Re: Secure Password Storage
On Wed, 13 Oct 2004 18:18:02 -0500, Jacob S <stormspotter@6texans.net> wrote:
> Ok, so I know that using key based authentication is better, and that
> you should never write down passwords. But, I don't know of any websites
> that allow key based authentication (yet) and 135+ passwords is hard to
> memorize. :-)
I'll say!
> So, my next thought was removeable media. But, what happens if I lose
> the removeable media (falls out of my pocket, gets stolen, etc.), or a
> 'friend' snoops files they shouldn't?
>
> I could encrypt them using ssh, but now I have to carry a second
> removeable media with me at all times - for my ssh key - and hope I
> don't lose both pieces of media at the same time. If I don't carry my
> ssh key with me, I've just lost the functionality of always having my
> passwords with me. I could do a password protected zip file, but that
> seems pretty weak to me.
One thing that comes to mind is, as has been mentioned,
password-protected gpg encryption, which seems to be what you intended
to say here. There's no real reason
to have to carry multiple removable media, though. All you need is a
protected "keyring" where the keys are really passwords. Since
everything is secure so long as your master password is good, you can
store multiple copies of the keychain, keeping one on your home
machine. You can create dummy secret keys and attach comments to them
(or so it would seem according to the man page -- I only see an option
to export them: --sk-comments). The comments would be the passwords
for the accounts, which are the user IDs.
> I also don't have a laptop, so I realize that presents a whole new set
> of complications and ways for privacy/security to be compromised in
> regard to my passwords and keyloggers, etc.
How so? Do you mean you don't have a computer of your own at all, and
always have to use public or friends' machines? That certainly could
complicate things, since you need a trustworthy environment in which
to set up your password keyring.
> So, does anyone have any other suggestions for good ways to store
> passwords in a fashion I can carry with me yet keep them secure? I'm
> pretty much resigned to the fact that anyone that *really* wants to get
> the passwords can, if they have the removeable media and enough time,
> but I don't want to make it any easier on them than I have to.
Another option is to do what a friend of mine does. He has one "real"
password from which he generates the passwords he actually uses. The
actual password for a system, say foo@bar.com, is generated with a
cryptographically good hash function, such as SHA-1, by concatenating
the account name with the master password. All you need is a way to
translate the 20-byte output into something that you can type in. He
keeps the program to generate the passwords on his PDA, but there's no
reason it can't be kept in multiple places. You end up only having to
remember one password, but you get a unique strong password for each
system.
--
Michael A. Marsh
http://www.umiacs.umd.edu/~mmarsh
Reply to: