2 words for you:
Password Manager
Get around to using one :P
I only remember my password to my PW manager, which additionally is encrypted with a key file to increase security.
The rest of my PWs are 128 character long random generated PWs, with capitals, numbers, special characters etc..
Yep. Several years ago I switched and it took a little getting used to. But now I would not want it any other way. The plugins in the browsers make it convenient and also a proper app on your mobile and you are set to go. Click on a password field and then you can click on the plugin to fill the fields.
I wish all my passwords were 128 characters. Most sites won't allow anything that complex. Because apperantly making the password hash field longer is hard /s
Where do you keep the key file and the PW managers DB? I feel like they would be too much side-by-side to really increase security in my case
I won't disclose where I store mine.
But I'd recommend to:
- Not backup your PW manager's database + key file in the same location
(That would decrease security, x1 data breach would allow them to easily brute force your PW DB since they'll have the key) - Not go with a PW manager that does not allow you to choose a location where you desire to backup to (Seen plenty of mainstream PW managers getting data breached by now, so going with a cloud, which is not solely used for PW managers, has an advantage imo, since they tend to be less targeted by hackers)
I've been happily using KeeWeb + Keepass2Android for years now:
@mormund I used to store them in a paper notebook, away from the prying eyes of malware and other shenanigans. Now I also have them in a password manager for easy access in case I need them, if the account supports 2FA TOTP.
You could use a USB drive that you only ever plug in to open the password manager. It's not the most secure option but it's a bit better than no key file at all.
Can't use it with a phone though. To be honest, I think just having a password manager gives you protection against 99% of the attack surface. And if someone is really determined, I'm not sure the key file will be hard to obtain for them no matter what. But I was curious what setup others have
•
or store the key in a tpm chip protected by password +biometric auth? that's what kost OSs do for storing passkeys and encryption keys
I have tried to use a password manager like 3 separate times now and can never seem to get the hang of it
If you recognise yourself from this meme, please get a password manager.
Use a password manager, its way better. I use KeePass and sync the database across devices with syncthing.
I really appreciate that one last look Tom gives, it's the same way I look at the already decomposing carcass of my fancy new password, as if 'I will surely remember you'.