[lug] password generating techniques

[Rob Nagler]

> 4) use a password manager like Kevin suggested

I use an encrypted file, but it isn't a "password manager" as I'll be
relying on people's ability to write good software.  I don't have much
faith in that.  :)

Certain passwords, like Amazon, are easy to remember, and aren't
randomly generated.  I (and others in my company) use this site to buy
things.  I make a conscious choice of buying the majority of things on
Amazon so I don't have to 1) trust random sites and 2) remember the
passwords.  The cost of a crack is very low, because I'm protected by
the fraud policies from my CC company.   The cost of always buying on
Amazon is miniscule in comparison to having to open my encrypted file
and having my computer hacked.  I try to avoid going into the
encrypted file as much as possible.

> 6) write the strong passwords on a piece of paper

I print out my encrypted file and store them in a vault at a bank in case.

I would never use a third party server (VPS, dropbox, or otherwise) to
store this file.  The way I store the file is also obscured in
interesting ways that make it even harder to find.

I generate random passwords for sites.

All VPS providers get their own very long unique email (not stored on
our servers) and password.  I don't login to the management consoles
very often.  I rely on VPS for non-essential servers and standby's.  I
am quite convinced that the Cloud is highly insecure, and will be
cracked at some point (in a very bad way) so I can't rely on them as
my primary servers nor to store our primary backups.

As to getting into machines, I do not rely on keys for ssh (except for
backup, obviously, but these are VERY secure).  Given the amount of
CPU available to crackers, I believe any key file is crackable within
a relatively short amount of time.  ssh keys are in a known location,
and worse, many people uses ssh-agent, which is a recipe for disaster
with a local exploit. I use relatively secure, tiered passwords which
I can remember.

If someone installs a key logger, I'm relatively safe from a business
continuity standpoint (my primary concern).  No one can get to other
machines unless they are sniffing at the time.  My most secure
machines I visit "almost never" and often only from the console.  The
chance I'd discover an exploit before I visited them is quite small,
therefore.  If, however, I use key files, the attacks can be taken
offline.  For my local password to be cracked, someone has to get
access to /etc/shadow, which is a root exploit (admittedly easier once
on the target).

Rob