Password storing apps such as Keeper

[OscarH]

keep the second factor separate from your passwords!

This is something that annoys me with some password managers, they've started supporting 2FA. Defeats the point to keep them in the same place

(ones with WebAuthn support like 1password are slightly less pointless, as at least you should get the right-site protection, but it's still nowhere near as good as an actual second factor)

 

[Puffing Devil]

I use LastPass; it's as good/safe/cheap as any commercial competitor. What's important is appropriate encryption to protect your data from the baddies. And MFA. Always MFA.

Change your Master Password frequently, don't re-use user names and never re-use a password.

Ideally, buy yourself a domain and give each service you use its own email, eg: RailUK Forums@Mydomain.co.uk

 

[JamesT]

I use LastPass; it's as good/safe/cheap as any commercial competitor. What's important is appropriate encryption to protect your data from the baddies. And MFA. Always MFA.

Change your Master Password frequently, don't re-use user names and never re-use a password.

Ideally, buy yourself a domain and give each service you use its own email, eg: RailUK Forums@Mydomain.co.uk

Some email services like gmail offer subaddressing, so as well as username@gmail.com, you can use username+tag@gmail.com. So in a similar fashion, assign a tag to every service and you'll know who's leaked your email address when you get a flood of spam to it.

 

[Puffing Devil]

Some email services like gmail offer subaddressing, so as well as username@gmail.com, you can use username+tag@gmail.com. So in a similar fashion, assign a tag to every service and you'll know who's leaked your email address when you get a flood of spam to it.

Absolutely - though not all services accept the + in the email address, and some are smart enough to strip it out.

 

[Lucan]

Random mixtures of letters and numbers is a complete nightmare (maybe unless you can copy and paste it)

Copy and paste is what I do.

I have a text file with hundreds of sets of IDs, email addresses and passwords, a different set for every entity I deal with. For banks and sellers I must obviously use my real name, and for websites where it would not matter (like hobby forums) I use the same password. I am with an email provider (several in fact) that allows an unlimited number of email addresses and I now have hundreds of them. This file is encrypted with a master password and stored on two different devices, and I have different files for finance and non-finance. I open the file if I need to look up an ID and password and then I close it again, but I can remember the ones that use my common low security password. I see no need to pay someone else to host such a file.

If someone discovered my password for this forum for example and logged in pretending to be me, it would not be the end of the world; there is nothing much in here that links me to anything else beyond what is in the text of my comments, and I am quite careful with that. They could place me in a vague geographical area but even so Google (for example, by the ads they show me) thinks I live 200 miles from where I do, and that I want to buy an industrial air compressor. I don't, but I am not going to correct them.