DEMO: Password Manager

Why a password manager matters

There's one application that I want to make sure we cover, because I feel like it's really critical, and that's a password manager. Not everyone uses them, although I feel like everyone should use them, or at least most people.

I don't really want to get in depth into what makes a good password and what things to avoid. There's quite a few recommendations that I have that I feel like are really important, but it's just not part of this lesson or this course. What I will say is there are certain things that you should probably implement to make sure that you have a secure password and that it's not going to be hacked. And if it were up to me, all passwords would look like this.

It's really critical that you have a separate password for all of your critical accounts. Can you imagine, for every single critical account you have, that you would have a password that looks like this that's completely unique? Well, that would be really hard to memorize all of that. That's why I think having a password manager is critical nowadays: you have one location that is super secure that you keep all your passwords in, that gets you access into all of your other sites. So this is something that I recommend that you have.

Essentially what we do is we have an encrypted source where our passwords are at, something that's super secure, and then we have a super secure password, a long password, but one that we can memorize to get into that password vault, that password manager. And then from there, we have long passwords for each one of these other locations, things that we want to get into, but we don't have to memorize all of those because it's secured in an encrypted format.

The different types

There are several different types that are out there. There's one in the cloud, there's ones that are encrypted and stored locally, and there's ones that are incorporated into your browser. There's only really one that I like personally.

It is better to have a password manager than no password manager, but I'm really not a big fan of ones that are up in the cloud, because I don't have control over it. You're turning over your passwords to somebody else. And in the case of like LastPass, where things became unsecure, now all your passwords are insecure, and so that can be problematic. So I don't really trust putting it in somebody else's hands. Although it can be a good solution, and it's better than nothing, it's not my favorite solution.

Same thing with the browser. There are now browsers that have password management incorporated into it. I'm not a big fan of this, because that's kind of like if you have a bank card that has a PIN number to it, and you keep the PIN number on the bank card, and you say, "Well, it's secure because it's in my wallet. So because it's in my wallet, no one can take it and no one can see that PIN number." But in fact that PIN number on there is insecure. Well, now if you have your browser that has your passwords in it, that's really quite insecure. So I'll do that for a few sites that I don't really care about, but I don't do that for my critical sites.

My favorite is something that's stored locally, encrypted, has great encryption on it, and a really strong password to get into it.

Open authentication

I'll also address open authentication, or OAuth. This is when you go to sites and you have the option of logging in with something like your Facebook account or your Google account. It's the same thing: now the keys are inside the browser to get into those locations. Well, that's not how I want to treat my passwords, and I wouldn't want to get into some of these accounts via that method. Once again, maybe it's okay for some of the sites out there, but certainly there are things that I don't want to have that option for. That's why you don't have that option for something like a bank.

So here's an example of that OAuth. This is logging into Atlassian, and I have the choice to use my email address and password, or I can use my Google account or Microsoft account or Apple account or Slack account to log into this. This is what I'm saying I'm not a big fan of. If I think that this is a sensitive site that I want secure, then by logging in via these methods, it makes it really easy to log into them. But that means my credentials, the way I log into these, is stored on this machine. If this machine were to ever get out into the public, then they would be able to access my account. And so instead, largely for the most part, I use this: entering in my email address and password to make a connection to it. Plus there is also the disadvantage of using these other Google or Microsoft or Apple accounts, that some of the information can get shared from these different locations to my Atlassian account, and I don't necessarily want to do that from a privacy concern.

KeePass

My favorite option is KeePass. I'm going to open up KeePass, and what it's going to do is ask me for a master password. This is going to be that super secure one. My example right here is going to be correct horse battery staple. And this is actually, believe it or not, a well-known password that's out there, so I wouldn't choose it for that purpose. But this would be the bare minimum: choosing like four seemingly random words and throwing them together is somewhat secure. The one that I have is a big password phrase on my KeePass that's way more secure than this.

I recommend making it as secure as possible, pulling out all the stops to make this. And really, I'll just tell you that pulling out all the stops doesn't mean that you necessarily have the complexity of like replacing characters with numbers and that type of stuff. It just means having it long. Having a long password, and maybe throwing in a number or two or whatever to randomize it a bit, but making a longer password is definitely more secure.

I'm going to click on OK to open this up here. And here it is. I've got all my passwords that are in here. If I want to generate a new password on here, I click on the new key. So I'm going to add an entry, and whatever I'm adding it to, maybe I'm doing the Atlassian site. So I type in Atlassian. What's my username? A lot of times that's the email account, so whatever email account it is. And then here's the automatically generated one, which is usually fairly secure. I could generate a more secure one, but this is usually a pretty good random. It's going to be pretty hard for anybody to figure this password out. And so now I have this as a password. I can click on OK.

If I wanted to use it, all I need to do is click on this and say copy username. I'd paste it into the browser. And then I would say copy password and paste it in the browser. But what's cool about this is notice this countdown down here. You have 12 seconds for it to be cleared from the clipboard. So once this counts down and now it's disappeared, that's no longer in the clipboard.

To just show you what I mean by that, I'm going to say copy password. I'm going to open up Notepad and I'll paste it in here. We're going to wait until this counts down, and then once it counts down to zero again, I'm going to try pasting again. And it's not pasting in there, because it's no longer in the clipboard. So this is an awesome feature of this, because now there's no chance of me pasting this into a spot where it's not supposed to be pasted into.

Then what I can do is save this. I'd have to save this as what's called a KeePass database, and then all my passwords are secure in here. So this is a great password manager that I use, and this is just my demo one right here, but I highly recommend a password manager like this. KeePass I've had great success with.

Personal use versus a business

I will add one thing though, and that is that this is a great solution from a personal perspective. This is probably not the solution I would choose for managing a business or for an enterprise at that level right there. What you actually need to do is do something in the cloud, or better yet do something like a local hosted server. The reason why I say that is because imagine, let's say an employee left and they were disgruntled and they had all of these passwords locally, then that's a compromise. I have more control when it's up in the cloud, or if it's a local server that I'm hosting.

The other thing too is, let's say they have a laptop and it gets stolen. Even though it would be safe, because these passwords would be encrypted, maybe we lose important key passwords and no longer have access to something because those passwords are gone. Well, that's where having some sort of server or something like that hosting that out would be a good solution, because I have much more control and can't lose that information as easily. So it depends a little bit on your scenario.