Managing Passwords (LinkedIn Hacking)
 

As you may know, about a week ago, LinkedIn's password database was hacked and several million passwords stolen. They were posted on an open server, and are presumably now decrypted and for sale along with the associated user names.

(Or maybe you didn't know? I can't say LinkedIn made any great effort to notify me. Maybe they're hoping we won't notice.)

So this raises an issue. On the one hand, you're not supposed to use the same password for different accounts. On the other hand, who can remember dozens of different passwords?

How do you deal with this?

i changed my password..something unique. i cannot friggen remember it. damn it.

I've written my password on the underside of my desk. Only I know it. Well, me and the cleaner.

Use LastPass.

I'm guilty of using the same or similar passwords for places like PP and linkedin (changed it). For bank, stock broker and such I write them down in a file in my office.

I use KeePass to store my passwords but also changed my Linkedin password the day after they were stolen/hacked.

Apparently I was smart enough to use a unique password for stinked-in, because I haven't been able to remember what it is and successfully log in for the past two years. Fortunately their site was hacked and they gave me the opportunity to reset my password--which I did, and then promptly deleted my account!

No longer a professional IT'er, but when I was, a SecureID (dynamic password) was used. For personal stuff, I've narrowed it down to about 3-4 different ones (for different security layers) of pseudo-random PWs that I simply remember. I've always had a knack for remembering bs "strings"...like the serial number from my Schwinn stingray from 45 years ago :)

Come up with a system. I have 3 levels - things I don't care about (forums and such), things that are somewhat important (my user accounts, email passwords, etc), and really important things (my admin passwords, root user passwords, etc). Then come up wtih 2 or 3 variations on a theme for each level - for example a good strong but short password, with the website/service/domain name appended to it - like "s3cr3+pelican" or "s3cr3+slashdot". Done.

I use a password protected excel document hidden in a very obscure place with a different name.