You should be using a password manager. If you're a technical person, this is probably not news to you - you're very likely already using one.
This article is for the non-technical people. People like my wife (hi, honey!) and my mom. People who access a lot of websites and have a lot of passwords to remember.
So why is using a password manager a good idea?
Well, you may have seen guidelines for cyber security that tell you things like:
- Don't write down your passwords.
- Don't reuse passwords on different sites.
- Don't use short, easy to guess passwords.
- Don't use passwords that are easy to figure out from public data (like a birthday that anyone can get from your Facebook profile).
Such guidance raises the question: if I have to use long passwords that aren't related to anything in my life, and I can't reuse them or write them down, how the hell am I supposed to remember them?!?
This is a totally reasonable question. Yes, ideally we would all memorize a hundred different 32-character-long, randomly generated passwords. But in real life, nobody can actually do that. So a password manager is a good compromise.
What is a Password Manager
My mother has a little paper "password book" that she keeps in a drawer next to her computer. When she has to create a new account for some website, she writes down all the login information in that book so that she can look it up later.
A password manager is the digital equivalent of that password book. It's an application that lets you record your login information and them look it up later. Most password managers have lots of other handy-dandy features as well, but that's the core of what they do.
So how is this different from, say, writing down all your passwords in a Word document on your desktop? Well, a password manager encrypts all your data. It requires a "master password" to decrypt your information, so if some nasty hacker steals that file, they won't be able to actually read it.
Is this as secure as just memorizing all your passwords? No. But as we said, nobody can do that anyway, and this is one heck of a lot more secure than the alternatives, i.e. reused or weak passwords. With a password manager, you can still have strong, unique passwords for all your sites, but you're relieved of the burden of having to remember them all.
There are a number of password managers out there, but the one I'm going to talk about is KeePass. It's a free, open-source password management application that will run on Windows, Linux, and Mac, and has compatible apps available for iOS and Android. KeePass works offline (i.e. it requires no internet connection and doesn't depend on any online services), but it's possible to sync your KeePass passwords between devices using file sync tools like DropBox or OneDrive. So it provides you some flexibility, but you aren't beholden to a single company that can get hacked or go out of business.
KeePass creates files password files that end with ".kdbx". You can open those files from within KeePass or double-click on them in Window Explorer. When you try to open one, KeePass will prompt you for the master password to that file. Every KDBX file has its own master password. This allows you to do things like create a password file to share with the rest of your family, and have a different one for the accounts that are just yours. (That's a topic for a different post.)
One of the handy extra functions of KeePass is that each entry in your password save can have a bunch of extra data associated with it. For example, you can add custom fields and attach files to each entry, which are handy for things like account validation questions and activation files for software licenses. Basically, you can keep all the important information in one place. And since KeePass encrypts your entire password file, it will all be kept secure.
So how do you use KeePass? Let's walk through it.
Step 1 - Download
The first thing you need to do is to get yourself a copy of KeePass. You can go to this page and click the download link for the "professional edition". (There's not really anything "professional" about it - it's just a newer version with more features.) When that's done, you can double-click the file to install it like any other program.
You can also install KeePass through Ninite. If you're not familiar with Ninite, I strongly recommend you check it out. It's a great tool that makes it brain-dead simple to install and update a collection of programs with just a few clicks. You basically just select a bunch of applications you'd like to install from a list, click a button, and you get an installer program you can run to put everything you selected on your computer. And if you run that program again later, it will actually update any of those programs that have a newer version. It's very slick and a real time-saver.
Step 2 - Create a password safe
Next, open up KeePass and click "File > New". You will be prompted to choose where you want to save your new password database. Choose a name and folder that work for you. Remember - your password database is just a regular file, so you can always move or rename it later if you want.
After that, you should get a dialog that looks like this:
This shows several options for securing your password safe. But don't worry about that - the one you really want is the first one, "master password". So choose a password and type it in. If you click the three dots on the right, KeePass will display the password as you type, so that you don't have to re-enter it.
There are two important things to note when choosing a master password. First, since it's going to protect all your other passwords, you want to make it good. KeePass provides a password strength meter to help you judge, but the main things to bear in mind are that you want a range of different characters and you want it to be long. And no, ten letters does not qualify as "long" - it should be more of a passphrase than a password. One common technique is to use a full sentence, complete with capitalization and punctuation (an maybe some numbers, if you can work them in). That will generally give you a pretty strong password, but it will still be easy to remember.
The other important thing to remember is that the password to a KDBX file is your encription key for that file. That means that the only way to decrypt the file is with that password. If you forget your master password, your data is gone forever. So write down your master password and keep it in a safe place until you're certain you've committed it to memory. And if you want to change your master password later, make sure to make a backup copy of your KDBX file first.
After you've chosen a master password, you should see a screen that allows you to configure some of the settings for your password file. However, you don't really need to worry about this - those are all optional. You can safely click the "OK" button to just continue on.
Step 3 - Organize your passwords
Alright! You now have a password database set up. You should see a list of groups on the left and a list of password entries on the right, like in the image below. These are the sample groups and entries that KeePass creates by default. They're just to give you an idea of how to use your password database - you can safely delete them at any time.
You can click on each group at the left to see what entries it contains. The groups are basically like folders in Windows. There's a top-level folder, and it contains a bunch of sub-folders and each of those sub-folders can contain other folders. So in the screenshot, you can see that "NewDatabase" is highlighted in the group list. That's the top-level folder for my example database. You can see on the right that it contains two entries. You can move an entry into another folders by dragging it from the entry list on the right onto one of the folders on the left.
Step 4 - Create passwords
To add a password entry to your database, select "Edit > Add Entry" from the menu. That will bring up the entry edit screen. This is the same screen you'll see when you double-click on the title of an existing entry, except that it is mostly blank.
There are a lot of tabs and options on this screen, but you don't really need to worry about those. The main things are right in front of you: the entry title, user name, and password. You'll probably also want to fill in the URL field with the web address of the site this information is for. This will come in handy if you want to use a KeePass plugin for your web browser (which we'll cover in another post). When you're done entering your info, click the OK button to create the entry. You should then select "File > Save" from the menu or push the "save" button on the toolbar to save the changes to your password database.
You'll probably notice that there's already a password filled in. KeePass will generate a random password for new entries. You are free to change this yourself or use the button to the right of the "repeat" box to generate other random passwords using different rules. KeePass has a password generator that lets you specify the allowed characters and length for a random password, which is handy for those sites that insist on specific password length or complexity rules.
Step 5 - Getting your passwords out
Now let's back up and say you've just started up your computer, are logging in to some website, and want to get a password out of KeePass. The first thing you need to do is open up your password database. You can do this by double-clicking on it in Windows Explorer or by opening up KeePass then selecting your database from the "File > Open" menu. When you open the database, you'll be greeted by a screen asking you to enter your master password - you know, the one you came up with in step 2. (Hint: remember that you can click the button with the three dots to display the password as you type it.) After you enter your master password, the database will be decrypted and you'll find yourself and the entry browsing screen from step 3.
There are several ways to get your passwords out of KeePass. Here's the list in order of preference:
- Use a browser plugin to automatically fill in login forms. Since most of the passwords you end up creating are for websites, setting up your browser to fill in the forms from your KeePass database makes life much easier. I'll talk about how to do that in the next post. But don't worry - it's not all that hard.
- Use auto-type. This is a feature of KeePass where you to click a button in the KeePass window and it will automatically send the keystrokes for your username and password to the last window you used. So, for example, you would navigate to the login page of a site in your web browser, click in the username box, and then switch over to the KeePass window and click the auto-type button on the toolbar (the one that looks kind of like some keyboard keys - hover your cursor over the buttons to see the descriptions). By default, the auto-type feature will type your username, the "tab" key, your password, and then the "enter" key. This will work for probably 90% or more of login pages, but it's not universal, so be aware of that.
- Copy them to the clipboard. If all else fails, you can always just copy your passwords to the clipboard so that you can paste them into another window. KeePass makes this fairly easy. In the main password list that you saw in step 3, when you double-click on the actual username or password for an entry in the list, it will copy that to the clipboard. This saves you having to open up the entry edit screen and copy things there. You can then switch to another window and paste the data into a login screen.
- Just read it. Last, but not least, you can always go low-tech and just read the passwords out of the window. Just double-click the name of your entry, then click the "three dots" button to make the password visible. Clearly this is not great, but sometimes it's necessary. For example, you will need to do this when entering a password on a system that doesn't have KeePass installed, such as to login into your Amazon or Netflix account when setting up a Roku or other streaming media system.
With any luck, I've made this "password manager" thing sound good enough for you to try it out. You really should look into it. Password reuse has become increasingly dangerous, with hackers trying the usernames and passwords they harvested from one hack on other sites just to see if they work. Password cracking tools have also advanced a lot in recent years, including information gleaned from previous attacks, so relying on things like "133t 5p34k" passwords is no longer good enough. A decent password manager, if used consistently with randomly generated passwords, will provide you with a good trade-off between convenience and security.
You can reply to this entry by leaving a comment below. You can send TrackBack pings to this URL. This entry accepts Pingbacks from other blogs. You can follow comments on this entry by subscribing to the RSS feed.