Too many passwords.

So I finally tackled the issue of exactly how many passwords I have to juggle on the internet. I had an intersection between this being on my to-do list and a conversation about the matter, so I revisited my options and chose one. In the past, it seemed like having about 3-5 major passwords and choosing which level of security the site fit into was a good solution.

At this point, however, I'm sure I've registered with over 300 websites and I only use or remember a fraction of that total. I've left a wide path of possible security issues in my wake. Who really goes back to old sites and tries to delete their accounts? Do you really trust sites on the internet to take great pains at security? If you use *@domain.com style email filtering to prevent spamming, you know how often your email addresses are sold. You also know how many times the company will deny they ever did such a thing. How many smaller websites are going to notify you when your personal account details are taken? It's not something they want to publicize.

So what do you do? If you're using Windows you have options like Roboform (which I don't actually recommend) or KeePass. If you want multiplatform KeePass might work (it runs under mono as 2.0 is written in C#), but you also have the option of KeePassX if you use Linux. KeePass 1.x and KeePassX are at least supposedly compatible regarding key databases. No good CLI based solutions seem to exist. PWSafe exists, but the CLI version is not maintained as well as the GUI version.

So what are the benefits? First, they can generate random string passwords for any new website or application and save them in one central database. You either use auto-form functions to automatically fill in your login information, or you quickly cut and paste it into your browser. They can also track the URL of the site. So each site has it's own security, you have a list of sites you've registered with, and you know when you last changed your password with each. These are all good things.

But this requires some responsibility. What happens if you lose this password database? Sure you can go through the whole process of password reminders/resets on every website you use, but that is a nightmare scenario. Also, you'd forget sites and could run into situations where you lost access to things. The equivalent of losing your wallet (ewallet!). So, this means you immediately need to keep backups. So, you need to integrate the password key database into your regular backup routine (which you have, right?), or one day you may regret it.

There are others who have recognized this problem and have created other solutions (OpenID for one), but they aren't widely adopted yet. I wish them luck in the future, but for now... it looks like I'm using KeePassX.