You're viewing a single thread.
2 words for you:
Password ManagerGet around to using one :P
I only remember my password to my PW manager, which additionally is encrypted with a key file to increase security.
The rest of my PWs are 128 character long random generated PWs, with capitals, numbers, special characters etc..
Yep. Several years ago I switched and it took a little getting used to. But now I would not want it any other way. The plugins in the browsers make it convenient and also a proper app on your mobile and you are set to go. Click on a password field and then you can click on the plugin to fill the fields.
I wish all my passwords were 128 characters. Most sites won't allow anything that complex. Because apperantly making the password hash field longer is hard /s
Where do you keep the key file and the PW managers DB? I feel like they would be too much side-by-side to really increase security in my case
Can always use a service like bitwarden, even their free tier is very good
I won't disclose where I store mine.
But I'd recommend to:
- Not backup your PW manager's database + key file in the same location
(That would decrease security, x1 data breach would allow them to easily brute force your PW DB since they'll have the key) - Not go with a PW manager that does not allow you to choose a location where you desire to backup to (Seen plenty of mainstream PW managers getting data breached by now, so going with a cloud, which is not solely used for PW managers, has an advantage imo, since they tend to be less targeted by hackers)
I've been happily using KeeWeb + Keepass2Android for years now:
- Not backup your PW manager's database + key file in the same location
You could use a USB drive that you only ever plug in to open the password manager. It's not the most secure option but it's a bit better than no key file at all.
Can't use it with a phone though. To be honest, I think just having a password manager gives you protection against 99% of the attack surface. And if someone is really determined, I'm not sure the key file will be hard to obtain for them no matter what. But I was curious what setup others have
If someone is really determined to attack you specifically they will just get a wrench.
or store the key in a tpm chip protected by password +biometric auth? that's what kost OSs do for storing passkeys and encryption keys
I have tried to use a password manager like 3 separate times now and can never seem to get the hang of it