Password Managers

chrisw

Install another password manager and then each one can remember the other one's password. 

flaneurs_lobster

chrisw said:

Install another password manager and then each one can remember the other one's password. 

Genius. If you are worried that your password manager Master Password is exposed because it has to be written down then the obvious solution is to store it in another password manager!

Err...

Actually my partner and I do kind of do this, we have an account each on Bitwarden, each with it's own Master Password, but these passwords are stored in the other's vault (albeit slightly encrypted with extra characters known only to us). Paid version of Bitwarden, allows other account holder access if other person has pre-authorised and does not cancel request within set timescale.

victor2

chrisw said:

Install another password manager and then each one can remember the other one's password. 

But then you have two passwords to remember and one of them you won't be using, except when you've forgotten the other! 

flaneurs_lobster

victor2 said:

chrisw said:

Install another password manager and then each one can remember the other one's password. 

But then you have two passwords to remember and one of them you won't be using, except when you've forgotten the other! 

Yes, but you write that one down. Obviously.

victor2

flaneurs_lobster said:

chrisw said:

Install another password manager and then each one can remember the other one's password. 

...

Actually my partner and I do kind of do this, we have an account each on Bitwarden, each with it's own Master Password, but these passwords are stored in the other's vault (albeit slightly encrypted with extra characters known only to us). Paid version of Bitwarden, allows other account holder access if other person has pre-authorised and does not cancel request within set timescale.

I've been thinking about that as DD and I both use the free version of Bitwarden, and only one needs to have the paid version. Apparently, it remains in place even if you no longer subscribe, but you can't change it. Could be worth a one-off annual subscription of 10USD to set it up perhaps.

flaneurs_lobster

victor2 said:

flaneurs_lobster said:

chrisw said:

Install another password manager and then each one can remember the other one's password. 

...

Actually my partner and I do kind of do this, we have an account each on Bitwarden, each with it's own Master Password, but these passwords are stored in the other's vault (albeit slightly encrypted with extra characters known only to us). Paid version of Bitwarden, allows other account holder access if other person has pre-authorised and does not cancel request within set timescale.

I've been thinking about that as DD and I both use the free version of Bitwarden, and only one needs to have the paid version. Apparently, it remains in place even if you no longer subscribe, but you can't change it. Could be worth a one-off annual subscription of 10USD to set it up perhaps.

That's very interesting, I've paid for the Families subscription ($40/yr) not knowing that about a single paid sub. Please post again if you are able to confirm this.

RumRat

flaneurs_lobster said:

victor2 said:

flaneurs_lobster said:

chrisw said:

Install another password manager and then each one can remember the other one's password. 

...

Actually my partner and I do kind of do this, we have an account each on Bitwarden, each with it's own Master Password, but these passwords are stored in the other's vault (albeit slightly encrypted with extra characters known only to us). Paid version of Bitwarden, allows other account holder access if other person has pre-authorised and does not cancel request within set timescale.

I've been thinking about that as DD and I both use the free version of Bitwarden, and only one needs to have the paid version. Apparently, it remains in place even if you no longer subscribe, but you can't change it. Could be worth a one-off annual subscription of 10USD to set it up perhaps.

That's very interesting, I've paid for the Families subscription ($40/yr) not knowing that about a single paid sub. Please post again if you are able to confirm this.

Bitwarden Password Manager Pricing & Plans | Bitwarden

km1500

PHK said:

km1500 said:

oldernonethewiser said:

B0bbyEwing said:

Saw a post elsewhere on the board that was 8 pages long & there was a lot of talk about password managers & it made me think....

So the whole idea behind them is you only need to remember 1 password & everything contained within the manager should really be a large gobbledygook password. 

So in theory, shouldn't your master password also be gobbledygook, in which case you're never going to remember it so then how do you get it each time you need to access the manager?

How do you operate yours? Is it 'safe' having something you can remember or not really and if not really then what do you do to not lose access to your manager?

Yep I know, I overthink things. Just wondered that's all

No

It should be something you can remember easily which can be a combination of dates, names places, things eg

Sticky22 yellowflower - 30 years to crack allegedly. A quick tweak of the same password means it will take almost 30 thousand years.

disagree that a 4 'character' password would take that long to crack

The person attempting to crack it doesn't know you've only used four different characters. The US equivalent of the NCCS has a password checker that will show how long various methods will take to crack a password. 

a dictionary attack will have a list of words - one of which will be sticky one of which will be yellowflowers and one of which will be 22 so it's an effectively a three 'character'password

IvanOpinion

km1500 said:

PHK said:

km1500 said:

oldernonethewiser said:

B0bbyEwing said:

Saw a post elsewhere on the board that was 8 pages long & there was a lot of talk about password managers & it made me think....

So the whole idea behind them is you only need to remember 1 password & everything contained within the manager should really be a large gobbledygook password. 

So in theory, shouldn't your master password also be gobbledygook, in which case you're never going to remember it so then how do you get it each time you need to access the manager?

How do you operate yours? Is it 'safe' having something you can remember or not really and if not really then what do you do to not lose access to your manager?

Yep I know, I overthink things. Just wondered that's all

No

It should be something you can remember easily which can be a combination of dates, names places, things eg

Sticky22 yellowflower - 30 years to crack allegedly. A quick tweak of the same password means it will take almost 30 thousand years.

disagree that a 4 'character' password would take that long to crack

The person attempting to crack it doesn't know you've only used four different characters. The US equivalent of the NCCS has a password checker that will show how long various methods will take to crack a password. 

a dictionary attack will have a list of words - one of which will be sticky one of which will be yellowflowers and one of which will be 22 so it's an effectively a three 'character'password

Slightly more complex. The base for a character attack is about 100, the base for a dictionary attack is about 8000-170000. I agree with your premise though that simple dictionary words significantly reduces the effectiveness.

BTW you were correct the first time when you said 4 words, 'yellowflower' would count as 2 words.

Apparently brute force crackers can check up to a billion passwords per second (and increasing). Most of the charts that give an idea of how long to crack a password assume character-by-character attacks, and significantly less throughput.

People often extrapolate these time-to-crack charts to mean a 12 character word would take centuries to crack. That is not true it could take only a few seconds to crack a 12 character word using a dictionary attack. That is why it is suggested to use multiple words (to provide length) and ensure at least one is mangled (not in an obvious way such as replacing 'o' with '0' or 's' with '$').

Vitor

The difference in time needed to brute force crack a 15 character passphrase made up dictionary words compared to a truly random 15 character password using all symbols on the keyboard is quite remarkable.

That said, by using mixed case (e,g, "AppleHouseCloud"), that password would take about 5 days to crack using GPU-based techniques assuming each of the words is chosen from a dictionary of 100,000 words.

If you inserted 4 digits that you can remember (i.e. house alarm code) somewhere in the passphrase "AppleHouse1241Cloud" it's more like 507 years to crack.