[ale] password management

[Robert L. Harris]

I keep 2 copies of my password list.  The first is in my home directory
at home as well as work.  It is gpg encrypted with a 2048bit key.  If I
need an individual password I don't have memorized:

gpg -d passwords.txt.gpg | grep host

Puts it to my screen and not on disk.  I also keep a copy of this file
on a USB memory stick on my keychain.  It's very easy to keep these in
sync with rsync.

The second copy I keep on my PalmPilot.  If you go to: 

http://www.linkesoft.com/secret/

You can get "Secret!" for PalmOS which is 128Bit encryption, autologout,
etc.  This is great if you also get "SecretDesktop" which can read a
PDA's sync'd files from Intellisync.  Basically I can keep up small
changes easily or I do this when a major password change happens:

Sync my Pilot
gpg -d passwords.txt.gpg
copy the output of the gpg to a certain samba shared folder (I do this
  at home only)
Open the file on the share in notepad
Open SecretDesktop
Paste the info into SecretDesktop
Delete the file on the share
Resync my Pilot


Works very well for me.


Thus spake Christopher Bergeron (christopher at bergeron.com):

> Does anyone have any good tips on how to manage passwords?  I did a 
> quick tally today of how many passwords we need to keep track of and I 
> stopped at the 100 mark.  We use passwords for different boxes, vendor 
> services (T1 management websites, etc)., client files (pgp), client 
> websites, phone systems, jetdirect boxes, all-in-one copiers, email 
> clients, routers, vpns, etc...  I'd like to implement LDAP here, but I 
> can't convince management to let me spend time on it (just to make my 
> life easier).
> 
> Sooo....
> 
> What I was wondering is if anyone has any tips on how they keep track of 
> many UID/signon/passwords.  I've seen keychains, etc, but I'm sure I 
> want to key about 100 passwords into a little keychain.  I currently 
> have them all written down on 1 page of a notebook (that I guard with my 
> life).  I know it's probably not best practice, but it's impossible to 
> keep all that stuff in [my] memory.  Does anyone have a good algorithm 
> for creating passwords that might make my life easier?  If comporomised 
> it would probably mean a world of hurt, but I need to come up with some 
> kind of solution...
> 
> What do you guys use (aside from LDAP or Radius)?  Any suggestions?
> 
> Thanks,
> -CB
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale

:wq!
---------------------------------------------------------------------------
Robert L. Harris                     | GPG Key ID: E344DA3B
                                         @ x-hkp://pgp.mit.edu 
DISCLAIMER:
      These are MY OPINIONS ALONE.  I speak for no-one else.

Diagnosis: witzelsucht  	

IPv6 = robert at ipv6.rdlg.net	http://ipv6.rdlg.net
IPv4 = robert at mail.rdlg.net	http://www.rdlg.net

 PGP signature