Passwords & Two-Factor Authentication

During a recent morning on 3740 kHz we discussed the two big Yahoo email breaches and the need for effective password use and management. A detailed Q and A about the Yahoo breaches is available in this article by Brian Krebs. Today we depend upon online accounts for many purposes. Our most important accounts (e.g. finance-related) must have strong passwords that are not reused at other sites. A good way to meet these requirements is by use of a password manager. (Paper records are also popular, but require manual typing of login details and secure handling.) Below are links to two (of many available) password manager programs that have good reviews from security analysts and journalists. Both are free and have versions for Windows, Mac, Linux, iOS and Android.  If you have not used one, I suggest that you try one with one or more of your existing logins to explore the features.

• LastPass
• KeePass

You can find these and many others reviewed in many web articles such as the following:

• The best password managers for PCs, Macs, and mobile devices
• The Best Password Managers of 2017

Several programs provide automatic fill-in of username and password blanks on web sites that you log into. Some or most can use secure cloud storage to make it easy to access your password data from multiple computers or mobile devices. These programs can also generate a complex, random unique password of any length to use with each online account.


Note that use of any password manager requires you to choose a strong master password since it must protect all of your stored passwords.


For additional security you should consider two-factor authentication (2FA) which requires entry of an additional piece of information when a login is attempted from a previously unknown device. This is strongly recommended for online accounts that involve your financial matters. Below are links to articles that discuss how two-factor authentication works and why you should use it.

• Multi-factor authentication
• Two factor authentication: what you need to know
• Websites that support 2FA

At the very least, you should make sure that your important / finance-related online accounts use unique and long passwords. Password complexity is important too, but if you must sacrifice complexity, use longer length. For an appreciation of the importance of password length see this article by Steve Gibson. With a password manager you can use long and complex passwords since you are not burdened with manually typing them in at each login.

Your comments and questions are welcome.

John

Password Management

Below are my notes about several methods and tools for password management. Individual needs and preferences will always help to determine the best approach. 

For a collection of articles that review various password management programs, scroll down to the section labeled  "Reviews".

Paper Records

• easy to use, but requires manual keyboard entry of login data
• storage is offline
• must be stored and transported securely
• may not be with you when you need it
• no electrical power needed to access
• frequent updates can get messy

Web Browser Password Storage

• built into popular web browsers
• convenient for most web sites
• storage by web browser on your device is not highly secure
• password data can be lost if not backed up
• must synchronize among multiple devices
• master password strongly recommended for user access

Spreadsheet Password Storage

• convenient for most web sites
• storage by spreadsheet file on your device is not highly secure
• password data can be lost if not backed up
• must synchronize among multiple devices
• master password strongly recommended for user access

Cloud-based Password Managers

• encrypted password data is shared among all of your registered devices via cloud storage
• all encryption / decryption is done on your device
• software must be installed on each device
• can augment security with a hardware multifactor authentication device
• able to capture login information during initial login creation on a web page
• automatically enters login information on subsequent logins
• easy to create new login information and updated passwords
• can generate strong random passwords that meet web site requirements
• can securely store content other than logins
• a master password is required

Local Computer-based Password Managers

• encrypted password data is stored on your device (computer, phone, flash drive / removable media)
• data file must be backed up
• if removable media used for storage, must transport between devices
• all encryption / decryption is done on your device
• software must be installed on each device
• some can augment security with a hardware multifactor authentication device
• data can be shared among all of your devices via manual copy process, local server or cloud
• easy to create new login information and updated passwords
• can use copy / paste or auto-text to apply login data to a web page
• can generate strong random passwords that meet web site requirements
• can securely store content other than logins
• a master password is required

Reviews

Many articles are published that review and compare password manager programs. Here are a few for information. The first article does a very good job of explaining the big picture and the specifics of various approaches.

Password managers: Are they safe? Which is the best?
The Best Password Managers
Lifehacker Faceoff: The Best Password Managers, Compared 

Take control of password chaos with these six password managers

Web Browser Based Password Managers  -- See page 5

Top 10 password managers