"Depending on your usecase" - e.g. you use many devices, need your passwords on all of them, and don't trust any of the current password managers to do their job (which is valid due to the many breaches and vulns).
back
1 comments
Is the reality that your home-grown solution is genuinely going to be more secure than one of those current password managers? I doubt it.
However, I agree that for some people existing password managers seem either too complicated (KeePass) or expensive (1Password). In that case, I recommend:
1. Generate a password randomly using a 'diceware' type methodology
2. Use a standard prefix in front of all your passwords.
3. Write the password without the prefix in a notebook that you carry everywhere.
It's still not as good as 1Password because the passwords are not encrypted. But it's better than using a predictable algorithm that you have to remember. And of course, it's better than the system this often replaces - using the same 8 character password everywhere.
But I still strongly recommend paying for 1Password. How much do you pay for a padlock for your bike, or a burglar alarm for your house?
I never claimed it was more secure than a password manager. Just 'surprisingly' secure. You get something easy to remember with a lot of entropy that's difficult even for someone targeting you to exploit and which mitigates against the more common attack of cracking passwords en-masse from a leak and retrying them.
Yes, it has its own attack vectors, but they don't include things like ads stealing your info from your password manager [0] and apps stealing your passwords from your clipboard [1], both of which are legitimate reasons why you might want an alternative to a password manager.
"home-grown solution" has very negative connotations in infosec and rightfully so. I don't like seeing it in these kind of contexts as it blurs an important distinction between "Don't write your own random number generator if you're creating an app like Signal" (don't do it) vs "Find a solution to deal something as shitty as passwords in a way that works for you" (do it).
Your recommended method might also suit some people better (e.g. people who already carry a notebook around everywhere and guard it carefully).
There are no silver bullets out there. Work out what your needs are and then find a reasonable solution. It might be a password manager. It might not be.
[0] https://www.theverge.com/2017/12/30/16829804/browser-passwor...
[1] https://arstechnica.com/information-technology/2014/11/using...