Embedded Files
Why Use A Password Manager?
Using the same email and password for multiple online services poses a significant security risk. In the event of a data breach or a malicious service, attackers can exploit this vulnerability by trying the compromised credentials across various platforms until they gain access, rendering the strength of the password irrelevant. Even attempts to outsmart attackers by tweaking passwords often fail, as cybercriminals anticipate these patterns. This common method, known as "credential stuffing," is a prevalent technique used by attackers to compromise accounts. To bolster security, it's crucial to use strong, unique passwords and consider employing a password manager like Bitwarden or 1Password, which can alert you in case your credentials are compromised.
Why You Shouldn’t Store Passwords In A Browser
Information: View a video demonstration by The PC Security Channel showcasing how malicious software retrieves passwords from web browsers. Alternatively, use WebBrowserPassView to easily retrieve your browser passwords.
Web browsers safeguard autofill data by encrypting it, which allows decryption only on the same device and account where the data was initially saved. This security measure, however, is contingent on the security of your device and account, including the absence of malware on your device. Firefox provides an additional layer of protection with a master password, although this feature is not enabled by default. Malware can extract data from Chrome and other Chromium-based browsers by courteously asking for decryption once it has infiltrated your system. Firefox adds a slight hurdle for malware by concealing data in profiles with random names, but this does not make it invulnerable. The stolen data is usually dispatched to cybercriminals who might exploit it or trade it on the black market, potentially resulting in unauthorized account access, financial losses, and a range of illegal activities.
Recommended Password Managers
Information: I highly recommend 1Password for its cross-platform compatibility, user-friendly features, enhanced security with high entropy encryption, and superior native client support with an intuitive interface.
Bitwarden (Free)
Information: To access additional details about the security measures implemented by Bitwarden, please refer to the Bitwarden Security FAQ, Is Bitwarden Audited, and Bitwarden Security Whitepaper.
Bitwarden ensures robust security for your passwords through several key measures. Being open source, its code is transparent and continuously reviewed by the community. It undergoes regular audits by third-party security firms and independent researchers. Bitwarden employs end-to-end encryption, meaning your passwords are encrypted on your device before being stored on Bitwarden servers, ensuring that only you can decrypt and access them. Even if Bitwarden's servers were compromised, your data remains protected due to strong encryption practices. The company’s compliance with GDPR, CCPA, HIPAA, SOC 2 Type 2, and SOC 3 further underscores its commitment to security and privacy.
1Password (Paid)
Information: To access additional details about the security measures implemented by 1Password, please refer to the 1Password Security, Secret Key Security, and Secure Remote Password.
1Password employs a robust security model designed to ensure the safety and privacy of user data. It uses end-to-end encryption, meaning that only the user holds the keys to decrypt their data, protected with 256-bit AES encryption and PBKDF2 key strengthening. The data is further secured with a Secret Key combined with the user's account password. Additional features such as automatic clipboard clearing, code signature validation, auto-lock, and Watchtower vulnerability alerts provide layered security. 1Password also emphasizes transparency by using open standards and undergoing regular independent security audits, making it a reliable tool for safeguarding sensitive information.
Important: Avoid LastPass due to its recent security breaches and inadequate response. The company suffered data breaches in 2022 and 2023, compromising user data. LastPass's slow response, lack of transparency, and questionable claims about "zero knowledge" have raised concerns among security experts. It's wise to consider using the recommended password managers for better security.
How To Create A Strong Password
Information: For a secure method of creating robust passwords, consider utilizing the Bitwarden Password Generator or 1Password Password Generator. By visiting the website How Secure Is My Password, individuals can check the strength of their passwords.
Best Practices
A longer password is generally much harder to break. Aim for at least 20 characters if possible. Length plays a bigger role than complexity alone.
Don’t just stick to lowercase letters. Use uppercase letters, numbers, and special symbols like @, %, or ^. A broader range of character types significantly raises the difficulty level for anyone trying to guess or brute-force your password.
No birthdays, pet names, or anything a hacker could potentially guess. Also, steer clear of obvious words or phrases like "password" or "123456."
Try to be random in how you include them. For example, don’t just add a “1” at the end—scatter symbols, numbers, and capital letters throughout.
Think about entropy like a measure of unpredictability. The higher the entropy, the stronger the password. Entropy is measured in bits, and the more bits, the better. For example, reaching 100 bits of entropy (usually a mix of characters and a length of 20 or more) means your password is almost unbreakable by brute-force attacks.
For passphrases, use a memorable, random combination of words. For example, “PurpleGiraffe#98_Dances!” is easier to remember and has good entropy.
Some passwords are just too common, even if they’re long or complex. Check your password against blocklists like the one from NIST to ensure it’s not commonly used or predictable.
Important: Pwned Passwords consist of numerous genuine passwords from real-world situations that have been compromised in past data breaches. This compromise renders them inappropriate for continued usage due to the significantly heightened likelihood of them being exploited to gain control over other accounts. Visit HaveIBeenPwned to verify whether your password(s) have been compromised in this manner.
HaveIBeenPwned protects the privacy of searched passwords by using k-anonymity, sending only the first five characters of a hashed password to the API, which returns multiple possible matches, and the client-side application then compares the full hash of the password to determine the correct match.
Use Multi-Factor Authentication
After setting up Bitwarden or 1Password, it is recommended to enable Multi-Factor Authentication (MFA) on all your online accounts. MFA provides an extra layer of security beyond passwords by requiring additional identity verification. Avoid using SMS for 2FA due to vulnerabilities like simjacking and man-in-the-middle attacks; instead, opt for an authenticator app like Aegis or Ente Auth. Even if a hacker discovers a user's password, they would still need physical access to the user's device (e.g., phone) to gain account access. The strength of MFA methods varies, with stronger methods being more difficult for attackers to exploit. Examples of MFA methods, ranked from weakest to strongest, include SMS, email codes, app push notifications, TOTP (Time-Based One-Time Password), Yubico OTP, and FIDO (Fast Identity Online).