So you have a million passwords, right? Every site out there requires you to enter a username and password to buy a widget that plugs into your doohickey for whatever silly little hobby you have that is supposed to distract you from writing code in your free time so you don’t feel like a complete loser.
Or better yet, you need a username and password to buy flowers for your wife. Or you need a username and password if you’re buying a $3.75 Cozy Coupe Wheel With Capnut, plus $7.95 shipping, when all you really need is the damn capnut anyway because the first one got slightly bent during assembly so every now and then the wheel pops off and your horrified toddler is trapped in plastic car wreck. Or something like that.
And of course, we all know that you shouldn’t be using the same password everywhere. At the very least, you should be using a different password for everything important and sensitive, like email and banking and online gambling.
Some say Open ID may be the answer. It certainly is gaining popularity with many sites in the development community. But the real test will be if it ever catches on with people who have real lives, and really couldn’t care less about your cool new shared authentication mechanism, and don’t really know or care that they shouldn’t reuse their favorite celebrity’s nickname as their password everywhere.
But even then, even if the world were to become thusly enlightened, a large number of the sites our there start using Open ID as their core authentication, there will still be countless little sites out there written by internal IT departments who have never even heard of Open ID and certainly aren’t going to trust some new-fangled “Web 2.0” technology, when they’ve spent the last 10 years working their way up to “Enterprise Architect” of their little fiefdom, and they are certainly smart enough to build a completely secure authentication system from scratch that is going to be so much better than anything anyone has ever seen, thank you very much.
So, yeah, you’re probably still going to be stuck with a million passwords. Or maybe just half a million, but it’s still the same problem. If someone dumps a half-ton of manure on your front lawn, are you really relieved that it wasn’t a full ton?
Password Safe to the rescue
I’ve been using Password Safe for years, and I definitely recommend it. It’s very easy to add new entries, to quickly generate secure passwords, and to attach additional notes (like the answers to the stupid security questions that don’t have clear and definitive answers).
Of course, it doesn’t have to be Password Safe, there are plenty of other good and free products out there, but I’m not that familiar with them so I’m going to assume that they make your computer burst into flames.
Another benefit of Password Safe, besides the lack of flames, is that the database is very portable, so you can easily copy it to another computer. However, what about keeping the databases synchronized across multiple computers you ask?
DropBox to the rescue of Password Safe’s … rescue, or something
Since the Password Safe database is just a file, it’s actually pretty easy to keep them synchronized across a few separate machines. As a pathological-job-hopper-turned-consultant, I’ve usually had some new machine for some reason every six months or so, and I end up with a LOT of copies of my password database floating around. But after a few years of headaches and manually copying/merging password databases, services like DropBox came along and solved the problem for me.
Since DropBox treats a directly on your machine as a share and automatically syncs that directory across all of your machines through the DropBox cloud (+1 Google buzzword, yay), then all you have to do is to keep your working copy of the password database on your DropBox share, and voila, you always have your up-to-date passwords at your fingertips.
Well almost. Of course, there is one gotcha. When you have Password Safe open in read/write mode, it locks the file (more specifically, it locks the .plk file). This will actually prevent block the DropBox sync process and prevent it from synchronizing not just the database file, but also anything else on the share. If you’re like me, you very rarely make changes to your password list, so I just go into Password Safe and select the option to always open database files as read-only by default, and everyone is happy.
Pingback: Tweets that mention The Mooney Project » Blog Archive » Password Management for Dummies (and Developers) -- Topsy.com
Ideally you should remember your thousand passwords. To do so, some people generate the password by a function of one or more parameters (the url, domain, type of service, etc..).
I used RoboForm for a long time, but it’s Windows only so I finally gave it up for http://www.lastpass.com . LastPass provides clients for Windows, OSX, Android, etc. Auto synchronizes across all instances. Integrates with the browsers, but can also act as a generic encypted notes data store. All information is encrypted/decrypted locally, so it has same security as your dropbox solution. Just another option.
I use portable keepass via dropbox. Synchronizes all platforms.
Yes, that is the other common approach, having some hash system for being able to re-generate the same password over and over. Personally I prefer being able to store an arbitrary a list of passwords, because it’s easier if you are assigned as password by a third party, or if you want to change your password often.
Hi Josh and Can, I’ll take a look at lastpass and keepass. Thanks.
[…] This post was mentioned on Twitter by Richard Laksana, Kirill Vlasov. Kirill Vlasov said: Password Management for Dummies (and Developers) http://is.gd/cmSwk […]
Hi there! Don’t you use Facebook? I would prefer to follow you if that might be alright. I’m absolutely enjoying your web site and look forward to new articles.