Any safe place for keeping passwords?

onejontwo

With all the different and more complicated passwords we're supposed to use to keep our pc's safe, does anybody know of a way of saving them all to one place without the need for loads of "stick-it" notes as I have?

fwor

KeePass, or KeePassX if you're running Linux. It's Open Source and free.

Choose a long memorable passphrase - and keep a keyfile on a USB dongle - and your passwords will be very safe.

John_Gray

I use the free LockNote. All you get is a simplistic Notepad-type screen in which you can enter anything you like, including passwords, and it is encrypted when you save it (giving an .EXE file).

JasX

At work (for a large and usually security paranoid blue chip) we're advised to use a program called 'passwordsafe' you basically remember one 'master' password and can then keep all your other passwords inside it

....seems to be free too

albionrovers

I use the same password for everything and keep it in my head.

cyberbob

There was a security expert (ex-hacker) on Radio 4 the other week. His conclusion was nothing is safe. If you have to keep a note of them somewhere the safest place is a piece of paper. Don't all leap onto me for this. If its encrypted on your Pc you still have a chance of it being hacked. If you keep it on an online service. How do you know the security of that? If banks can be hacked so can that. If you keep it in a book at home and make sure its hidden well. The only risk you have is if your burgled and thats if they find them.

fwor wrote: »

Choose a long memorable passphrase - and keep a keyfile on a USB dongle - and your passwords will be very safe.

If someone gets hold of that that is easy to hack into

isofa

albionrovers wrote: »

I use the same password for everything and keep it in my head.

Probably the worst thing you can possibly do!

I have pretty much a different password for everything, I work in IT, so to me it's second nature, and I'm good at remembering. I just keep some cryptic reminders for ones I don't use very often, that only I'll remember. I also change frequently used passwords on client systems monthly. Security is very important, humans, especially with social engineering, are always the weakest link.

Also remember to use letters, numbers and preferably symbols. Nothing someone could guess.

There is a good nmemonic generator here: http://www.bad-neighborhood.com/password-generator.htm

JasX

albionrovers wrote: »

I use the same password for everything and keep it in my head.

...and even worse to post on the internet telling everyone that you do

hc25036

A good way of getting "random" passwords and remembering them is to use favourite songs (or poems, sayings, whatever). The take the first letter of each word, switching one or two for numbers. You can get long unbreakable passwords this way - for instance I have a Captain Beefheart line embedded in my brain "the camel wore a nightie at the party of special things to do" (don't ask!). This becomes tcwan@tp0st2d....

rmg1

We use passwordsafe at work as well (we have 5 PC between 4 people and 8 different systems all with different password requirements!!).
It's dead easy to set up and use, you can set it to launch automatically at system start-up and all you have to do is remember the master password and where you put the encrypted file.
And, yes, we all have access to each others passwords but we couldn't work any other way as some systems will only work on certain machines.

fwor

fwor wrote: »

Choose a long memorable passphrase - and keep a keyfile on a USB dongle - and your passwords will be very safe.

cyberbob wrote: »

If someone gets hold of that that is easy to hack into

It's not easy at all to hack into.

KeePass uses a strong version of AES by default, and the keyfile that you put on the dongle is ~in addition~ to the long passphrase. If you don't have the passphrase ~or~ the dongle with the keyfile on is not plugged in, it won't decrypt your password file.

Trying to brute-force crack it if you have the keyfile but not the passphrase would take an impractically long time.