Password Security

[benni]

Hey everyone, this topic might seem a little on the dry side, but bear with me...
Among other things, 2016 was a pretty crazy year for cybersecurity, even affecting the US elections! It got me thinking about whether I'm doing enough to protect myself online from hacking. Currently I have two or three different core passwords that I normally adapt for each different website I sign up to.

My question is - what method do you use and how could it be improved? Password manager? Memory? Pen and paper?

[Topcat]

Re: Password Security

security/cybersecurity had zero effect on US elections, none whatsoever. Electronic voting machines are not connected to the outside world. They are not 'hackable'. Some of the political left like to blame it on that, but its nothing more than propaganda and being sore losers.

As for passwords, they're on paper in a safe deposit box....not so much if I forget them, but rather if something happens to me, my wife can get into my bank accounts.

[benni]

Re: Password Security

Apologies, I really ought to have said "allegedly affecting the US elections". I just mean that the theme was in the news a lot last year, so it got me thinking about cybersecurity in general.

That sounds like a good strategy, I hadn't thought of it from the point of view of being accessible to family. It's difficult remembering multiple passwords though, at least for me. I'm a little concerned my password variations aren't enough, so have been considering a password manager. There's LastPass, which most people have heard of, but I just found out about one called Dashlane from this blog. Apparently it doubles up as a digital wallet for online payment information, that sort of thing. Anyone have any experience with something like this, or password managers in general?

[jondoe]

Re: Password Security

To say an electronic voting machine isn't hackable is very short sighted, at best. It doesn't matter what side of the political fence you sit, almost anything and everything is hackable.

[retiredcaps]

Re: Password Security

I use keepass because it runs on multiple platforms (linux, android, windows, apple, etc). The source code is available for anyone to look at and it is free to use. It is updated almost twice a year with bug fixes, etc.

http://keepass.info/index.html

I use random long passwords with lower, upper, numbers and special characters.

I keep all my passwords in keepass and then use a 20 digit master password made of the above. The 20 digit master password is easy for me to remember because it is a phrase.

This keepass file is then backed onto two separate hard drives and 4 rotating USB drives. It has and never will be stored in the cloud. Obviously, the keepass file itself is encrypted. The USB drives are also encrypted as well.

Can the keepass master file be broken? Maybe if there is a flaw in the program or encryption algorithm or with enough computing power, but 20 characters is pretty long.

[benni]

Re: Password Security

I use keepass because it runs on multiple platforms (linux, android, windows, apple, etc). The source code is available for anyone to look at and it is free to use. It is updated almost twice a year with bug fixes, etc.

That's pretty cool, I didn't know the source code was available to everyone. It certainly sounds like you have your security well locked down, I'll certainly be taking a few pointers from your strategy, thanks!