How (not to) keep your passwords safe!
By Alex Miller
Today I was helping my mom setup new Gmail and AIM accounts, (now that gmail chat and AIM are linked, its essential to have an account on AIM and gmail, and to link them) and I was horrified to discover that she keeps all of her passwords, including her bank, email, credit card, web and domain hosting, and other crucial sites, in a word doc on the root of her laptop’s hard drive. AHHHHHA! What a recipe for disaster! “But what should I do?” she asked me. Her passwords are myriad, and all different (good), but she can remember none of them (bad!).
Here are several ways to keep your passwords safe (and the pitfalls):
1) Do like my mom, and keep all your passwords different, and in one “password file”, but encrypt that file with PGP, GWEBS WebmailSafety, or some other asymmetric encryption.
Pitfalls: A) You could forget your PGP password. B) You could lose your private key or your password file. C) Someone could steal your private key and your password file and guess your password. D) Someone could steal your password file and crack your private key.
Avoiding Pitfalls: A) Write down your pgp password somewhere, but don’t label it “PGP password” and keep it safe and long. B) Keep both a copy of your private key and your password file backed up and offsite, but not on someone else’s systems. C) Not likely, but again, you have to keep your password long and secure. D) Even less likely. Use a high bit rate algorithm. WebmailSafety, for example, uses 2048 bit RSA, and you would need to string together several of today’s most powerful supercomputers to crack that within your grandchildren’s life time.
2) Use a commercial password keeper, like Apple’s keychain or similar.
Pitfalls: these password keepers are only as secure as their implementations – and the user must decide which software to trust. Apparently Apple’s keychain is pretty secure, but you should always find out as much as you can about critical security software.
3) Use several passwords that you can remember, but different passwords on important or often-used sites. And never write any passwords down. For example Password A for email, password b for your online bank and password C for everything non-mission critical.
Pitfalls: The more you use a password, the less secure it is, and the more places you use, the less secure it is.
Avoiding pitfalls: For daily use and important passwords, choose long, strong, and hard to guess passwords, enter them manually and change them often. Daily use passwords are easy to remember because you are entering them all the time, and repetition breeds memories. Your non-mission critical passwords may be guessed, and if the intruder guesses one, they know them all, but again, these passwords are non mission critical, so this isn’t such a big problem.
Well, there are three solutions that I recommend. This is a big topic, so I look forward to user comments. Tell me what you do. How you keep your passwords secure, and if I missed some pitfalls, help me fill those in too!
![[del.icio.us]](http://images.del.icio.us/static/img/delicious.small.gif){kind=small}
Tags: encryption, IT, mission critical, PGP, pitfalls, safe passwords, Security
December 10th, 2007 at 7:17 pm
Hey, I found a good tutorial on how to use Apple’s keychain.
http://www.playingwithwire.com/2007/02/apple-keychain-all-your-passwords-in-one-secure-place/
December 10th, 2007 at 7:35 pm
Thanks!
Upon further investigation, i found this: http://www.engadget.com/tag/apple%20keychain/
The keychain picklock! How scary. Maybe Keychain isn’t the best tool to use afterall.
December 17th, 2007 at 8:59 pm
Update: Just ran across Password Safe:
http://www.schneier.com/passsafe.html
Password Safe is the PC answer to Keychain. It’s FOSS and the author has great credentials. Note, however, that Password Safe uses Twofish, not a PGP variant, so you dont have to keep a back up of your private key.
“Password Safe protects passwords with the Twofish encryption algorithm, a fast, free alternative to DES. The program’s security has been thoroughly verified by Counterpane Labs under the supervision of Bruce Schneier, author of Applied Cryptography and creator of the Twofish algorithm.”
December 17th, 2007 at 11:23 pm
Some security gurus advise against frequently changing passwords. In reality, if someone steals your password, they are very likely to use it before your scheduled password change anyway. And the method they used to steal it before the change can be repeated to steal it again after the change.
Frequently changing passwords results in other unsafe practices — like weak passwords (easier to remember), patterns (so if I steal one password I can derive the next one), writing down passwords, etc.
December 18th, 2007 at 12:41 am
One way I use to create my “master password” so I don’t have to write it down but don’t forget it is to choose a favorite song and use the first letter of each word in the verse. That way I can remember my password, it appears random and allows me access to the file where all my other passwords are encrypted.
Example:
Song: Row Row Row Your Boat
rrrybgdts
I typically add a number to the beginning or end of the string to make it harder to crack.
December 3rd, 2008 at 6:47 pm
[...] (And the moral of the story? Don’t be like Alex’s mom.) [...]