I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game?

My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc.

Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?

As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons:

- people forget

- you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords

- this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk

These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because:

- you don't store passwords

- you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password)

- your users can't forget their passwords

- it's pretty much just as secure as your email, which is probably gmail, which is fine

I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.

Your assertion that you need a "system" to remember multiple passwords is simply false. In fact, I generate passwords with a random generator I wrote in python, just like any software "solution".

You did touch on one of my secrets, I don't maintain hundreds of superfluous "accounts". I'm not going to count them, but I suspect I'm at around 30. If I don't log into a service for a long time then I just go ahead and transition that to "never" in which case it doesn't matter if I remember the password or not since it's clear I don't need that account anyway.

I also use unique logins and emails with each service which I guess is even more to remember.

For throwaway accounts and things that really don't matter I use an easier to guess (and crack) leetspeak pw and/or a post-it note.

I suspect people who are not techies have even fewer accounts to remember so this may actually work for many (though I agree, not all) of them. Probably more than you give credit. In fact I assume that most non-techies are simply keeping credentials in their memory in which case the best advice is probably just to remind them to use unique ones, at least for their email and their bank...

I've also worked help desk and no one ever called to report that everything was hunky dory.

Anyway, I appreciate you taking the time to address the issue rather than just leaving another drive-by downvote.

Yeah I mean, there may be a goldilocks zone of sophisticated enough to remember 30 random strings of text but not sophisticated enough to need to remember 300 random strings of text, and yeah if it works for you that's awesome (I keep thinking I'll try and get my memory back to where it was when I was in college, but I keep forgetting to do it!! :P)

And yeah I think the big bad we're working against is people using the same password (or a password with some very small variations that's super easy to guess from a variant) across all their services. I'm sure almost everyone does this, I even know sophisticated engineers who do it, I also do it for accounts I don't care about. "Use a password manager browser extension" is the easiest thing for us former help deskers to tell people, and as long as that person didn't choose LastPass (which you should never have chosen, how many breaches will it take) they'll be in great shape.

So you’ve memorized multiple hundred passwords of high complexity and uniqueness? I’m impressed if so but kind of doubtful.

So you log into hundreds of unique accounts each month? Why?

Maybe not every month, but having hundreds of unique accounts is quite trivial to do. For example I manage dozens of accounts for friends and family for a variety of reasons. The fact that I don’t log into these accounts every month makes it even harder to remember them.

“Just have less accounts so you can remember your passwords!” is not real advice

I'll warrant that if you have hundreds of accounts you rarely log in to then it may behoove you to record them somewhere. However in this case I'm not sure a password vault is superior to just keeping them on an encrypted volume on a thumb drive. And I'd still argue its best to keep these rarely-used credentials siloed from your day-to-day passwords, especially if they're being held in trust for someone else (really each client should have their own silo).

That’s a good point about siloed credentials, I honestly never thought about that.

However I’d say give that the password vault is open-source and can be self-hosted (like Bitwarden) there are many reasons to use it over an encrypted flash drive. It can be automatically backed up easily, is supported on every device (including mobile) via a web browser. It also includes useful tools like a configurable password generator, versioning, and auto fill. For the average person that is much better than an encrypted flash drive volume, which IME are platform locked (LUKS doesn’t work on Windows, Bitlocker doesn’t work on Linux), are much less convenient, and are much more fragile.

Of course, use whatever works best for you, I don’t know your situation.

Sure, but for passwords you rarely use the added convenience of things like autofill seems less impactful compared to the added attack surface.

Over 20 years, probably.

Not the person you're responding to, but: My keepass database has over 250 entries over the last decade. There's no way I could remember a unique password for each entry.

If you could explain how "monthly" is relevant to the discussion, that'd be great.

I’m a happy user of 1Password for Families, which I only mention since it means >1 person is storing in our vaults (and 1P isn’t as vulnerable to “my backup has unencrypted URLs stored in it” — one of my main issues with LastPass’ latest breach).

Like you we have TONS of credentials (and other supported items), around 2800 vault items in total, some of which we definitely only use once a year, others we use multiple times per day. Probably started using a password manager and some technique to share some vaults around 2010, so also a decade.

> "... around 2800 vault items in total... "

This is absolutely insane to me.

The number of people reporting needing access to multiple hundreds or more of required credentials is blowing my mind. If this is the reality of how people are using the internet these days then we desperately need a better cross-platform solution to identity management and authentication than can ever be offered by passwords. These vault programs are sounding more like a horrendous bandaid than the mere unnecessary convenience I viewed them as.

If you need to share passwords amongst multiple people I guess I can see some of the appeal of these networked vaults, but it strikes me that even this is a drastically subpar situation that ought to be handled on a deeper architectural level (like with sub-accounts and ACLs).

> This is absolutely insane to me.

What's absolutely insane to ME is how consistently your responses seem to ignore that other people have different use cases for passwords. Nobody cares if something seems "insane" to you. It may surprise you to discover that services like these exist, perhaps, because people interact with passwords in a different way than your "I only keep passwords that I use monthly" brain database paradigm.

You can't seriously be telling me that managing 2800 secrets for a single "family" isn't evidence of a broken system. Unless GP is doing IT for the actual mafia I stand by my assertion that this is nuts and we ought to consider whether there's a better paradigm we could be pursuing.

To whoever is reading this: I am not doing IT for the Mafia. ;)

I mean, this is all apples and oranges, but if you could, examine your browser history across all devices as a household going back let's say 10 years. Lots of sites, right? How many did you ever create an account on for whatever reason? Are those all in your vault today? They essentially are for us. To the very best of my knowledge (and there's functionality in 1Password to analyze this, obviously anything not in vaults is invisible to it however) we have no duplicated passwords, anywhere on the internet.

To give some examples of how we do use 1Password, in terms of "Online Shopping" (just one of our shared vaults) that has 100's of credentials for everything from Amazon through Walmart and covering whatever we buy online from groceries to ammunition. Tons of more specialist or niche suppliers like Christmas Designers also make you 'Create Account' to have order histories and to be able to track shipments - this one in particular is a great place for garland, lighting and other holiday items, tis the season!

1Password also stores all our rewards programs (i.e. Store Cards, Airline, Hotels). I'd guess we are signed up with 40-50 merchants for some kind of "Rewards" (i.e. Fred Meyer or QFC, and where the ROI for signing up for their program is some items will be $2.49 instead of $4.49 on offer). I have traveled a lot for business and so can't always fly one carrier alliance or stay entirely within one hotel chain, so I guess that's another ~20 (airlines) and ~20 (hotel chains) for you.

I'm not going to memorize software licenses (serial numbers or license files for e.g., Bartender for macOS), nor other access tokens (i.e. SSH Keys, API Tokens) to various geekery.

Two other things which end up helping a lot, one of which adds lots of vault items: the integration story with Privacy [1] and Fastmail [2]. We've used and loved Privacy for a long time, and this integration stores the unique per-merchant credit card details in a vault. With Fastmail you can create 'Masked Emails' so you've got a unique email for each place you signed up. We've easily rotated both card details and emails on accounts when we find out someone was compromised, and with these integrations we're only rotating that site, not potentially 100+ sites using say the same Chase Sapphire card.

[1] https://blog.1password.com/privacy-virtual-cards/

[2] https://1password.com/fastmail/

"sub-accounts and ACLs" sounds just as awful to me, if not worse, quite honestly. Imagine managing an "Account" at each of 100's of online merchants and other sites like Netflix, where each has >= 1 "User", and "ACLs" (permissions).

I am entirely happy for my family to just have access to the Amazon or Netflix email addresses (logins) and passwords without any of that overhead.

Monthly is just a simple test to see if you're actually using these accounts. I'd say start by reconsidering if you need these accounts at all and if you decide you do, go ahead and keep them in a software vault. But I still recommend keeping the ones you use once a month or more in your head. It will be more secure (and possibly more convenient) and if you are using them this frequently it will also be easy to remember them. I'd also posit that these frequently-accessed accounts are likely to be your most important ones, deserving of a little extra security.

I do the same. I have iterations written down in a safe but my family will have a hard time accessing my digital identity when I’m gone

How many?

Around 30.

That’s too few to be secure by about an order of magnitude, for me