Michael Horowitz
Home => The BEST password advice
[Formatted for Printing] From the personal web site of  Michael Horowitz

The world's BEST password advice

2021 updates: Sept. 13, 3 | June 10 | May 25 | April 24 | March 31, 11, 10 | February 21, 28 | January 19
2020 updates: November 29, 21 | October 25, 24, 19 | September 18 | July 30, 25 | April | March | February
Created: August 16, 2019

Table of Contents
 Paper Has Its Place
 Introducing a Formula
 Examples of Simple Formulas
 More Secure Examples
 Two Types of Formulas
 Arguing Against Password Manager Software
 Arguing For Password Manager Software
 Beware of Browser Extensions
 What I Do
 Formula vs. SQRL
 Me vs. The New York Times
 Still More Problems With Password Managers  
 Black Sheep


Seeing as how it is 2019 2021, you might think that everything there is to say about passwords has already been said. But, no.

I would argue that most password advice, to date, has been flawed. Some advice is intended to help people pick a single "good" password when we all need hundreds of passwords. Other advice comes from techies thinking in the box and is only appropriate for other techies. Still other advice comes from people devoted to the one true solution who ignore any other solution.

The problem is not just that we need hundreds of passwords, it is also that they have to be reasonably long and reasonably unique.

Long passwords (12 characters is probably a minimum length, the exact number is debatable) defeat brute force guessing attacks. Wi-Fi passwords are one case where bad guys can make billions of guesses a second for as long as they care to. The password "TipTop99" has upper and lower case letters and a number but will not stand up to a brute force attack for very long.

Unique passwords defeat two other types of attacks. In one, bad guys try to guess your password using lists of popular passwords and/or lists of previously stolen passwords. Even if a password is not globally unique, it is far better for it be so rarely used that it never appears on any list of the most popular passwords. In the other attack, bad guys use a password of yours, stolen from one website, at many other websites, hoping that you re-used it. The common terms for this are "password stuffing" or "credential stuffing". It requires a victim to have used the same email address, as their userid, at multiple websites, which many people do.

We need many passwords for things that we don't care about at all, so it is tempting to re-use a single password for these accounts. I disagree with ever re-using a password, but I understand the motivation. A formula, as explained below, is a much better solution while also being easy to use.

This brings up another problem with some password advice: it is solely focused on retrieving passwords, not helping at all to make the passwords longer or reasonably unique.

There are multiple solutions for dealing with hundreds of passwords. Perhaps the most popular approaches are:

  1. Write the passwords on paper
  2. Password manager software
  3. Store the passwords in a file and encrypt just that one file. Perhaps Word. Perhaps Excel.
  4. For websites, store passwords in your web browser
  5. A formula to generate easy-to-remember passwords

Three of these solutions simply help retrieving passwords, they do nothing about making them long or unique.

We all have different needs and abilities so there is no one best solution. I wrote this blog to make the case for using a formula. But, its never simple. Often the right solution is to use more than one approach.

Gabriel Fair is a case in point. He has 5 different types of passwords and deals with each type differently. He may have over-analyzed, but using one system for all your passwords is likely to be just as extreme and sub-optimal. (added Feb. 2021)


The main purpose of this blog is introduce Formulas as a better alternative to password managers. There is a section below with my arguments against password managers. Interestingly, many techies who recommend password managers, point out that paper is a safer alternative for our most important passwords. I will join that crowd and say that even if you use a password generating formula, paper still has its place. For what?

If your life savings are in one financial institution, that password clearly deserves special treatment. The password for your main email account is probably more important than your realize. If you do use a password manager, its main password, the one used to access all the other passwords, is special. It is reasonable, if not preferable, to keep your most important passwords away from any type of computing device.

I am not the only techie who thinks there is a place for paper:

  1. On March 30, 2021, tech journalist and IT consultant, Sean Kerner, tweeted: "I feel no shame in admitting i use a password journal too. I don’t trust password managers and use 2FA. Am I paranoid? of course. Is it overkill - likely. But it works for me." By "journal" he was referring to a book with passwords written in it.

  2. On March 30, 2021, Adrian Bradley, a journalist for the BBC, in response to someone writing their passwords in a book, tweeted: "This is fine. A hacker isn’t going get hold of this and if it means you have different passwords for everything you're much safer than most people probably are right now"

  3. The July 24, 2020 episode of The Privacy, Security, & OSINT Show by Michael Bazzell was about securely saving contact information. Nothing on passwords. At the very end of the topic, after discussing the safest way to save contact information, he mentioned that some of his clients are super sensitive, and for those people, he uses a different technique for storing their contact information - paper and pencil. That information is too sensitive to be in any computer. The concept is the same with passwords.

  4. In How strong is your password, really? 9 rules to make, remember and manage your logins Clifford Colby and Sharon Profis of CNET (Feb 1, 2020) write: "Yes, you can write your login credentials down. Really. We know: This recommendation goes against everything we've been told about protecting ourselves online. But password managers aren't for everyone, and some leading security experts, like the Electronic Frontier Foundation, suggest that keeping your login information on a physical sheet of paper or in a notebook is a viable way to track your credentials."

  5. In September 2020, Kim Crawley wrote: "If you have privacy in your home, you could write the most important passwords that you can’t keep in a password manager on a piece of paper in a safe place. I personally keep a note with my WiFi and router management passwords on a piece of paper that I keep on top of my refrigerator."

  6. Tavis Ormandy works for Google and is a techie's techie. Since Google makes the Chrome browser, he is, naturally, inclined towards storing passwords in the browser. But, he is open to all techniques. In July 2020, he wrote:

    "If you use a third party password manager, you might not realize that modern browsers have password management built in with a beautiful UX [User eXperience]. Frankly, it’s harder to not use it. Even if you can’t use a password manager, it is totally acceptable to record your passwords in a paper notebook, spreadsheet, rolodex, or any other method you have available to record data. These are cheap, universally available and accessible."

  7. In January 2020, Sara Morrison of Vox wrote about her experience being hacked, Hackers stole $13,103.91 from me. Learn from my mistakes, mostly because she re-used a password. While she now uses a password manager, for non-techies she writes: "I do think you’re better served by having unique passwords for every site written in a book (presumably one that you’ve stored in a safe location to which there is limited outside access) ... Just keep in mind the disastrous consequences if that book were to ever fall into the wrong hands." To this I would add that even with paper, there are a small number of passwords that should be segregated. (added Sept 13, 2021)

  8. Long-time techie Shannon Morse uses a password manager, but not for everything. In October 2019, she tweeted: "I use a mix of both. My password manager (which is free and generates pws that I can customize based on website needs) is used for almost everything. My email, bank, and social media are all weird, complex, and memorized. Those ones never go in the PW mngr."

  9. John Opdenakker loves password manager software but came to the realization that it's not for everyone. In his June 2019 blog, Secure Password Management part 4 - Why password managers are not the best solution for everyone he writes that "... for a lot of users, like my mum or dad .... I recommended them to use different passwords for their accounts and write them down in a password book." His recommendation stems not from the fact that paper is more secure, but from the practical reality that dealing with password manager software is too much for some people.

  10. In 2019, Maciej Cegłowski tried to spread the gospel of password managers. In May he blogged about the experience What I Learned Trying To Secure Congressional Campaigns. He found password managers were too much for people to deal with and concluded: "In the end, I told candidates to generate unique passwords and save them in the notes app on their phone, or write them down on a card they kept in their wallet."

  11. Almost the entire book, Take Control of Your Passwords (by Joe Kissell, Third Edition, April 2019) is devoted to Password Managers. But, he does consider non-techies on page 144 and writes: "For a modest number of passwords, a piece of paper can be a completely adequate password manager". (added March 10, 2021)

If you do use paper, please keep two copies in two different, safe, locations.

The lesson from these stories, is that anyone who suggests that one approach is always the best is a fool.

In August 2019, the New York Times published an article "Why You Need a Password Manager. Yes, You" which is an example of this tunnel vision. The author, Andrew Cunningham, is a true believer in the only solution. More about this article is below in the Me vs. The New York Times section. Different approaches are a better fit for different people with different needs. And even for a single person, different approaches may make sense for different passwords. The real lesson to be learned is not to get computer advice from the New York Times.

In October 2020, on Episode 1,737 of the Tech Guy podcast, a caller asked show host Leo Laporte, for a good way to remember passwords for a senior citizen. Laporte went through four different approaches for managing passwords, but in the end was forced to admit that none was a great fit for a senior citizen. He never considered a password formula. If you watch the video, the topic comes up 13 minutes 25 seconds into the show.

FYI: Let's debate password managers at the Forums of askwoody.com.


In my opinion, a password formula is a great solution. It solves three problems: it makes retrieving passwords easy and it helps create reasonably long and reasonably unique passwords. A tri-fecta. It is the Rodney Dangerfield of password solutions - it gets no respect.

What everyone has gotten wrong, is thinking of a password as a single thing. My idea/suggestion is to consider a password as a two part thing.

One part never changes, its something meaningful to you that you will never forget (trust me on this). The other part does change but can be very simple and also meaningful to you. That's it. A constant and a variable. This should help you create dozens of unique, yet easily remembered, passwords.


Say, for example, that you are a fan of the New York Yankees and your favorite player is Babe Ruth. Fine. Start every password with "BabeRuth". That's your constant. You should write it down in case amnesia sets in, but I doubt you will have any problem remembering that all your passwords start with the name of your favorite baseball player. It should not take too long for this to get burned into your brain.

Or, perhaps you use the name of your pet dog as a password. Then instead of it being the entire password, use it as the constant part of every password. Now, all your passwords start with "Fido" or "Rover" or "Daisey".

The variable part of your passwords does not need be any more difficult. You can pick what, on its own, is a miserable password. For amazon.com, you could, for example, use "jungle". For Barnes and Noble, you could use "book". For Gmail you could use "geemail".

Putting it all together, our fictional Yankee fan, would have passwords of "BabeRuthjungle", "BabeRuthbook" and "BabeRuthgeemail".

Not the most secure passwords in the world, but probably better than most. And, speaking as computer nerd, I can not stress enough how important it is to not re-use passwords.

Speaking of which ... a formula means never having to re-use a password, even for accounts that you don't care about. Your password for websiteX could be "BabeRuthwebsiteX". This is barely harder than re-using a password, yet its more secure. It's not very secure, just more so.


These passwords can (and really should) be made much more secure fairly easily.

Just replace the "BabeRuth" constant prefix with "Babe-Ruth" or "BabeRuth--" or "babeRUTH". Many passwords that consist of a single capital letter have it as the first character, so, don't use "Baberuth-".

Likewise, "Fido" and "Rover" can be made more secure by adding a special character or two ("Fido=" or "Rover//"). Heck even just repeating the pet name twice ("RoverRoverjungle"), is a huge improvement.

If you are really ambitious, break up the name into a prefix and a suffix such as "Babe-jungle-Ruth" or "babeBOOKruth". For pet lovers, consider "Fido-geemail-Fido".

And, Joe DiMaggio is better than Babe Ruth - not because he hit more home runs, but because his name is longer (11 letters vs. 8). And Mickey Mantle beats them both; his name is 12 letters long. Lou Gehrig? Barely better than Ruth.

Baseball players come and go, but team loyalties do not. So, Missouri residents can create great Amazon.com/jungle passwords such as "STLcardinalsjungle" or "St.Lcardsjungle" or "StLouisjungleCardinals" or "st.louis.junglecardinals" or "STLjungleCardinals".

Finally, let me note that while you might use an extremely simple word ("book" and "jungle" in our examples) as the variable half for some accounts, your most important accounts deserve something better. If you depend on Gmail, for example, then "geemail" is a bit too simplistic, even as only half the password.

These formula-generated passwords are virtual unicorns: easy to remember, long and, almost definitely, unique.

It's the best password advice in the world.

TWO TYPES OF FORMULAS   (Added August 31, 2019)

To sum up the above, I suggest a formula with a fixed and a variable component. To begin with, the fixed component can be at the beginning followed by the variable part. If you are more ambitious, then create a fixed beginning and a fixed ending, with the variable part in between them. For the lack of a better term, I will refer to this as a soft formula, in that you can always change the variable portion.

Some criticism of formulas assumes another type, which I will call a hard formula. This type, like a mathematical formula, creates one and only one output, for any given input.

For example, assume a hard formula based on a website name. Perhaps the first two letters of the site name and the suffix. So, Amazon.com would generate a password of "am.com" and yale.edu would be "ya.edu". This would then be appended to a fixed constant, yielding something like "BabeRutham.com".

I know of two problems with hard formulas:

  1. If the formula is for a website that gets hacked, and the website forces users to change their passwords, the formula can not create a second password for the same website.
  2. If anyone sees two or three of the generated passwords, they may figure out the formula.
So, to be clear: hard formulas bad, soft formulas good.

I mentioned Gabriel Fair and his five different password solutions for five different classes of password earlier. One solution is a formula, but he uses a hard formula.

Hard formulas are what scares people away from formulas. Specifically, the worry that if a few passwords leak, through the inevitable data breaches, a bad guy might figure out the formula. With soft formulas, even if the formula leaks, you are still safe. But, if you are still concerned about the formula leaking, consider using two formulas to increase your odds. Specifically, use one formula for important websites/systems and a different formula for places that you don't care much about.

If a fan of the St. Louise Cardinals baseball team used "StLouis<variable>Cardinals" for their important passwords, they might use the simpler "stlouis<variable>" or "STLC<variable>" for their unimportant passwords. (added Feb 21, 2021)


The knee-jerk reaction of techies, is typically to use a password manager. I think a formula is better. Here is why:

  1. There is a learning curve with all software. Techies underestimate how much of a pain this can be for non-techies.
  2. No software runs on every Operating System or supports every web browser, so you are limited where you can use any one particular password manager.
  3. The most secure Operating System most people have access to is a Chromebook running in Guest Mode. A formula works there, a password manager does not.
  4. All software has bugs, password managers included. Not only might you be vulnerable to a bug, but you certainly are on the hook for keeping the password manager software up to date. A formula will never have a bug and never require an update.
    Update Aug 19, 2019: I was not aware of this password manager bug when I wrote first this.
    Update Aug 30, 2019: LastPass has had 5 security issues according to Wikipedia
    Update January 20, 2020: LastPass broke again. LastPass stores passwords so securely, not even its users can access them
    Update August 2020: Christopher Elliott wrote about the time LastPass refused to tell him his passwords: Help! My LastPass login doesn’t work. What’s the fix? (added Sept 13, 2021)
    Update September 2020: The F-Secure KEY Password Manager on Android needed to be updated both to fix bugs and for security improvements. Not what you want to see in a Password Manager.
  5. And, even if the software, itself, is not buggy, its supply chain can get hacked. This happened to Passwordstate in April 2021. As many as 29,000 enterprises downloaded a malicious update to the software that extracted data from the app and sent it to an attacker-controlled server. The defense here is to use software that can not self-update and then only update it when you become aware of a bug. The constant drip, drip, drip of software updates is an accident waiting to happen. (added April 24,2021)
  6. With a password manager you have to trust that it works correctly. The software is a black box to most people. With a formula, you do not need to trust anyone or anything.
  7. A formula lets you write down the variable part of the password - safely. That is, if you write down that your Amazon password is "jungle" and someone sees this, it's only half the actual password. No one is hacking a password written down on paper. You can put all your passwords in a book, and if the book is stolen, you are still protected, as long as the fixed part of each password was not written down in the book.
  8. When a password manager generates passwords for you, it may create a password that is too long for the target system, or, that contains characters the target system does not allow. It is much easier to deal with this sort of thing when using a formula.
  9. Some websites do not allow passwords to be pasted into the logon form. That's a problem for password manager software, not for a formula.
  10. A formula is free, some password managers are also free, but some are not.
  11. The security of web browser extensions. More on this below. (added Aug 28,2019)
  12. When using someone else's computer, the password manager software is not available (more below, added Aug 29, 2019)
  13. All your eggs in one basket? Really? There is a reason this phrase is popular. (added Aug 29, 2019)
  14. Backup. Backup. Backup. Anyone using password manager software, needs to periodically backup all their passwords. Perhaps monthly? Perhaps every three months? Maybe print all the passwords. Maybe back them up to a file that can be safely stored off-line somewhere (see the Nield article below, from March 2021, for more). Some password managers will store a backup in the cloud, but a backup in your home is far better. On Windows, portable software is the best possible case as both the app and the data should reside in one and only one folder. Just copy the folder, when the software is not running, to make a backup. (added March 10, 2021)
  15. What if you want to switch away from a password manager you are currently using? Perhaps the price has changed. Perhaps something you feel is better has come along. Perhaps the software has changed. In this case, the format(s) that the old software can export to, and the format(s) the new software can import from, become a big deal. And, quoting Joe Kissell: "... even if you can find compatible formats, you might still lose data - for example, if you store custom fields or file attachments in 1Password, those pieces of data will go missing when imported into a password manager without comparable features" (from Take Control of Your Passwords Third Edition April 2019). In the worst case, you may be forced to re-enter all your information. It can be easier to get out of a marriage than out of a password manager :-) (added Aug 29, 2019, modified March 10, 2021)
  16. Speaking of switching software: the people maintaining your password manager software may change (more below, added Aug 30, 2019)
  17. Speaking of switching software: a LastPass user griped about changes to the User Interface in October 2019 (more below).
  18. Speaking of switching software: the rules for the free version of the software may change, forcing you into the paid version. Again, this was LastPass, in February 2021.
  19. In February 2021, some password manager software on Android was found to include trackers, the last thing anyone wants to find in their password software. BitWarden had two, Dashlane had four and LastPass had seven. Password apps with no trackers were KeePass and 1Password. From: 1Password has none, KeePass has none... So why are there seven embedded trackers in the LastPass Android app? from The Register.
  20. Software is not forever. F-Secure is discontinuing support for their KEY password manager at the end of August 2021. (added June 10, 2021)
  21. Tavis Ormandy is a techies techie. In June 2021, he blogged about Password Managers saying:

    "I've spent a lot of time trying to understand the attack surface of popular password managers. I think I’ve spent more time analyzing them than practically anybody else ... Conceptually, what could be simpler than a password manager? It’s just a trivial key-value store. In fact, the simplest implementations are usually great ... Things start to go wrong when you want integration with other applications, or when you want data synchronized by an untrusted intermediary. There are safe ways to achieve this, but the allure of recurring subscription fees has attracted businesses to this space with varying degrees of competence. I’m generally skeptical of these online subscription password managers ... I often say that 'use a password manager' is bad advice. That’s because it’s difficult to tell the difference between a competent implementation and a naive one. The tech press ... can’t realistically evaluate any security claims, so how do you propose users tell the difference? For that reason, I think 'use a password manager' is so vague that it’s dangerous. A good analogy is telling someone with a headache to pop any pills they find in the medicine cabinet ... Advice on this topic needs to be specific. It’s better to recommend implementations that are well designed, rather than general product categories." (added June 10, 2021)

  22. In the same article as above, Ormandy also wrote:

    "Despite what your vendor says, if their network is compromised, the attacker can read your passwords. Here are some selected marketing claims from password manager vendors: 'No one apart from you, not even [us], has access to your passwords' ... These claims are all nonsense. An attacker (or malicious insider) in control of the vendor’s network can change the code that is served to your browser, and that code can obviously access your passwords. This isn't far-fetched, altering the content of websites (i.e. defacement) is so common that it’s practically a sport. The reality is that you have to trust your vendor to maintain their infrastructure and keep it safe. The existence of encryption ... does not alter this." (added June 10, 2021)

In response to one of my tweets about this blog, ZDNet reporter Catalin Cimpanu tweeted: "I've always used password formulas. Password managers are on my threat model as a reporter. Can't use them. Unless it's some account on a no-name site that I don't care about, I have a formula-based password for it." Computer security is Companu's beat. He has been covering it for years. He is as well informed on security as anyone.

Even someone who uses and recommends password managers, Daniel Aleksandersen, notes that password managers are a single point of failure and are difficult to back up. See How to back up your password manager. (Feb 17, 2020)

FYI: How to Switch Password Managers Without Losing Your Data by David Nield for Gizmodo (March 10, 2021). The article explains how to export all your userids/passwords in 10 different password managers. Interestingly, Safari is the worst, it does not let you export everything at once. Instead, you need to copy one userid/password at a time.

In their Creating Strong Passwords article (Oct. 2018), the EFF said "Wondering whether a password manager is the right tool for you? If a powerful adversary like a government is targeting you, it might not be. Remember: Using a password manager creates a single point of failure. Password managers are an obvious target for adversaries. Research suggests that many password managers have vulnerabilities."

On April 2, 2020, computer expert Robert Graham blogged about an issue with Zoom possibly stealing passwords. This led him to discuss good password practices, in general. He said: "By far the most important thing you should do to protect yourself from Internet threats is to use a different password for all your important accounts, like your home computer, your email, Amazon.com, and your bank. Write these down on paper ... Don't print them, don't store them in a file on your computer ... Store copies of that paper in a safe place. I put them in a copy of the book Catcher in the Rye on my bookshelf ... Writing it on a Post-It note taped under your keyboard is adequate security if you trust everyone in your household." In the article he does recommend Password Managers but, he knows all too well the things that go wrong with software and that some things are too important to trust to a computer.

ARGUING FOR PASSWORD MANAGER SOFTWARE   (section added Oct 10, 2019, last updated Jan 19, 2021)

A password manager that automatically enters passwords for websites, can protect against scam websites. Many people do not know the rules for domain names and thus can be tricked into thinking a scam website is legitimate. I explain the rules for domain names on my Defensive Computing Checklist web site.

For example, a saved password for citibank.com will not be automatically entered at citibank.badguy.com or secure-citibank.io. The protection is not foolproof however, a victim may think there is a problem with the password manager and manually enter their password.

- - - - - -

A undated (probably from 2019) white paper Modern password security for users by two Google employees (Ian Maddox and Kyle Moschetto) argues in favor of password manager software. This is a classic example of advice from techies for techies that is not appropriate for many people. Their advice on evaluating the software and how to use it, is making my case for me.

For example, they say: "A common criticism of password managers is that all of your secrets are in one high-value target. Losing control of that vault means losing control of all the accounts that it contains. This is why it is important to choose a password manager that has a high level of trustworthiness, transparency, and multiple layers of security controls." If you can evaluate software by these criteria, fine. If not, then password management software is not for you.

In addition, they advise keeping an offline copy of the recovery codes that you can use if the master password for the password manager is lost. And, to make sure the devices that have access to your password manager are secure and kept up to date with the latest patches. After all, they say, your overall security is only as strong as the weakest link. Agreed. Consider this advice table stakes for playing in the password manager game.

They suggest that the features below are the minimum requirements for a good password manager:

Going beyond the bare minimum, they suggest looking for a password manager with these extra features:

Not sure what self-hosting refers to. Ditto for behavior-based security.

I do not disagree with the advice from Maddox and Moschetto. If you want to manage your own encryption keys, fine. My point, again, is that there are very few people able to understand and implement these suggestions. And, anyone not able to grasp or carry out their advice is asking for trouble by using password management software.

They did give some examples of formulas. Starting with the simple password "mango2", they suggest:

Each of these formulas lets you safely write down the password, as long as you can remember the formula. One problem with shift-doubling is that you may end up with a forbidden special character.

Being techies, they say nothing about using a paper and pencil for saving passwords. And, being Google employees, they fail to point out the danger in web browser extensions, the next topic. Could it be because Google is so heavily invested in the Chrome browser?

- - - - - -

This article, Can Your Password Manager Be Hacked? (by Roger Grimes Jan 18, 2021) is yet another example of someone who has drunk the Kool-Aid. While Grimes admits to some danger with password management software, it is the only password solution on his radar screen. This is the very definition of thinking inside the box. He admits that a password manager is a single point of failure, but he blows it off rather than suggesting ways to protect yourself. And, like other people that argue in favor of password managers, he ignores the dangers of a browser plug-in. Back in 2018 Grimes, offered yet another poor argument (Using a password manager: 7 pros and cons). On the pro side, he cited both better security and ease of use. This is never possible, whenever you increase one, the other decreases. He is selling snake oil. Finally, his worst case scenario is forgetting the master password. Apparently he has never experienced a software bug or a memory error or a broken keyboard. And here too, nothing about planning for the worst. All told, two lame articles that boil down to: it's better than re-using passwords. For some people, yes. But not for all and certainly not for many.


Many password managers install a browser extension to handle passwords in web pages. These extensions have carte blanche. They see everything on every web page. And, they can change it. They are the Queens of the chessboard. This, to me, is an accident waiting to happen.

The permissions of browser extensions are usually hidden. Normally, you see them only when the extension is first installed. With the Chrome browser, the Queen-level permission is "Read and change all your data on the websites you visit". Let that sink in. I checked four Chrome password manager extensions (Avira, Lastpass, Bitwarden and Dashlane) and each required this permission. What if the vendor of the password manager gets hacked? Or, their supply chain gets hacked? Or, they make an honest mistake? With such a powerful extension installed, you are living on the edge of a cliff.

Dashlane Chrome browser extension permissions
Dashlane browser extension permissions

Plus, there are some Chrome browser permissions whose meaning is not at all obvious. Dashlane, for example, not only wants to read and change everything on every page, it also wants to:

Unless you fully understand what these permissions mean (I do not) you can not make an informed decision as to whether this lowering of normal browser security is worth the convenience offered by the Dashlane password manager. You will never see anyone make this argument. I very much doubt that anyone who recommends password manager software has thought things through to this level.

FYI. Mozilla explains the assorted permissions for extensions in Firefox here Permission request messages for Firefox extensions.

Update September 16, 2019: LastPass bug leaks credentials from previous site by Catalin Cimpanu. A bug in their browser extension exposed credentials entered on a previously visited site.

Update January 20, 2020: Avast Online Security and Avast Secure Browser are spying on you by Wladimir Palant (October 2019).

Update January 23, 2020: From Ars Technica More than 200 browser extensions ejected from Firefox and Chrome stores. Firefox ousts almost 200 add-ons while Google detects a significant increase in abuse.

Update March 3, 2020: From Brian krebs The Case for Limiting Your Browser Extensions.

Update October 25, 2020: Adblockers installed 300,000 times are malicious and should be removed now from Ars Technica. A popular browser extension was sold and the new owner made it malicious. There is no way for people using any given browser extension to know if this happens. Quoting the article: "It’s hard to provide actionable advice for preventing this kind of abuse." Me: avoid browser extensions that have full access to every web page. Many/most do. But not all.

Update May 25, 2021: Daniel Aleksandersen is a techie's techie. On May 24, 2021 he warned about passwords in browsers: "I've recently had a change of heart regarding having my password manager available for auto-fill in my web browser. Password manager extensions and password managers built into web browsers are very convenient. Web browser-integrated password managers - both the built-in ones and extensions - have suffered from many auto-fill leaks and vulnerabilities over the years. It’s an attack surface I can do without."

Update June 10, 2021. As noted elsewhere on this page, Tavis Ormandy, who works for Google, is a techies techie. The excerpt below is from an article he wrote about Password Manager software in June 2021. Specifically, he describes the integration of a Password Manager with a web browser.

"There are two primary components that make up your browser interface, the chrome (confusingly, the term has nothing to do with Google Chrome) and the content area. The chrome contains things like the address bar, tabs and back button. These components can be trusted, and websites can't interfere with them. Conversely, anything inside the content area can be controlled by the website and therefore it can't be trusted. Most password managers blur this distinction by drawing their UI in the content area. There is just no way to do this safely ...

We've already established that one component of online password managers must be injected into potentially hostile environments. How can those components communicate with other components? One naive solution would be to just use XHR or WebSockets to a local HTTP endpoint. This sounds appealing to developers, they’re the native way to communicate on the web. The problem with this solution is it's very difficult to differentiate between your content script, and a hostile script running on the same page but a different world. Essentially every implementation I’ve looked at has got this wrong, resulting in critical game-over vulnerabilities.

Another gripe I have with online password managers is that they render browser sandboxes less effective. Modern browsers use a sandbox architecture to isolate components that can go wrong. The problem is that online password managers effectively inject privileged components into these sandboxed processes with extensions. The purpose of sandboxing is to isolate potentially compromised components from each other, but if you stuff all your most valuable secrets inside the sandbox - then what’s the point? I worry that people don’t understand the tradeoff they’re making here."

Update September 3, 2021. This article Is LastPass Password Manager worth using? (Ghacks.net Aug. 2021) points out that the LastPass browser extension wants to spy on you. There are two deeply buried options that can turn this off (see Step 9: Disable telemetry in the article).

From a different perspective, consider why browser extensions exist for password managers. Convenience. I have been a computer nerd for more years than you would believe, and trust me, that convenience is the enemy of security. Nothing is both secure and convenient.

WHAT I DO   (section updated June 10, 2021)

As I noted in the introduction, the right solution for anyone may be more than one approach. Personally, I find that my passwords fall into three categories. There are a small number that I use often enough to memorize. The vast amount of my many many passwords are rarely used and I need to look them up when needed (not saying how). Then there are perhaps a dozen that I use often enough to want quick access to, but not often enough that I can memorize them. These dozen passwords are kept in a password manager.

I also use a simple formula with an online service where I have 4 accounts. This is not a service where I need a high level of security, but since no one should ever ever re-use a password, I made a simple formula that I use exclusively with this service. I use a fixed prefix with the rest based on the userid. For example, my account in the name of "michael" has a password of "abc123michael" and my account in the name of "william" has a password of "abc123william" (my passwords don't really start with "abc123", this is just an example). Again, this formula is used with just the one on-line service. (Added November 21, 2020)

I also use a formula for the many laptop computers I use. Here again, I have picked a fixed password prefix used only with these laptops and I use the laptop model number as the suffix. So, an HP x360 laptop has a login password of "laptopx360". A ThinkPad T420 has a login password of "laptopt420". Needless to say the common prefix is not "laptop". The laptops never leave my home. If they did, I would probably (hopefully) add a fixed suffix too. (Added November 29, 2020)

On Windows, the password manager I use for the dozen or so passwords I often need but can not remember is KeePass. It is free and open source. I use the portable version, so Windows does not know the software is there. Portable Windows also lets me copy the folder where it lives from one PC to another and make backups that contain both the software and the passwords. KeePass does have a cloud option, but it is off by default and I do not use it. There is no web browser extension. There are no KeePass accounts. The software does not store anything in the registry. I do not use the password generator feature or any of the available plug-ins. KeePass can check for updates automatically, but I disabled that feature. If I like the software the way it is, I can keep using it forever. If the people creating/maintaining the software stop doing so, the software will still work.

On Android, I used to use the free version of the KEY Password manager from F-Secure. It was a stand-alone app, not part of a software suite. I trusted F-Secure and it had no cloud or on-line component, no web browser extension and no need to create an account with F-Secure. Eventually, F-Secure dropped support for it. Now I use KeePassDX.(Updated Sept. 12, 2021)

Taking a step back, dealing with hundreds of passwords is not the only issue we all face. To avoid putting all my eggs in one basket, I also use multiple email addresses. I own a domain, one without my name in it, and I typically create new email addresses at that domain for new accounts. (Added March 11,2021)

That said, I am not you. What is right for me is not necessarily going to be right for you.

FORMULA vs. SQRL   (section added September 27, 2019)

As I write this in September 2019, Steve Gibson has just started promoting a new identity system called SQRL (pronounced Squirrel). Basically, it competes with passwords. Maybe it will take over the world, maybe it will be ignored. No one knows at this stage. It requires software to be installed both on a web server and the end user computing device, which certainly will be a hurdle to its adoption. Time will tell.

Frankly, I don't fully understand SQRL. It uses the now classic concept of a public key and a private key, two numbers with a relationship between them that seems magical to non-math people. SQRL creates a public and private key pair for each website where the SQRL user has an account. The website only knows the SQRL public key. Thus, if a website using SQRL gets hacked and leaks your public key, no big deal. The public key is not the whole SQRL proof of identity, its only half of it. This is analogous to writing down your password when using a formula. You only need to write down the variable component which is half the actual password. If someone sees the variable half of the password, they can't use it without the fixed component.

Also, in the SQRL system, each person gets a single userid that is used for every website where they have a SQRL based account. In Gibson's lingo, the SQRL userid is a 256-bit master key. Sounds a lot like the fixed component of a password formula which is also used at every website.

Formulas have two advantages over SQRL: they are not limited to websites and they do not require software to be installed.

- - - - - - - - - - - - - - - - -

ME vs. THE NEW YORK TIMES   (section added August 29, 2019. Updated Aug 30, 2019)

Now I know how Al Pacino felt in the last Godfather movie. Just when I thought I was done, they drag me back in.

They, in this case, is the New York Times. On August 27, 2019 they published: Why You Need a Password Manager. Yes, You by Andrew Cunningham. The story was originally published three weeks earlier at the Wirecutter which the Times owns.

The article in the Times does not allow comments. The Wirecutter does allow comments, and I made one pointing to this very blog. It was quickly removed, which, in a nutshell, tells you everything you need to know about the Wirecutter.

A tweet of mine about this, generated a response from Andrew Cunningham the author of the article: "I’m not going to go point-by-point here but I don’t think this is workable advice for the vast majority of computer users". By not debating, he helps makes my point for me. I don't pretend to know what is best for the vast majority of computer users. Fortunately for them, Cunningham does know.

Perhaps the most offensive thing about this article is the total belief in the one true solution. It does not consider, or even mention, using a formula to generate passwords. I have listed 14 problems above with password management software, yet the article mentions none of them.


Three arguments against password manager software, that I had not considered, were raised by people commenting on the Wirecutter article.

Someone calling themselves Joe said: "So what happens if I set up a password manager and then find myself needing to log into a site/account from a machine that is not mine? Perhaps a family member's whom I'm visiting? Since the password manager has created all the passwords for me, how can I hope to know what the password is when I'm not using the manager?" Good point.

Someone calling themselves Rick said: "What happens when you decide you no longer wish to use 1Password, Lastpass, Dashlane etc. as your password manager? Can you transfer your password vault to another provider? Can you transfer them back to the sticky note filing system you used to have?" This generated a link to a possibly helpful article, but still, it would be a hassle that does not exist when using a formula.

Someone calling themselves Michael Rooney cited a glaring exception to the article: " ... who owns the various password managers and how is the user protected from them being purchased by someone else?" The only way to insulate yourself from a change in ownership is with software that only runs locally, has no on-line component and never gets updated. If, if, if. This is not a theoretical issue.

LastPass was purchased by LogMeIn Inc. in 2015. What was a small start-up is now part of a large conglomerate. This is a cause for concern. Being part of a large company there is no way to judge the quality of the software. When a product is developed by a small group, or a single person, you can form an opinion of how good and trustworthy they are. This is not possible when the software is in the hands of faceless programmers who, likely, rotate into and out of it. Current Lastpass users are trusting both LogMeIn and, perhaps, their corporate partners too. As a company, LogMeIn has been moving away from consumer oriented products towards Enterprise markets. For example, they purchased GoToMyPC.

Update Dec 19, 2019: Yet again, LastPass was sold. By mid 2020 the software will be owned by "... affiliates of Francisco Partners, a leading technology-focused global private equity firm, and including Evergreen Coast Capital Corporation, the private equity affiliate of Elliott Management Corporation...". Do you trust these nameless faceless owners with ALL of your passwords?

Update: January 20, 2020. It seems that LastPass is not trustworthy. They suffered an outage and did not come clean about the problem.

Reader Richard Belew was hesitant to use password manager software and wrote: "... please create a list of other plausible mechanisms, and publish again".

And these are the comments the Wirecutter let stand. Since they deleted my comment, chances are they deleted others too.

Another article arguing for password managers, generated another reader comment against them. Quoting: "I'm a huge believer in using a Password Manager. I've been a LastPass user for many years. I'm now searching for a different one due to the fact that their 'new interface' is abominable compared to the old one. Where it took one click before, it now takes three. Does that sound petty? Maybe. But hubs is technologically challenged and no longer wants anything to do with LastPass. I have to admit, I can't stand the new interface and don't really want anything to do with it anymore either ... I'm all for change when it's for the better but in this case, LastPass is a major fail...and I'm searching for a suitable replacement."

BLACK SHEEP   (section added October 27, 2019)

My suggesting a password formula makes me a black sheep amongst techies. Pretty much every computer nerd recommends password managers. It's like a cult, one always thinking inside the box. One exception is the watchyourhack.com website, created by six techies. Quoting from the website:

"Pen and paper can also be used as a password manager. Make sure to use unique passwords and store them with care. And create a copy that you store in a physical vault, should you need a backup. When you’re expecting company - like friends, family, a mechanic or plumber - take extra care not to leave your list of passwords out in the open. A useful tip is to have all of your passwords start with the same word, which you don't write down in your password book. Simply remember it. If someone gets a hold of your password booklet, they still won't be able to use any of the passwords you’ve written down, because they’re missing one essential component that’s safely stored in your brain."

A breath of fresh air :-)

- - - - - - -

For more Defensive Computing advice, see my DefensiveComputingChecklist.com website.



 @defensivecomput TOP Home => The BEST password advice   
 michael--at--michaelhorowitz.com   Last Updated: September 29, 2021 4PM UTC  
  License Plate
Copyright 2001-2021
Copyright 2001-2021  
Printed at:   October 25, 2021 12:56am   ET
Viewed 22,545 times since August 16, 2019 (28/day over 800 days)