and that's very, very badly.

2FA is robust (if someone has your password it's no use to them) and fairly easy to use. LastPass will use the fingerprint scanner on an iPhone so for that use case there is already a biometric solution. It will even scan your passwords to ensure you haven't reused them and that they are hard to guess.

Solutions are there but you choose not to use them.

pickarooney · 15-06-2017 06:59PM

Who could be arsed having millions of complicated passwords. I simply don't care if anyone wants to read my emails or whatever and makes the effort to hack it. I'm not going to waste my time trying to outsmart people who do this for a living.

Mister Vain · 15-06-2017 07:22PM

I have 5 complex passwords that I use for my most important sites. Then I use one password for about 7 or 8 unimportant sites or sites I don't use very often.

How many passwords do you have to remember?

Comments