How do you remember all your different passwords?

[zico]

Question for those of you who use never use the same password for a different site. We're advised not to use the same, or similar, passwords for several different sites, but if I did that, I'd probably have over 50 different passwords, so just how do you remember all your different passwords.
(I actually have a password-protected Word document listing all my various UserID, customer numbers, personal ID, passwords, security questions, but it's not practical to carry all these around with me when away from home.)

I know there are sites that can store your passwords for you, but what if they get hacked?

[kiloran]

A password protected Word document is close to useless. Very easily hacked.

Many of us use Keepass. It's free, multi-platform and, more importantly, does NOT store passwords on a hackable site. The database with the passwords is a master-password-protected file stored on your PC/tablet/phone. It will be included in your PC backup (you do backup your PC i hope )

https://keepass.info/

--kiloran

[Laughton]

I've been using Roboform for as long as I can remember with no problems. I seem to have accumulated over 300 different log-ins with different passwords.

https://www.roboform.com

[SalvorHardin]

For home use, write them down. Seriously, this is recommended by a lot of computer security people. The problem is that the sensible policy of not writing down passwords at your place of work isn't necessarily appropriate for home use.

"The best defense against hackers is...paper?"
https://www.vox.com/2014/4/16/5614258/t ... n-on-paper

"So Why Can’t You Write Down Your Password?"
https://www.howtogeek.com/howto/31259/a ... -password/

"Write your passwords down to improve safety"
https://www.macworld.com/article/300693 ... afety.html

You don't need to make it obvious. You may prefer for the really important passwords to have them written down with no identification as to what it's used for. Maybe in the back of an old paperback book.

If you're really paranoid you could encrypt the password using a simple substitution cipher (e.g. move up 3 letters in the alphabet with X = A, Y = B and Z = C). If you're sharing accomodation with people who you don't fully trust then writing down passwords might not be the best solution.

[Lootman]

For home use, write them down. Seriously, this is recommended by a lot of computer security people.

You don't need to make it obvious. You may prefer for the really important passwords to have them written down with no identification as to what it's used for. Maybe in the back of an old paperback book.

Yep, me too, all on a piece of paper inside a takeaway food menu. I take it with me on trips, leaving a photocopy at home.

And as you suggest, the important ones are unannotated.

[bungeejumper]

I don't recall ever forgetting a password without being able to have the solution posted back to me pretty damn promptly. "Forgotten your password? Tell us your email address and we'll send you a reset message." And they do, unless they're HMRC, who might take a day or two to kick-start their recovery process. Everybody else seems to have it down to thirty seconds or so.

Whether this is a good idea or not would presumably depend on whether or not you're a cybercriminal who also happens to be watching my email account.

BJ

[UncleEbenezer]

I keep them all on my computer. In fact, several computers, so I have them wherever I'm working at the time I need them. One of those is in "the cloud".

Encrypted, of course. Don't want to risk some stranger getting their hands on them if I lose a 'puter, or if any 'puter gets hacked.

I've been doing this a long time, using my own homebrew management. Nowadays you can just use a password manager - a popular candidate has already been mentioned above - to deal with it all.

[UncleEbenezer]

I don't recall ever forgetting a password without being able to have the solution posted back to me pretty damn promptly. "Forgotten your password? Tell us your email address and we'll send you a reset message." And they do, unless they're HMRC, who might take a day or two to kick-start their recovery process. Everybody else seems to have it down to thirty seconds or so.

Whether this is a good idea or not would presumably depend on whether or not you're a cybercriminal who also happens to be watching my email account.

Yep, password reset presents potential opportunities for malefactors (and as with contactless payment, you gain nothing by not using it if it's enabled). What you really need is to encrypt password reset messages. Short of that, most sites that offer password reset offer some lesser mitigation, such as a limited time window to visit a one-time password-reset URL.

[OLTB]

At work we use Lastpass https://www.lastpass.com/

Cheers, OLTB.

[scotia]

I keep them all on my computer. In fact, several computers, so I have them wherever I'm working at the time I need them. One of those is in "the cloud".

Encrypted, of course. Don't want to risk some stranger getting their hands on them if I lose a 'puter, or if any 'puter gets hacked.

I've been doing this a long time, using my own homebrew management. Nowadays you can just use a password manager - a popular candidate has already been mentioned above - to deal with it all.

moi aussi

[Mike88]

My passwords are saved in Google Chrome automatically. The fact nobody else has mentioned the facility within Google leads me to presume saving passwords in this way is unsafe. Is that correct?

[UncleEbenezer]

My passwords are saved in Google Chrome automatically. The fact nobody else has mentioned the facility within Google leads me to presume saving passwords in this way is unsafe. Is that correct?

That'll be websites with no session timeout, or that only rarely log you out. Or low-security sites.

If chrome knows a password, then anyone who gets their hands on your chrome gets free access to whatever it protects. I'm fine with that for lemonfool, but glad my bank doesn't work like that.

Unless what you're actually talking about is a password manager built into chrome?

[AndyPandy]

A password protected Word document is close to useless. Very easily hacked.

Many of us use Keepass. It's free, multi-platform and, more importantly, does NOT store passwords on a hackable site. The database with the passwords is a master-password-protected file stored on your PC/tablet/phone. It will be included in your PC backup (you do backup your PC i hope )

https://keepass.info/

--kiloran

Until recently I had mine in a Password protected WORD file as well but, aware that WORD can be hacked so easily - as mentioned, signed up to Lastpass. That keeps passwords for websites but also has a document vault and I've copied the WORD doc there (with a bit of a purge - many sites that I had registered on no longer exist and my kids have grown out of Club Penguin (which I believe was hacked once?) )

Works for me and accessible anywhere with an Internet connection. One downside of Keepass I think as I work from all sorts of places.

Yes, I know LastPass was also hacked but that was a while back and I don't think much was able to be taken. It's not perfect, but it will do me for now. I've even started using their password generator rather than my thematic own ones. If anyone's looking, I'd say at least consider it. It's missing some functionality I'd like but it's relatively easy to use.

[AsleepInYorkshire]

H0w d0 y0u r3m3mb3r @ll y0ur d1ff3r3nt p@55w0rd5 was my password - now because of you I have to change it

My b@d

AiY

[Lanark]

My passwords are saved in Google Chrome automatically. The fact nobody else has mentioned the facility within Google leads me to presume saving passwords in this way is unsafe. Is that correct?

What if your house is burgled or burns to the ground - if that machine goes away you are going to lose all the passwords.

You can get google to sync your passwords and store them in the cloud, but that means Handing over all your keys, to everything, to Google.

Google are pretty good but I don't trust them that much!

[tacpot12]

I use Keeper, which I pay a subscription for because I want to support the company financially as I need them to remain in business.

I use Keeper's facility to generate random passwords. I have 237 passwords stored currently.

[BrummieDave]

My passwords are saved in Google Chrome automatically. The fact nobody else has mentioned the facility within Google leads me to presume saving passwords in this way is unsafe. Is that correct?

Storing your password in this manner, so that it comes back automatically next time, is like not having one at all IMHO.

I don't understand why it was invented, or why anyone would use it.

[xeny]

I don't understand why it was invented, or why anyone would use it.

If you're confident that the computer is adequately secure then it is very convenient.

If you've got a machine with a strong password and encrypted hard drive that you keep up to date on patches then that may be a reasonable approach.

[XFool]

...At the back of my small computer notebook. The most frequently used on a Post-It-Note stuck to the front of the notebook.

Hack that!

[scotia]

...At the back of my small computer notebook. The most frequently used on a Post-It-Note stuck to the front of the notebook.

Hack that!

Way back in a University department, PCs were issued to each member of staff, many of whom were computer semi-literate. The computer manager correctly insisted that each user selected a password - but with limited use of the PCs the passwords were quickly forgotten, and reprimands were handed out by the computer manager when requests were made for the creation of new passwords to replace the forgotten ones. But a solution was found by the academics -post-it notes appeared, stuck on screens with the password clearly displayed. The computer manager gave up the unequal struggle!