I use random passwords (base64-encoded, 48 bits of entropy:
8 characters), one for each site, all written on several pages in my
wallet.  It solves remote problems (if anyone gets my password from a
site, they already control that site, they won't get access to other
sites).  (Guessing the password for a site is imo impractical, changing
them should help.)

This solution depends too strongly on physical security and not losing
the wallet (and limits the choice of wallets and clothing to ones that
can fit the password list).  It has another problem: many such random
passwords do not contain special symbols required by some sites.

I know several other solutions:

- some first digits of SHA2 sum of a single secret + site domain name;
  needs a terminal

- an encrypted file with passwords: I don't know a good solution for its
  synchronization between multiple computers; not ok for computers that
  I trust for some passwords only

- single password, OpenID, etc: bad for security and won't work for
  sites not supporting it or requiring frequent password changes

- easy to remember passwords (http://xkcd.com/936/): imo not practical
  for 70+ sites requiring them

Attachment: pgp4AV6nGQ0bY.pgp
Description: PGP signature

Reply via email to