Management of current and historic passwords?

[keeper]

So I have over 600 passwords in keychain, some being used but many from historic sites that I no longer use.
Those that are banking or may have my banking details have complex passwords and 2FA where its provided.

That still leave me hundreds that are not managed and have repeated passwords from where password generation wasn't built in or laziness.

Im interested if anyone has tackled this issue to get to a current list of those required and ensure they have a strong password.

I do have a dummy google email that can replace my real email on sites where the account can't be deleted.

Thoughts on how to tackle the issue?

 

[Fishrrman]

Don't know if this reply will be helpful, but...

Are you able (or WILL you be able) to use the new Sequoia OS (OS 15)?
(the developer/beta version is out now)

It has a new Apple app named "Passwords" as a part of it.

I found that it "picked up" (from my keychains, perhaps?) all the pre-existing passwords that were on my experimental install.
(I normally do not install new versions of the OS UNTIL I have experimented with them first on an external SSD which I set up for that purpose)

You might try the same.

But there's another way to handle things (which I guess could be called "the hard way").

That would be to create your own "password list" file.
It could be easily done with spreadsheet software (excel, numbers, libreoffice, etc.)

I used a small free database app named "iData" (I think it's now called "iData Pro").

Some apps will "protect" a file with a password.
So... you could have "a master password" required to open the file with all the regular passwords within.

There are also 3rd-party password management apps, but I have no experience with those.
I just found it easier to "create on myself".

If I could do it, you can do it.

 

[HDFan]

That still leave me hundreds that are not managed and have repeated passwords from where password generation wasn't built in or laziness.

Im interested if anyone has tackled this issue to get to a current list of those required and ensure they have a strong password.

Not sure I understand the issue. Duplicate password entries? What does "not managed" mean?

1Password has a lot of features which make password management easier. Watchtower lists compromised websites, vulnerable passwords, reused passwords, weak passwords, items with duplicates, etc.

 

[Heelpir8]

So I have over 600 passwords in keychain, some being used but many from historic sites that I no longer use.
Those that are banking or may have my banking details have complex passwords and 2FA where its provided.

That still leave me hundreds that are not managed and have repeated passwords from where password generation wasn't built in or laziness.

Im interested if anyone has tackled this issue to get to a current list of those required and ensure they have a strong password.

I do have a dummy google email that can replace my real email on sites where the account can't be deleted.

Thoughts on how to tackle the issue?

1Password's archive feature is great for dealing with old accounts that are no longer used. Gets them completely out of the way without deleting the entries.

You might want to import everything into 1Password, let Watchtower do its thing, strengthen all passwords and then archive what you're no longer using.

 

[arinamichel911]

A password manager like 1Password or Bitwarden can be used to generate and store these passwords. Also, you can update the repeated passwords into another strong password

 

[NoBoMac]

I did it years ago and basically "tossed" the unimportant ones.

Started with the most important accounts: financial, medical, Apple, email, cable. Last three are really important and overlooked since those are primary conduits for keeping things secure (sending authcodes, "click link to verify you are you", etc).

After that, just started to look through the entries in Keychain to see which ones stand out re: last updated date, know that I use it, etc.

In all cases, updated the password to something random (aside from Apple ID, but made that really strong, would be used there only, and difficult to dictionary crack) and added it to my password manager app. Actually used the password manager app to generate the passwords as it is better than Keychain imo.

A year or two ago went through the password manager to clean out old entries from it and noticed that many of the previous accounts are no longer active on those sites: seems a number of sites will prune out inactive accounts after a certain amount of time. So, they "tossed" it for me and was obviously unimportant to me as it was probably years since I accessed. And if those "tossed" accounts get hacked, no big whoop as everything important/in use has some different password.

TLDR: secure the important and active ones, don't sweat the dead/dying stuff.

 

[keeper]

I've just been through them all, 2FA where I can on sites I use, strong passwords on the others, stuff I no longer use, dummy emails address with strong password and deleted from my keychain, I deleted over 300 old passwords.

 

[LV426]

So I have over 600 passwords in keychain, some being used but many from historic sites that I no longer use.
Those that are banking or may have my banking details have complex passwords and 2FA where its provided.

That still leave me hundreds that are not managed and have repeated passwords from where password generation wasn't built in or laziness.

Im interested if anyone has tackled this issue to get to a current list of those required and ensure they have a strong password.

I do have a dummy google email that can replace my real email on sites where the account can't be deleted.

Thoughts on how to tackle the issue?

Settings | Passwords shows all my keychain passwords, plus it has a "Security Recommendations" section. In there, it shows a Security Recommendations section where it lists re-used passwords. From memory, it also shows rubbish passwords if you have any, but all mine tend to be strong as a matter of course.