Bsrgvty

Memorising a really strong master password is probably a bit much to ask

I disagree! I have a daughter who, at around 7, was able to quickly memorize a very strong password using the Diceware method for use in a password manager. This method picks several random words from a dictionary (typically) composed of 7,776 words. A mere 9 words is log₂(7776⁹) ≈ 116 bits.

If you use a password manager that supports password-strengthening with an algorithm like PBKDF2, you can reduce the length of the password even further. Using 262,144 (2¹⁸) hash iterations, you can increase the security of a 6 character password to log₂(7776⁶) + 18 ≈ 96 bits. An example password:

octopus handrail chasing hull shy ambition

That's not hard to remember! It does take some practice and it's not as easy as memorizing a weak password with just one or two words or the name of a pet, but it is something that a child, even a young child, is able to do. Some password managers support multiple equivalent master passwords, making it possible for you to keep a backup password until you are sure your daughter won't forget hers. Then you can revoke your own password so you don't need to have unnecessary access to her passwords.

and she's likely to mislay any physical storage.

If you don't want to synchronize the password database, you can use a stateless password manager. This is a password manager which uses a combination of an identifier for the service you want to log into, as well as a single, strong master password. A stateless password manager works by hashing a concatenation of your master password and the service identifier. It has a few downsides, though:

1. You can't change a site's password without changing the identifier or master password.




2. If your master password is ever compromised, so are all your site passwords.




3. The master password must be strong enough to resist attacks on its own.

If reliance on a storage device to hold the password database is simply unacceptable, then stateless password managers are absolutely the way to go. They can be very secure if used correctly.

"Logging in from multiple devices" if you do not own them, is one habit that would need to be stopped for general security.

Once you own all the devices in the scenario, one method that I saw for young people that was useful is to avoid dealing with passwords altogether: use the "forgot password" process.

If the device is owned and access to email is on the device, then you simply request a password reset link and use that. Nothing to remember.

Another method is to use an online, family password manager (LastPass has this feature, for instance). This feature is designed specifically for this problem, but it has a cost, and you might not like the cloud storage and multi-device syncing. But having this and managing it for your child might be worth it.

You could also teach a strong password pattern. Yes, patterns have an inherent and obvious vulnerability, but it is a method that can be considered for your personal risk assessment.

I'm a fan of the "password reset" process, myself.

Now I am not sure if I am right but I think teaching basic mnemonic techniques to kids seems like a wonderful idea to me. It's a skill that will help her lifelong and will also aid in avoiding writing down any passwords and low entropy password. Consider a 10 digit gibberish password such as 1kej@!lej2. This could be easily remembered if you just made up a story by using characters of the password. Schroeder's advice also seems good to be honest. You could also teach her in time "how to generate passwords with sufficient entropy" and use a password manager. Until then mnemonics should do fine for kids. They have a vivid imagination.

EDIT: The answer that I wrote is wrong. The mnemonics part is correct but the password I chose is not sufficiently lengthy or easy to memorize. This question goes into the math and usability issue in detail. A far better method is the one written by forest in his answer.

Great question/topic, and if the definition of password "management" here also includes "password generation" I would provide a Python program or similar that generates cryptographically-secure passwords of various lengths with just a few lines of code, and show the child how to easily run the program anytime they need a strong password. (as this would be a better habit in my opinion than thinking of a strong password each time).

Here is a rudimentary example I built that is cryptographically-secure using the secrets module in Python and library of 64 characters: https://github.com/hatgit/hatnotation/blob/master/Hatnotation-Password-Generator.py

Such 'secure' passwords, however, cannot be easily remembered as they look like a string of machine-readable code, unless the underlying binary is converted to mnemonic words so it can be easily written down.

I've also built an encoder/decoder (notation system called Hatnotation) and with the above compatible password generator for educational purpose, the underlying binary could be pasted into a mnemonic code converter, such as follows:

A random 22-character password generated from the range of 64 characters where 64^22 == 2^132 in terms of bits of security/entropy, using the Hatnotation password generator: }FT}:+3'Z;:BB,LY^>EOPF

Underlying 132-bit binary that represents those 22-characters (non-ascii, these are Hatnotation- encoded characters:)010111000100111100011011111011011001000010110100010100010011111001011111111100010101110000010111101011100110101100011100100001011101

Converted 132-bits into a mnemonic based on the BIP39 English wordlist (excluding checksum, and which can be an alternative to the Diceware options that @Forest provided), using a mnemonic converter that can work offline on a standalone basis:

shaft mistake rent bird eye very wisdom return kit culture improve ritual

An alternative is to teach them to how to generate entropy in binary or hex format using the command line or code compiler (which is faster than flipping coins), and how to paste such binary into the mnemonic converter of their choice depending on the wordlist used (even if it is their own custom wordlist). In Python, there are a few secure ways to do so using the built-in secrets, uuid4() and os.urandom modules.

P.S. In terms of storage/password-custody retrieval, if passwords are saved in the browser's native manager, and there is a concern about logging into the browser (i.e. Google Chrome) session from public or other potentially-unsafe locations in order to access passwords for logging-in to services such as the Scratch.Mit.edu website , I think adding a 2FA app such as Google Authenticator (assuming the youngster has a cell phone or compatible device, even if it is offline) could reduce the risks of those passwords being accessed by an adversary, if the login info was otherwise compromised.