Anyone Use a Password Manager?

[Snow Dog]

I used to have a book of passwords but now I use LastPass. It stores all your passwords in the cloud and then you have a single password log in (once in a while). It'll generate passwords for you but there's nothing automatic. It works across all my computers (3) and the paid version works with smartphones and tablets. It's not perfect. Some web sites have weird log in urls and when a site reorganizes it gets confused.

I never change passwords unless I forced to.

[Buke]

I've been using Password Safe for a little while now. The fact that it was originally developed by Bruce Schneier gives me a little more faith in it than some of the other options out there.

[Mustonen]

I use lastpass for work. The enterprise version syncs w/ AD, which is slick, and you can lock it down so you can only access your vault inside the org. Make all of your passwords the longest, most complex, and random supported by each site and get rid of your trapper keeper of passwords. Every now and then we'll have a site that gives it fits, and you have to pay attention to it, but take care of it and it takes care of you.

If you're truly worried about single point of failure, tie it to MFA. It supports several. Mine is hooked up to a yubikey.

For passwords you need to remember, focus on password length over complexity or frequent changes. An all lowercase 16 character pass phrase is orders of magnitude more secure than a complex, 10 character password. It's also easier to remember and type. Just avoid anything that somebody might be able to guess via data mining.

[Mustonen]

Ah, thanks. I thought they regularly generated new passwords, since the expert advice is to change your passwords regularly. Seems like that would make for a better product, though it would cause the complication I mentioned regarding aggregators.

Last pass assists with password changes. It recognizes pass change prompts, fills old and generates new passwords, and then remembers it for you.

Frequent pass changes, as security advice, is overblown. If you use the same password for everything, sure.... But if you don't, what's the rationale?