MSE News: Customers can't keep track of passwords

Former_MSE_Helen

"The average person has 22 online accounts each and more than one in six have over 40 such accounts to remember..."

Read the full story:

Customers can't keep track of passwords

pfpf

A growing number of people in Britain are struggling to remember their passwords.

The average person has 22 online accounts each and more than one in six have over 40 such accounts to keep track of.

The council warns consumer should steer clear of using the same password, or even a variation of it, more than once.

People are also advised to avoid birthdays, names and common words, and be creative.

all sensible.

Memory expert Dominic O'Brien suggests people create their own coded story.

He explains: "Take the password 8:30121hP99. Imagine it's 8.30 in the morning and you're having a one-2-one meeting with little Harry Potter who's holding 99 red balloons."

so just have to remember 40 mini stories instead of 40 passwords.

tyllwyd

Memory expert Dominic O'Brien suggests people create their own coded story.

He explains: "Take the password 8:30121hP99. Imagine it's 8.30 in the morning and you're having a one-2-one meeting with little Harry Potter who's holding 99 red balloons."

Daftest suggestion ever. I can't even keep the story in my head, let alone translate it into a password. Anyway, you could easily remember the story and turn it into "8.30121hP99" so it doesn't even work.

zerog

Well, I don't see the problem with using one password for accounts that aren't so important, such as MSE... I will admit that I have registered with the same password on many forums and shopping sites (where I make sure that my card details and address are not stored)

Reaper

The best bet is to use a program to remember them all. There are lots of them but personally I use the free KeePass, not because I think its the best to use but because it is open source so not likely to have anything dodgy in it.

I also put the password file on Dropbox which means I can access it on my work computer and my mobile phone too so I am never without it.

Gromitt

I have a different password for every "useful" site (such as this one) and let the browser save the login information with a master password. If someone hacks my browser and finds it, its not the end of the world.

Sites that you have to register just to get something you want, and don't intend to use much afterwards, I typically use the same password and a throw away email address.

For sites which have my payment details, passwords are stored using "Password Safe" (open source), with the data stored inside a 2048-bit True Crypt partition which is only mounted when needed.

For banking sites, password are stored on a device that I created for that purpose that is kept in the safe. Just in case the device is stolen at any time, there are no references to the actual banks the passwords belong to, and they are also obfuscated.

alinwales

Reaper wrote: »

I also put the password file on Dropbox which means I can access it on my work computer and my mobile phone too so I am never without it.

I will hack your dropbox then... one password to rule them all

Only joking...

Reaper

alinwales wrote: »

I will hack your dropbox then... one password to rule them all

It wouldn't help even if you could access password file in Dropbox as the program heavily encrypts it. Of course you do have to keep the master password safe as that unlocks the file, but at least that is only 1 password I need to remember.

Gromitt

Reaper wrote: »

It wouldn't help even if you could access password file in Dropbox as the program heavily encrypts it. Of course you do have to keep the master password safe as that unlocks the file, but at least that is only 1 password I need to remember.

Thats one thing I've never trusted - password manager with built in encryption. The password managers I've used had no options to choose what encryption scheme, strength, amount of entropy when creating the keys etc. Nor has a feature for plausible deniability, so you could be forced to reveal your master password.

Two passwords is a much better approach. One password opens up the database and shows you one set of passwords, whilst another password opens up a completely different database of passwords. So if you are forced to give up your password, you don't have to give them the real one

callum9999

Gromitt wrote: »

Thats one thing I've never trusted - password manager with built in encryption. The password managers I've used had no options to choose what encryption scheme, strength, amount of entropy when creating the keys etc. Nor has a feature for plausible deniability, so you could be forced to reveal your master password.

Two passwords is a much better approach. One password opens up the database and shows you one set of passwords, whilst another password opens up a completely different database of passwords. So if you are forced to give up your password, you don't have to give them the real one

If you're a secret agent maybe. If you're a normal person then that is just unnecessary paranoia!

Gromitt

callum9999 wrote: »

If you're a secret agent maybe. If you're a normal person then that is just unnecessary paranoia!

Maybe I'm a little over cautious, but meh. You wouldn't want to spend a day in my head, I can assure you.