Password Manager

One of the great ways we can manage a password is through a password manager.

Why a password manager is a must

There's a lot of things we should be doing to have great passwords: things like length, complexity, changing it often, a password per account. What we've done is we created an extremely high bar for us and for our users that we need to achieve to have a strong password. Ideally all of our passwords would look like this for every single account, but how in the world would you memorize something like that?

That's why, in my opinion, a password manager is a must. We should be using password managers both for us and for the users that we are setting our policies for. A password manager is used so we don't need to memorize a bunch of complex passwords. We have one location where we keep all of our passwords, and that's encrypted and it's very secure, and we keep all of our passwords safe for all of the locations that we want to log into. Then we have just one single really good password that we use to get into our password manager.

In this case right here I'm using a passphrase, so there's a whole phrase, a whole sentence, with capital letters and periods and punctuation, and maybe I incorporate a number into this. This is not a great one, because this is a password from the movie Home, but this drives home a point: we can have something that is actually fairly easy to remember, that we can memorize, that is very secure, and in this case it will get us into the one location that's going to give us access to all of our passwords.

A look at KeePass

What I'm going to do is open up a password manager that I use called KeePass. What I do is I type in my master password in here — it's a long phrase here — and then I'll click on OK, and now I'm into the program, into the password manager.

Let's say I want to add a new entry. What I would do is I go up to this key right here and click on it. It's an add entry key, so I'm going to click on it, and then I'm going to type the website name, or whatever I'm giving access to. So in this case right here, maybe we are setting up an account in TechKnowSurge, so I can type in TechKnowSurge, and maybe I type in the URL, which is techknowsurge.com. And then the username that I add on to here, so whatever username it is — maybe it's Andrew, let's just use that as an example, or maybe it's an email, so maybe [email protected].

And then the password here: notice it automatically populates it with a complex password, a fairly complex password, so we could just use that password. There are a couple of ways I could access this. I can just copy it from right here and paste it into there, or if I click on OK I can right-click on it and say copy username and then paste it over into there, and then copy password.

Now, one thing that's great about this: when I right-click and say copy password, it's storing it inside the clipboard, which is a security concern, because now anybody who has access to the clipboard can use it. So I can hit Ctrl+V here and you can see that I can paste it in wherever. This is a problem, this is a security hole. So when I right-click on this and say copy password, notice that there is a countdown. It only stores this inside of the clipboard for a certain period of time, and once that counts down — you can see it's 12 seconds here — once it counts down, then I go to paste this and now I can't paste it into anything. I can't paste it into something. So it's a security feature that it only remains inside the clipboard for a certain period of time.

You'll see that there's a lot of other advantages to this password manager, and I'm not going to get into all of the advantages. If I want to search for something, I can search for it. It's got a lot of features in this that I just absolutely love. I can generate even more complex passwords if I want to generate more complex passwords. So there are a lot of great ways to go about using this tool.

Local, cloud and self-hosted options

The example I gave you shows a version of a local password manager. It's software that's installed on the machine that I can access on the machine, and it gives me a lot of great advantages to doing it this way. But there are also hosted cloud solutions, so there's a way that I could go and get a hosted cloud solution, and there are advantages and disadvantages to that. Or I could actually pay for a solution and host it internally — that is, set up a server internally within my business that people have access to.

Personally, I love the locally hosted option, that is, it's stored on my local computer. Somebody would have to have access to my local computer and be able to hack into that local computer, then they'd have to be able to hack the encrypted files to get that information. So I feel like this is a very secure method and really practices defense in depth. But one of the problems of this is that it is local, so if I were to lose the local file, that could be problematic. If I'm managing a bunch of users, then they all have their local files, and we're relying upon them to have good file management to make sure that those files are secure.

The advantages of a cloud solution are that any device that I have — maybe it's my phone, maybe it's my laptop, maybe it's my tablet — any device that I have can be linked to all of those, so I could use it in many different scenarios. So there are some great features of the cloud. And if I roll this out from an enterprise perspective, then I've got a lot of features that I can manage my users with. For instance, let's say somebody leaves: what I can do is I can reassign those passwords to somebody else. I don't lose access to those passwords. But the problem is that there are companies out there that manage passwords that have been hacked before, so if they get hacked then all your passwords could be exposed, and obviously this is problematic.

So there are solutions that are similar to cloud hosting but you can manage it yourself. You can manage it internally, and then you have some of the same type of access that you have with the cloud hosting, but you have more control over the security of it.

That's not to mention that in all of these cases you're really relying on somebody else's code and the way that they encrypt and treat the information. So you're relying on another company in essentially all of these situations. But this is practicing great defense in depth, where you can have control over the local files, so you have a little more control over it, and you have less control over this cloud environment.