Hacker News Reader

Hacker News

Comment by imaginenore | Hacker News Reader

Full thread

imaginenore

That's why you always

1) store passwords in the password manager, even the ones you think aren't important.

2) backup your data

View on HN

> 1) store passwords in the password manager, even the ones you think aren't important.

Losing the password that unlocks full disk encryption (FDE) is like losing the password that unlocks your password manager. At some point you have to have something stored only in your mind.

Now sure you could have your FDE password stored in a password manager as well but that's probably not a good idea. Also, compared to just about everything else saved in a password manager, you'd have to manually type the FDE password at boot. You can't copy/paste it as if anything your password manager would be running on a different computer.

Unless you use a hardware password mgr which can emulate a USB keyboard :)

> stored only in your mind

A sticky note at home is reasonably safe, unless you're legitimately worried that a dedicated person may target you specifically.

I have portions of my password safe passphrase stored with certain friends. If I get hit by a bus, those friends will almost certainly work out who each other are and what to do with the snippets they have. (And I "mind" several snippets of passphrase for some of them as well).

Not "nation state" secure, but I'm reasonable sure it's well beyond petty thief, curious cow-orker, 4chan/anonymous, or local LEO's capability to subvert.

It's easy to read off your phone and type at boot if you use a passphrase. You'll probably memorize it anyways after a couple of days.

How would backing up help? If you back up the encrypted data, then your backup is still useless because you don't have your password. If you back up an unencrypted copy, that defeats the purpose of encryption.

Backing up the password manager data (provided you did store all passwords in there, and that you don't forget at least the master password) would _definitely_ help in this scenario.

You could make a encrypted backup with a different password. That way if somebody compromises one drive they still have to work for the other.

But it's a backup? If you have one copy, you pretty much have the other, right? And that just adds another password you can't forget, lest you lose your data.

Scribbling the passwords in a notebook isn't a bad idea (although don't write "My Passwords" on the front cover). The security of physical things is well understood by most humans.

Just put the notebook in a safety deposit box.

You already have a lifetime of training for taking care of small, folding pieces of paper in your wallet.

That is true only for rapidly decreasing part of the population, especially in certain parts of the world.

Think of it as a small, non-folding piece of plastic in your wallet, then.

> Scribbling the passwords in a notebook isn't a bad idea (although don't write "My Passwords" on the front cover). The security of physical things is well understood by most humans.

"Not Passwords" :D

I don't write down my most important passwords and they're randomly generated gibberish. About a month back, for whatever reason I just couldn't remember one for a minute and it damned near gave me a heart attack. I think I ought to go with your strategy now.

> I don't write down my most important passwords and they're randomly generated gibberish.

How the hell do you remember randomly generated gibberish of a length that would be cryptographically secure?

Multi-word passphrases work great for me for everything that has to be kept in my mind safe. If I had to remember things like "LOZOktjR33IxVbACQsgicUtDubOyz9o2" I'd definitely have to drink less.

Even better, store the password with recovery instructions in your will. That's both safe and available because wills share many of the security treats of passwords. And it's also a good backup plan for your relatives to access bank accounts, cancel subscription services etc in the event of accidents.

And/or maybe in a sealed and tamper-evident container. So you or your family can access it in an emergency, but you will know if this has occurred. The hiding location could be outlined in your will?

how would a physical tamper resistant container work? just curious. if it's something one can buy, what prevents an attacker to buy one same container itself to replace the damaged after the fact?

Sealed with tape, with your signature on the tape? And/or some tiny mark on the container that's hard to find.

ah silly me I was thinking about buyable products but that sounds both easy and feasible

Or just remember TWO passwords... it's not that hard.

Reply on news.ycombinator.com