# Is a password manager safe from hacking? Or else I'll be as screwed as SD is now... **URL:** \ **Category:** Factual Questions\ **Created:** [January 8, 2014, 12:07am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199 "2014-01-08T00:07:57Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 12:07am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/1 "2014-01-08T00:07:57Z")
See subject. I’m in my panic room. And I really am the same Leo Bloom from before. Really. ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [January 8, 2014, 12:13am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/2 "2014-01-08T00:13:34Z")
Nothing is safe. Why do you ask? ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 12:20am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/3 "2014-01-08T00:20:29Z")
Ummm…, are you doing a Dustin Hoffman? ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [January 8, 2014, 12:28am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/4 "2014-01-08T00:28:55Z")
> [@Leo\_Bloom](#): > > Ummm…, are you doing a Dustin Hoffman? Well, maybe a Laurence Olivier. No, I have no idea what your OP means. But, nothing is 100% safe. A keylogger will get you pretty much anything. ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 12:34am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/5 "2014-01-08T00:34:14Z")
Read any good bulletin boards lately? ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [January 8, 2014, 12:39am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/6 "2014-01-08T00:39:45Z")
You really need to be less coy. I just saw the announcement. It’s not exactly obvious. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 8, 2014, 12:41am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/7 "2014-01-08T00:41:02Z")
Define “safe”. No, a password manager is not completely impervious to hacking. It is probably much safer than the sites where you would otherwise be entering poorly-constructed passwords. The [thread currently in ATMB about the hack](http://boards.straightdope.com/sdmb/showthread.php?p=16994100) has some discussion of password managers if you want to wade through it. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [January 8, 2014, 12:43am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/8 "2014-01-08T00:43:54Z")
Yup, what TroutMan says. It’s not perfect but better than what you’d be doing otherwise. ---
**Author:** ![anson2995](https://avatars.discourse-cdn.com/v4/letter/a/c77e96/32.png) [@anson2995](https://boards.straightdope.com/u/anson2995)\ **Post date:** [January 8, 2014, 1:07am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/9 "2014-01-08T01:07:54Z")
everything is susceptible to hacking, including password managers. What those tools do is make it easier for you to keep track of different passwords across multiple sites. Thus avoiding the practice of using one username and password everywhere. And that’s why it matters that the straight dope was hacked. Not because someone can log in and post to this message board, but because they can use the email and password you use for this site to access your other accounts. If you used the same password at the SMDB as on your bank account, for example, you’d better go change that one ASAP. ---
**Author:** ![Alan\_Smithee](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@Alan\_Smithee](https://boards.straightdope.com/u/Alan_Smithee)\ **Post date:** [January 8, 2014, 2:27am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/10 "2014-01-08T02:27:30Z")
Someone on the SDMB gave me the idea years ago of using a strong password that incorporates the initials of the website, so that, as an example, my password here might be swordfish01SDMB, while my Gmail pasword would be swordfish01GM. I would imagine that’s more secure than using a password manager, since I doubt hackers look at the individual passwords and try to suss out password the pattern I use; they presumably just try the passwords they have on a variety of other services. If you are worried about it, though, you could mung the site-specific part of your password using a rot cypher (using the next letter of the alphabet, swordfish01TENC for the SDMB, for example). ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 2:35am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/11 "2014-01-08T02:35:02Z")
FTR, thread topic is/was discussed, w/ good posts, on the [first ATMB thread](http://boards.straightdope.com/sdmb/showthread.php?t=712411) posted about this. I think it should continue here, but double check… ETA: Isn’t the password “haddock?” ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 2:40am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/12 "2014-01-08T02:40:27Z")
Apologies. Such a short thread and I didn’t read it through. Apologies particularly to **beowulf** , who can now be coy with me. ---
**Author:** ![drewtwo99](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@drewtwo99](https://boards.straightdope.com/u/drewtwo99)\ **Post date:** [January 8, 2014, 3:02am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/13 "2014-01-08T03:02:17Z")
Password managing services like LastPass are gauranteed to be safer in at least one way: their hashing and/or salting algorithms for how they store the passwords are going to be the best available. If you choose a secure password in the first place, even if hacked, no hacker is going to be able to brute force their way to your password since all they will have is an extremely well-hashed and salted version of it. ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 3:33am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/14 "2014-01-08T03:33:21Z")
Just bought 1Password. Lock that barn! ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 3:52am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/15 "2014-01-08T03:52:15Z")
Since I first saw it I was intrigued by the xkcd strip about plain language codes and entropy referenced, developed, and commented on [here](http://preshing.com/20110811/xkcd-password-generator/). Could someone here smart look at it, maybe flip through some comments there, and give a summary, with their own $0.02? Leo ---
**Author:** ![Duckster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duckster/32/1244_2.png) [@Duckster](https://boards.straightdope.com/u/Duckster)\ **Post date:** [January 8, 2014, 4:16am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/16 "2014-01-08T04:16:15Z")
I do not use online password managers. My password manager is [Keepass](http://keepass.info/). It exists in a thumb drive at home (duplicated with another thumb drive elsewhere). It cannot be hacked. ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [January 8, 2014, 5:15am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/17 "2014-01-08T05:15:15Z")
I’d lose my data stick. They look a lot like the used cartridges of e-cigs, as I found out to my regret recently. Anyway, found [this](http://blog.agilebits.com/2011/06/21/toward-better-master-passwords/) on the 1Password cite, with a cross link in conjunction with [Diceware](http://world.std.com/~reinhold/diceware.html) passphrase generator, as of April recommending five words. Those pages have more than I’ll never need to know, so I respectfully withdraw my bleg. But anyone else’s $0.02 are still nice. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 8, 2014, 8:47am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/18 "2014-01-08T08:47:30Z")
> [@Alan\_Smithee](#): > > Someone on the SDMB gave me the idea years ago of using a strong password that incorporates the initials of the website, so that, as an example, my password here might be swordfish01SDMB, while my Gmail pasword would be swordfish01GM. > > I would imagine that’s more secure than using a password manager, since I doubt hackers look at the individual passwords and try to suss out password the pattern I use; they presumably just try the passwords they have on a variety of other services. If you are worried about it, though, you could mung the site-specific part of your password using a rot cypher (using the next letter of the alphabet, swordfish01TENC for the SDMB, for example). Any kind of logic you build into your passwords makes them (in principle) easier to work out. In practice, you’re probably right - hackers probably won’t be spending time handcrafting their assault on your accounts. The key security benefit of a password manager is the same security benefit of a wallet - having placed all your eggs in one basket, you tend to carry it more carefully. ---
**Author:** ![jovan](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@jovan](https://boards.straightdope.com/u/jovan)\ **Post date:** [January 8, 2014, 9:14am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/19 "2014-01-08T09:14:03Z")
> [@Alan\_Smithee](#): > > Someone on the SDMB gave me the idea years ago of using a strong password that incorporates the initials of the website, so that, as an example, my password here might be swordfish01SDMB, while my Gmail pasword would be swordfish01GM. > > I would imagine that’s more secure than using a password manager, since I doubt hackers look at the individual passwords and try to suss out password the pattern I use; they presumably just try the passwords they have on a variety of other services. If you are worried about it, though, you could mung the site-specific part of your password using a rot cypher (using the next letter of the alphabet, swordfish01TENC for the SDMB, for example). **Mangetout** already answered this but I’l reiterate: **NO! NO! NO!** Password crackers _most definitely_ take such recipes into account. I linked to this article before, it’s a little long but highly informative insight into how actual crackers operate. > **[Anatomy of a hack: How crackers ransack passwords like “qeadzcwrsfxv1331”](https://arstechnica.com/information-technology/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/)** > > For Ars, three crackers have at 16,000+ hashed passcodes—with 90 percent success. One of the take-home point is that it takes only a few minutes to brute-force all 6-character passwords. Beyond that, there are various tricks, but trying various recipes plays a big part, and it will take only a few more minutes to brute-force yours. In practice, it’s going to be even less because no part of your password is random. Really, most security experts seem to agree that some form of password management system is the best form of defence. Unless you’re able to memorise dozens of either very long or very random passwords. ---
**Author:** ![Deeg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deeg/32/2955_2.png) [@Deeg](https://boards.straightdope.com/u/Deeg)\ **Post date:** [January 8, 2014, 8:01pm UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/20 "2014-01-08T20:01:46Z")
The only thing safer than a password manager is having a photographic memory and using unique, long, unrelated PWs for every site that requires one. I use a combination of KeePass and Dropbox that makes my passwords available at home, work, and on my mobile devices. The password list is protected by a single, long, unguessable PW. KeePass will generate unique long Bin64 passwords for every site I use. [Next page](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199.md?page=2)