How do you store your passwords?

[frozenJim]

[sokai]

To use the password-file, you created by using Password Gorilla or MyPasswordSafe, under the Linux-console you can try pwsafe.
So I handle my passwords under Windows, Linux and the Linux-console across our net with a lot of Workstations and Servers.

[Simius]

Well, I have put some thought into this password device idea...
However, I'm not entirely sure that it would be the most practical - and safe - method.

What do we need?
- portability
- security
- reliability

The keypair encryption is maybe the best method in terms of security, so let's start out from here.
Having the private key on the very same unit the encrypted file is on - a workstation connected to the Internet -, defeats most of the security overhead keypair encryption offers. This setup can be called fair when we encrypt for transmission, but not for storage.

So I think we should have the private key in two copies - a paper hardcopy (honestly, I don't trust CDROMs enough to call them a hardcopy) and on a USB flash drive. Sure this can be stolen, but then again, your front door keys can be stolen too. And if it IS stolen, you do the same thing you would in the case of the front door keys - change the lock. That is, take the hardcopy, key it in, issue cancellation certs to all your communication partners, and re-encrypt any stored data with a new key.
(To defeat even the slight chance that the key might be stolen when it is in use on a computer, one could create a small computer that does all the encrypting, decrypting and signing via USB, and has different ports for uploading the key and for standard data traffic. This way, the key can only be stolen in a physical manner. Maybe there's already something like this on the market.)

The encrypted password file could even be kept on the Web, so you can access it from anywhere, and you could take the private key on the USB flash drive with you in your wallet...

[nielchiano]

[tgh]

In general, if the box is rooted or otherwise untrusted, you shouldn't use it for secure operations.

...

I go for the KISS principle with password storage. A GPG/PGP public key pair with a good, longish passphrase. I then encrypt the contents of individual text files, one per website / service. Easy to back up, I can encrypt certain passwords with multiple keys, and I can print out the ASCII armored text blocks to paper (or send them to a g-mail account, or hide them in the corner of a web/ftp site...).

The problem then becomes how to keep the secret key and the passphrase private, which is easier to do then keeping a few hundred account files secure.

[frozenJim]

[Aurisor]

I have a piece of paper I keep in my wallet. I figure if I lose my wallet I'm going to have to get new driver's license and credit card, so the hassle of changing all my passwords isn't that bad in comparison.
_________________
The problem with seeing too much is that it makes you insane. --Phaedrus

[frozenJim]

[figueroa]

[nielchiano]

[figueroa]

[nielchiano]

[elpeor]

I found a nice app that just takes fpm database:

admin/kedpm
Latest version available: 0.4.0-r1
Latest version installed: 0.4.0-r1
Size of files: 60 kB
Homepage: http://kedpm.sourceforge.net/
Description: Ked Password Manager helps to manage large amounts of passwords and related information
License: GPL-2
_________________
--ELPEOR--

[djdunn]

I keep my passwords in a piece of paper on my desk, the chicken scratch i write with is better than any encryption...
_________________
Now, with penguins, (cuddly such), "contented" means it has either just gotten laid, or it's stuffed on herring. Take it from me, I'm an expert on penguins, those are really the only two options.

--Linus Torvalds

[quag7]

I used to carry a paper in my wallet that had what appeared to be notes from a college literature class. Each two bullet points had a hint which would help me remember a password. If stolen, it would look like a bunch of literature notes.

For example, I had a password which was !z00ey451 as:

* In what ways did the Glass family embody Salinger's Buddhist beliefs or principles?
* For what reason are Salinger's books commonly subjected to censorship?

The first question = Glass Family = Zooey Glass from J.D. Salinger's Franny & Zooey
The second question = censorship = book burning = Heinlein's Fahrenheit 451

Now of course I had to be vaguely familar with the passwords I chose. These would simply help me to remember them and pair together numbers and names.

I don't have that paper anymore, but I was able to store almost 30 passwords via this method. There was no way of telling that the paper was anything other than a list of assignments or notes. I forget how I tied the passwords to specific systems or resources, but I was able to, through encoding that into the bullet points.

All passwords had set of rules which applied universally to add additional characters in - like if the password begins with a letter, then it would have an exclamation point at the front...or something along those lines.

This sounds complicated but it worked for me for about 5 years.

There are probably lots of ways of encoding meaning into something that looks like a grocery or "to do" list - or even graphically.
_________________
http://www.dataswamp.net

[nielchiano]

quag7's method looks nice... but I don't think it's practical for random passwords... since that would require too much bulets/passwd.
Also: loosing your wallet/paper ruins your passwd database...