# Anyone keep an emergency password reset list? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [May 20, 2013, 6:37am UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796 "2013-05-20T06:37:08Z")\ **Posts on this page:** 19\ **Page:** 2
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [May 23, 2013, 12:12pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/21 "2013-05-23T12:12:16Z")
> [@LynnM](#): > > Probably a naive question: > > Is there a disadvantage to using USB thumb drives instead of hard drives for this kind of backup? Such as reliability, capacity, encryption issues? > > I back up my Documents folder daily to two USB drives and stash them in a nearly thief-proof location; wondering if there’s a hidden gotcha to this technique. IME Thumb drives go bad every few years, but you should be able to tell when you can’t back up to them anymore. I use thumb drives for backing up everything I have at work (regular documents and QuickBooks). I like it over external drives because I just keep it in my coat pocket or car so it’s if there’s a fire it’s not at work (usually). But I do try to remember to get a new one every other year or so. Luckily, I can get one that’s large enough (and physically small enough to carry around) for $10 or $15. ---
**Author:** ![ThelmaLou](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thelmalou/32/390_2.png) [@ThelmaLou](https://boards.straightdope.com/u/ThelmaLou)\ **Post date:** [May 23, 2013, 12:46pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/22 "2013-05-23T12:46:06Z")
For me, it’s capacity. I have a lot of really big art files. Some Photoshop docs (psd) that are over 200 mb. I also keep multiple versions of things so I can edit in the future, reuse stuff, go back to earlier iterations if the client wants to, etc. Whenever I’ve done a delete/purge because of space, I’ve had it bite me in the ass. I have about half of each 1.5 T drive filled. ---
**Author:** ![LeeshaJoy](https://avatars.discourse-cdn.com/v4/letter/l/8e8cbc/32.png) [@LeeshaJoy](https://boards.straightdope.com/u/LeeshaJoy)\ **Post date:** [May 23, 2013, 3:28pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/23 "2013-05-23T15:28:59Z")
> [@LynnM](#): > > Probably a naive question: > > Is there a disadvantage to using USB thumb drives instead of hard drives for this kind of backup? Such as reliability, capacity, encryption issues? > > I back up my Documents folder daily to two USB drives and stash them in a nearly thief-proof location; wondering if there’s a hidden gotcha to this technique. My father, who works in IT on a college campus, informs me that thumbdrives and flash drives in general tend to go bad faster the more often you write to them, particularly if you’re overwriting older data. Just FWIW. ---
**Author:** ![wonderlust](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wonderlust/32/7237_2.png) [@wonderlust](https://boards.straightdope.com/u/wonderlust)\ **Post date:** [May 27, 2013, 3:00pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/24 "2013-05-27T15:00:04Z")
I recently started using LastPass, and I love it! I also have it installed on my iPad and iPod. Since it’s locally stored on my desktop computer, I’d like some input as to what password to use to log into Windows on startup. Should I use my same Master Password? ---
**Author:** ![The\_Second\_Stone](https://avatars.discourse-cdn.com/v4/letter/t/bbe5ce/32.png) [@The\_Second\_Stone](https://boards.straightdope.com/u/The_Second_Stone)\ **Post date:** [May 27, 2013, 5:31pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/25 "2013-05-27T17:31:28Z")
A old style rolodex or address book is great for having them written down and they can be put in a safe. ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [May 27, 2013, 8:41pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/26 "2013-05-27T20:41:42Z")
> [@wonderlust](#): > > I recently started using LastPass, and I love it! I also have it installed on my iPad and iPod. Since it’s locally stored on my desktop computer, I’d like some input as to what password to use to log into Windows on startup. Should I use my same Master Password? I’d say yes, except: if someone gets physical access to your computer and cracks (or otherwise knows) your Windows password, then they would probably try that as the LastPass master password as their first guess - then they have access to **everything**. Obviously that’s mainly an issue if you have _that_ written down somewhere a thief might find, or if there’s someone in your household who might be untrustworty. Maybe some mnemonic that you might figure out but an untrustworthy housemate is less likely to, to use as a variant - e.g. MyWindowsPassword for Windows, MyWindowsPasswordFirstGradeTeachersName for LastPass or something. ---
**Author:** ![I\_Love\_Me\_Vol.I](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/i_love_me_vol.i/32/521_2.png) [@I\_Love\_Me\_Vol.I](https://boards.straightdope.com/u/I_Love_Me_Vol.I)\ **Post date:** [May 27, 2013, 9:01pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/27 "2013-05-27T21:01:36Z")
> [@Dag\_Otto](#): > > A password manager such as Keepass is very useful. In addition to storing passwords, you can also store phone numbers for credit cards, answers to security questions, and the like. I am using a password manager called LastPass. But the thing is, I don’t really trust it because it seems to me that if all my passwords are retrievable using only one LastPass password then somebody only has to crack that one password to get access to all my other ones. Obviously this must have been considered by the folks who make password manager software, but I don’t understand how. What enables a password manager program to be secure? ---
**Author:** ![Leaper](https://avatars.discourse-cdn.com/v4/letter/l/4bbf92/32.png) [@Leaper](https://boards.straightdope.com/u/Leaper)\ **Post date:** [May 27, 2013, 9:03pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/28 "2013-05-27T21:03:28Z")
I think the point is that it’s secure _compared to the alternatives_, like writing them all down, or giving up and using easily remembered and insecure ones. ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [May 27, 2013, 10:04pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/29 "2013-05-27T22:04:19Z")
> [@I\_Love\_Me\_Vol.I](#): > > I am using a password manager called LastPass. But the thing is, I don’t really trust it because it seems to me that if all my passwords are retrievable using only one LastPass password then somebody only has to crack that one password to get access to all my other ones. > > Obviously this must have been considered by the folks who make password manager software, but I don’t understand how. What enables a password manager program to be secure? The bad guys have to: 1. Gain access to your LastPass files 2. Hack the password. To gain access, they have to either hack into whatever cloud storage you have it stored under (if appropriate), or gain physical (or remote, via keylogger / trojan) access to one of your devices. They’d have to figure out the master password just to decrypt the files, as well. So there’s two levels of security right there. I don’t know how common it is to have cloud storage hacked without someone knowing your password - certainly social engineering can play a role in letting someone get into your gmail or whatever ([as one writer found!](http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/)) in which case you can be really screwed no matter how you’ve safeguarded your passwords. So: obviously “safest” would be to have the information on a local machine which has no internet connection. And a strong master password, so that a casual thief couldn’t get into your files. But there are tradeoffs of convenience versus safety obviously. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [May 27, 2013, 10:14pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/30 "2013-05-27T22:14:47Z")
> [@wonderlust](#): > > Should I use my same Master Password? No. Use a separate unrelated password for that. The master password for your password manager is critical - never reuse it elsewhere, and make sure any other passwords you make up yourself give no clues as to what it might be. ---
**Author:** ![wonderlust](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wonderlust/32/7237_2.png) [@wonderlust](https://boards.straightdope.com/u/wonderlust)\ **Post date:** [May 27, 2013, 10:41pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/31 "2013-05-27T22:41:37Z")
Thanks, I’ll come up with a different one for Windows login. ---
**Author:** ![ThelmaLou](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thelmalou/32/390_2.png) [@ThelmaLou](https://boards.straightdope.com/u/ThelmaLou)\ **Post date:** [May 27, 2013, 11:32pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/32 "2013-05-27T23:32:11Z")
Here’s a site that generates strong passwords and a (challenging) mnemonic to remember them. > **[StrongPasswordGenerator (Get a Safe Password Now) - Privacy Canada](https://privacycanada.net/strong-password-generator/)** > > Generate a random password! You can choose between 4 and 32 characters, and include numbers, symbols, uppercase, and lowercase letters. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [May 28, 2013, 3:35am UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/33 "2013-05-28T03:35:11Z")
> [@I\_Love\_Me\_Vol.I](#): > > I am using a password manager called LastPass. But the thing is, I don’t really trust it because it seems to me that if all my passwords are retrievable using only one LastPass password then somebody only has to crack that one password to get access to all my other ones. > > Obviously this must have been considered by the folks who make password manager software, but I don’t understand how. What enables a password manager program to be secure? It seems as safe as a keypress to me. I don’t get the logic behind that either, but they’re very common. Hmm so it looks like having a list isn’t that uncommon. Now I wonder how to store this list, preferably somewhere with multiple access. ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [May 28, 2013, 4:28am UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/34 "2013-05-28T04:28:36Z")
> [@AaronX](#): > > It seems as safe as a keypress to me. I don’t get the logic behind that either, but they’re very common. > > Hmm so it looks like having a list isn’t that uncommon. Now I wonder how to store this list, preferably somewhere with multiple access. What’s a keypress? And what do you mean by multiple access? Something like one of the vaults which uses Dropbox etc. to sync the encrypted files to several devices? You could mimic that, to some extent, by keeping a regular typed-in-word-processor document saved in Google Drive or Dropbox or whatever, and putting a password on that document. I don’t know if those are encrypted as well as the big guns password vaults like 1Password, mSecure etc. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [May 28, 2013, 5:26am UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/35 "2013-05-28T05:26:36Z")
> [@Mama\_Zappa](#): > > What’s a keypress? > > And what do you mean by multiple access? Something like one of the vaults which uses Dropbox etc. to sync the encrypted files to several devices? > > You could mimic that, to some extent, by keeping a regular typed-in-word-processor document saved in Google Drive or Dropbox or whatever, and putting a password on that document. I don’t know if those are encrypted as well as the big guns password vaults like 1Password, mSecure etc. Those locked boxes in offices that hold all the keys? Maybe they’re called something else in the US. Yes, that’s what I meant. No point using a password manager on my phone if that gets lost. ---
**Author:** ![eenerms](https://avatars.discourse-cdn.com/v4/letter/e/cdc98d/32.png) [@eenerms](https://boards.straightdope.com/u/eenerms)\ **Post date:** [May 28, 2013, 12:54pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/36 "2013-05-28T12:54:52Z")
Yep it’s in with our living trust…have to update though. ---
**Author:** ![wonderlust](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wonderlust/32/7237_2.png) [@wonderlust](https://boards.straightdope.com/u/wonderlust)\ **Post date:** [May 28, 2013, 3:08pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/37 "2013-05-28T15:08:20Z")
The way I see it, a physical list is difficult to keep updated, especially if it’s stored in an obscure location. Every time you change your password (and you should be doing this often) you have to change your list. It’s easy for your list to becomes obsolete. ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [May 28, 2013, 3:44pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/38 "2013-05-28T15:44:56Z")
Email is my only big one. I don’t stay logged into my mobile banking app and, while I would change Amazon ASAP, at least I could wrangle that out with the bank. With control of your email people could start requesting password resets from any number of places. ---
**Author:** ![Learjeff](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@Learjeff](https://boards.straightdope.com/u/Learjeff)\ **Post date:** [May 28, 2013, 10:16pm UTC](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796/39 "2013-05-28T22:16:51Z")
I heartily recommend the free application, [Password Corral](http://download.cnet.com/3028-18501_4-10165333.html?c=SEM&s=fivemill&pid=dlcom_sem&aid=password%20corral-e&dlc=n&part=fivemill), which is probably the same thing as Keepsafe. As mentioned above, you can keep the secure password file uploaded somewhere like DropBox for access anywhere. Whenever I open a new account that requires a password, I open it up and add it. I’ve often had to refer to it for a forgotten password. Just yesterday, in fact, so my wife could use my paypal. For accounts like forums, where there’s no money at stake and no big security risk, I tend to use one of two or three passwords, which makes it easier to remember. That’s a security no-no, but it’s OK for forums. If someone hacks my SD account, I’ll be devastated but I’ll survive. It makes it easier to remember. But I still log it in the list, and that saves a bit of hassle every now and then. I try two guesses, and then go to the list. [Previous page](https://boards.straightdope.com/t/anyone-keep-an-emergency-password-reset-list/658796.md?page=1)