Wednesday, December 15, 2010

Password classification

I've been thinking a lot about my passwords and security, and am changing everything according to the following scheme:

"Unique" memorized password: Google, Password manager(s), home server (exposed to Internet).
  • These are "master key" systems - if these are compromised then the hacker effectively has the ability to get my password to anything else. As a result, the password for these is not used on anything else (really, I ought to have a separate pw for each of these, but since they're all so unrelated I've just got one for all 3).
Random stored individual passwords: All things potentially damaging (banks, brokerages, prosper, IRA, etc)
  • These are randomly generated 10-character passwords - they might get sniffed, but they're not going to get hacked. These get saved in the Firefox password DB and are also in my password manager program (Keepass, for anyone who cares)
Work password: all things work-related
  • Everything I do at work requires me to change my password every 3 months - since I have trouble with multiple passwords anyway, I just set them all to the same thing. Only one of them can be accessed from outside the intranet anyway, and my VPN is protected by a keyfob.
Easy (but still relatively secure) non-changing password: social networks and anything else that can't cost me money or too much heartache.

Useless password: sites that I really don't care about and/or don't trust.

This bring my list of passwords I'm required to memorize down to 4. I think this is pretty managable - the only thing that I still have to worry about is accessing gmail from any kind of public computer, but I don't see what I can do about that.

No comments: