Which password manager do you use?

[bazineta]

There are 18,170,005,425,000 possible combinations using 8 characters...Good luck trying to figure out my personal algorithm out of 18 TRILLION possible combinations.

If the hashed and salted version is available to me, i.e., a leaked password store like Yahoo's, a brute-force against only 18 trillion using current off-the-shelf video card hardware is, well, not going to require a lot of time, frankly.

The only thing that matters is length. Special characters, numbers, smiley faces, whatever, just doesn't matter to a machine. If you're using only 8 characters, that's not enough at present.

However, every one-character increase nets a very large result. Presuming that the site you're using the password on is using proper storage techniques (unfortunately, history shows that typically not to be the case) the content is largely irrelevant so long as the length is adequate.

[NYT]

A lot of companies enforce the "special characters, capitals, and numbers" thing but it's flawed reasoning. Adding a number to your password only adds 10 more possible options per space, insignificant for software trying to brute force crack a password. Specials add another 30 or so, also insignificant.

This comic explains it really well:

http://xkcd.com/936/

And if you feel like testing your password strength:
http://www.passwordmeter.com/

companies enforce those requirements because they are often subject to auditors who require them.

i agree with you though which is why my main passwords are passphrases.

[Calico1404]

Ginkgo biloba-

Perfect against hacks, no 3rd party penetration, no monthly updates.

No backing up, no loss of storage. It's great.

[M1NM]

Mine is unhackable - pen & paper

[glockman19]

If the hashed and salted version is available to me, i.e., a leaked password store like Yahoo's, a brute-force against only 18 trillion using current off-the-shelf video card hardware is, well, not going to require a lot of time, frankly.

The only thing that matters is length. Special characters, numbers, smiley faces, whatever, just doesn't matter to a machine. If you're using only 8 characters, that's not enough at present.

However, every one-character increase nets a very large result. Presuming that the site you're using the password on is using proper storage techniques (unfortunately, history shows that typically not to be the case) the content is largely irrelevant so long as the length is adequate.

I use a minimum of 8 characters. I haven't has my passwords hacked yet and I'm a Yahoo user.

[ocabj]

If the hashed and salted version is available to me, i.e., a leaked password store like Yahoo's, a brute-force against only 18 trillion using current off-the-shelf video card hardware is, well, not going to require a lot of time, frankly.

The only thing that matters is length. Special characters, numbers, smiley faces, whatever, just doesn't matter to a machine. If you're using only 8 characters, that's not enough at present.

However, every one-character increase nets a very large result. Presuming that the site you're using the password on is using proper storage techniques (unfortunately, history shows that typically not to be the case) the content is largely irrelevant so long as the length is adequate.

This is why I have been wanting to enforce password aging specifically for non-MFA accounts (e.g. root), but people are against it. If a password changes on a regular basis, I don't care if a password hash is compromised, because by the time it is cracked through hash tables, hash collisions, etc (and assuming it has some decent length/complexity), it will have rotated anyway.

[Zorba]

I use lastpass also.

What irritates me are sites that won't allow "special characters" and/or can't work with long passwords. Its actually HARDER to write code that rejects certain characters than to just do a simple string comparison!

The sheer amount of crap code on all levels is staggering...

[speedrrracer]

I also use Keepass . Great app and it's also available on mobile devices.

I've been using Keepass for a few years now. Free, and works on every platform. Store the db in your free Spideroak account, and it's reasonably secure, and it'll auto-sync to all your devices.

If you are willing to accept more hassle for more security, I also like the LastPass w/2-factor auth.

[Chris M]

So, using P@ssw0rd for all my website logins is a bad idea?


I use Keeper, and use a password generator for each login. Usually 20 characters, uppercase, lowercase, numbers, symbols. Some sites don't allow more than 15 characters or certain symbols, so I have to change the settings occasionally.

[Flyliner]

1Password for me. I couldn't get over LastPass being browser based, just a pet peeve of mine.

Folks keep in mind that both of these applications store their database in the cloud encrypted. Even if a datacenter employee grabbed your cloud files, your password manager database is encrypted and safe.

I in fact encrypt everything I store in any cloud service I use, would never put anything in the cloud in the clear...

[dscoduc]

Used to use Lastpass but switched to Password Safe and haven't looked back...

[bbguns44]

No way I'm allowing any software & cloud to control my passwords. Also not going to pay a dime. Not hard to manage passwords yourself.

[ocabj]

No way I'm allowing any software & cloud to control my passwords. Also not going to pay a dime. Not hard to manage passwords yourself.

LOL. I'm waiting for the "Get off my lawn" quote.

[ocabj]

Out of curiosity, how many credential sets do you guys have? I checked my LastPass vault and I have 293 different accounts for various applications and web services. This does not include the 100+ odd secure notes for things like private/public key pairs.

Note: This is my count for my personal (non-work related) credentials.

[mikeyr]

keepass, its FREE and works great. I keep the password file in DropBox and access my passwords from all my computers, both Windows and Linux at work and Macs at home, I also have it on my iPhone, so I have my passwords any time. Been using Keepass for about 10 years now.

At work my company pays for Password Wallet and we are free to use professionally and personally, I found keepass to be much better and continued using it.