What's the best way to store a passphrase?

Question

I've recently enabled Ubuntu's encrypted /home/ directory features and I was asked to remember a passphrase in case I would need to recover the data manually.

What is the best way to store this passphrase without compromising security?

Answer 1

Write it down, on a bit of paper. Put that paper somewhere safe, like where you put your passports and important papers.

Encryption keys should be copied onto a USB stick and put into the same place.

I use Password Gorilla and PasswordSafe for everyday password storage and have the password to that in my brain (its complex, the only one I have to remember and used daily) and on a safe bit of paper (in case that fabled bus hits me).

Answer 2

Keepass

Excellent tool not just for passhrases, but for any login/password you have to store.

I personally use for all my passwords for all on line services I use.

Some of its features:

• Strong Security
• Multiple User Keys
• Portable and No Installation Required
• Export To TXT, HTML, XML and CSV Files
• Import From Many File Formats
• Easy Database Transfer
• Support of Password Groups
• Time Fields and Entry Attachments
• Auto-Type, Global Auto-Type Hot Key and Drag&Drop
• Intuitive and Secure Clipboard Handling
• Searching and Sorting
• Multi-Language Support
• Strong Random Password Generator
• Plugin Architecture
• Open Source!

Warning
Keepass is actually a windows app, but you can run version 1.x without problems (at least for me) with Wine or versions 2.x with the newest version of mono. See update.

or

you can use the linux native KeepassX

sudo apt-get install keepassx

Personally I prefer to use the original Keepass, since I can run it from my thumb drive on any system I have to use. But KeepassX is fine if you intend to use it only on your personal computer.

PS: You can install Mono, KeepassX and Wine from the Software Center if don't already have them.

UPDATE:

As of Ubuntu 11.04 (at least that's when I noticed), you can install Keepass 2 from the Software Center or

sudo apt-get install keepass2

Answer 3

KeePassX

For all the reasons cited by Decio Lira but without all the WINE overhead.

http://www.keepassx.org/

Answer 4

You shouldn't be using software to store the recovery passphrase for your encrypted home directory. If you store the passphrase in an application, it would get stored in your home directory and wouldn't be available when your encrypted home directory is the very thing you are trying to recover!

Writing it down on a piece of paper, or storing it on a usb key in a physical secure location such as a safe would be the best way to store your encrypted home directory passphrase.

Answer 5

I use Lastpass to store stuff like that. If you already have Lastpass, just create a secure note.

Answer 6

Write it on the wall, hidden in a little corner of your house.

But, also, an excellent idea is to write it wherever you choose but do not write it down literally; use a mnemonic system.

For example, write: "dumbest_commander+my_nr", if your password is "gwbush3355" and 3355 is a number you know and remember well; or write down: "little love+yr", if the password is the first person you fell in love with followed by the year that happened; or write down: "colourcitysport", if your password is "greencalcuttatennis" because your favourite colour, city and sport are: green, calcutta and tennis; or write: "pornstr + b-yr", if you want to use your favourite pornstar's name followed by her/his birthyear as a password, etc., etc. It is up to your imagination.

This is good for personal use when you have many different passwords and/or don't use them very often. This is the intelligent way to do this kind of things.

Answer 7

I just heard of passwordcard.org from Planet Ubuntu .. it's a pretty genius system for creating strong passwords, and saving them for later. You essentially make a card at the site using some hexidecimal number, and you get a card full of random passwords. You then determine a way to get a password from the card (for instance, for your encrypted partition, choose the smiley face column, blue row, all the way to the end). Check it out at passwordcard.org

Answer 8

The best way to store a passphrase is to memorize it. The best way for me to store a passphrase is not to save it, so that I have to type it over and over and over. Eventually I can throw away the sticky note.

Answer 9

As some others recommended here writing the password down is a good idea. However I want to add some points:

1. In the beginning it is hard to memorise your password or passphrase. So I would suggest to often relogin during a day. This helps to memorise it.
2. Keep your password somewhere near you. A good idea might be your wallet. Usually not many others have access to it. Users tend to keep an eye on it. So it is a good place for »saving the passphrase«.
3. When you can easily remember your passphrase I would suggest to throw away your paper. Instead split it into three or more parts, write every part on a separate piece of paper and hand it out to some friends. Bonus points if the friends do not know each other. If you forget your password you can recover it.
4. If you own a bank safe, you can also put it there. It is safe from a »normal« burglar, but authorities and corrupt employees can get access.

There are other ways of storing your password. You should thing about some short term strategy until you have memorised your password. Later you should switch to some long term strategy with higher security requirements.