security_topics
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| security_topics [2020.12.22 11:01] – [Care and Maintenance of Secure Passwords] Steve Isenberg | security_topics [2021.12.22 10:51] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ~~NOCACHE~~ | ||
| This is a work-in-progress. | This is a work-in-progress. | ||
| - | Version 20190817.0930 | + | <fc # |
| + | Overview | ||
| + | |||
| + | We all have bank accounts, credit cards, insurance policies, healthcare accounts, the list goes on. Many are online. There are so many of these, each with its URL to go to for access, phone numbers, account numbers, and requiring a password to access--one that is complex and hard to guess. | ||
| + | We will discuss a solution that your presenter uses to solve all of these challenges in a cost affordable--free--way. | ||
| + | |||
| + | ====Summary, | ||
| + | For what it's worth, I use KeePass and on multiple devices. I will summarize below. Note, there are no costs (to purchase or recurring) for any of the following (further down on the page some items may have a cost and it is noted). | ||
| + | The major benefit for using a password manager are: (1) You only have ONE password to remember, and (2) You can use Long, Complex, and Hard-to-guess passwords | ||
| + | - KeePass refers to both (a) an encrypted database holding information and (b) the name of one application that can access the database. | ||
| + | - A KeePass // | ||
| + | - Logins and password | ||
| + | - Other information you feel useful, such as: Social Security numbers, Secret passwords (answer to "what was your first dog's name" | ||
| + | - Past passwords. Date you started to use a given password. | ||
| + | - And all of the data in the database is encrypted. | ||
| + | - There are many applications that can access a KeePass database, and the same database can be accessed from each of them. You choose one that is available and that you find works for you. | ||
| + | - On my iPhone, I use or have used: KeePass Touch, KeePassium, MiniKeePass | ||
| + | - On Windows (a while ago) I was using KeePass2 | ||
| + | - On Mac OSX I'm using KeePassXC | ||
| + | - When I first started using KeePass, I would keep the database on a USB stick and copy it to/from any computer I was using to access/ | ||
| + | - Then I started using Dropbox to hold the database. This way I could access the KeePass database from any machine or phone that could access Dropbox. | ||
| + | - Then Dropbox started restricting free use to 3 devices. Then I switched to storing it on iCloud, and periodically copy it from iCloud to: Dropbox, pCloud, and into the Documents directory on the machine I'm using. | ||
| + | - I have an entry in KeePass with a name I modify that indicates the last important change I've made to the database. | ||
| + | - For example: "Last Changed 2021 1202.1003" | ||
| + | - This way I can see how current a database is on the other devices and determine whether I need to update it on that device. | ||
| + | - I use the KeePass application to create new entries and especially passwords for logins. | ||
| + | * Here is a possible password I might use (and it's one I am not using): '' | ||
| + | * This one: '' | ||
| + | * Using a password manager you can create quite long passwords | ||
| + | * Using a password manager you can create secure passwords and not have to remember all of them | ||
| + | * Using a password manager you have all of your access information in one spot, the encrypted file | ||
| + | * (your next of kin would likely find this useful) | ||
| + | //There are other capabilities of a KeePass password manager like autofill (it'll copy and enter passwords for you) and URL entry (it'll enter your site's URL into your browser), and more; but I do not have experience with these.// | ||
| ====Care and Maintenance of Secure Passwords==== | ====Care and Maintenance of Secure Passwords==== | ||
| The idea for this started when I heard that someone had someone access their Facebook page. It's possible this happened because Facebook passwords were stolen but it's also that the password was guessed. | The idea for this started when I heard that someone had someone access their Facebook page. It's possible this happened because Facebook passwords were stolen but it's also that the password was guessed. | ||
| Line 19: | Line 52: | ||
| * The password is stolen from a company | * The password is stolen from a company | ||
| - | How long does it take to crack a password? | + | How long does it take to crack a password? |
| ^Length^A-Z, | ^Length^A-Z, | ||
| |9 characters|2 minutes|2 hours| | |9 characters|2 minutes|2 hours| | ||
| Line 26: | Line 59: | ||
| |12 characters|1 year|2 centuries| | |12 characters|1 year|2 centuries| | ||
| |13 characters|64 years|really long time| | |13 characters|64 years|really long time| | ||
| + | |||
| + | or this from [[https:// | ||
| + | ^Length^numbers only^lowercase letters^U/L letters^Numbers, | ||
| + | |10|instantly|58 min|1 month|7 months|5 years| | ||
| + | |11|2 secs|1 day|5 years|41 years|400 years| | ||
| + | |12|25 seconds|3 weeks|300 years|2000 years|34k years| | ||
| + | |13|4 mins|1 year|16k years|100k years|2m years| | ||
| + | |14|41 mins|51 years|800k years|9m years|200m years| | ||
| + | |15|6 hrs|1k years|43m years|600m years|15 bn years| | ||
| + | |||
| + | Yes, there are differences in time to crack, but the key is that it's best to do a 14-character mix of upper/lower letters and numbers. | ||
| + | |||
| You should assume that the attacker knows a lot about you: e.g., Facebook. | You should assume that the attacker knows a lot about you: e.g., Facebook. | ||
| Line 36: | Line 81: | ||
| ===How to protect your password=== | ===How to protect your password=== | ||
| * Change it often | * Change it often | ||
| - | * Make it hard to guess - upper and lower chars, digits, special chars. | + | * Make it hard to guess - upper and lower chars, digits, special chars. |
| - | * Watch the news for breaches and change password | + | * Watch the news for company security |
| ===How to create hard-to-guess passwords=== | ===How to create hard-to-guess passwords=== | ||
| - | If a human is going to guess the password then make it unhuman. | + | If a human is going to guess the password then make it unhuman. |
| - | Also see [[https:// | + | Also see [[https:// |
| + | Do a DuckDuckGo (or Google if you're still using Google) search for "Best Password Managers" | ||
| All offer unlimited login and text note storage in a secure vault protected by your master password, and can generate (and store) strong passwords. | All offer unlimited login and text note storage in a secure vault protected by your master password, and can generate (and store) strong passwords. | ||
| - | ^Manager^Free version. | + | ^Manager^Free version. |
| - | |[[https:// | + | |[[https:// |
| - | |[[https:// | + | |[[https:// |
| - | |[[https:// | + | |[[https:// |
| - | |[[https:// | + | |[[https:// |
| - | |[[https:// | + | |[[https:// |
| + | |[[https:// | ||
| ===Has your email been compromised in a data breach?=== | ===Has your email been compromised in a data breach?=== | ||
| - | You enter your email address and this site ([[https:// | + | You enter your email address and this site ([[https:// |
| ====Steve' | ====Steve' | ||
| - | I use a combination of KeePass on my Mac, PC, and iPhone to access, create, maintain passwords and related information in a secure password safe (encrypted file). | + | I use a combination of KeePass on my Mac, PC, iPad, and iPhone to access, create, maintain passwords and related information in a secure password safe (encrypted file). |
| Note that KeePass has different applications you can use to access the password safe, as they differ by device. | Note that KeePass has different applications you can use to access the password safe, as they differ by device. | ||
| - | While I started using Dropbox as you could access your free 5GB from any number of devices, they have restricted its use to 3 devices unless you pay. Now I am using iCloud to hold the password safe as there is no limit on number of devices. | + | While I started using Dropbox as you could access your free 5GB from any number of devices, they have restricted its use to 3 devices unless you pay. Now I am using iCloud |
| If you do not want to use the cloud (Internet storage) to save your password crypt, you can store it on your computer and use a USB stick to copy it from machine to machine and as a backup. | If you do not want to use the cloud (Internet storage) to save your password crypt, you can store it on your computer and use a USB stick to copy it from machine to machine and as a backup. | ||
| Line 65: | Line 112: | ||
| ===On Mac Computer=== | ===On Mac Computer=== | ||
| * KeePassXC | * KeePassXC | ||
| - | * Dropbox, iCloud | + | * Dropbox, iCloud, pCloud |
| - | ===On iPhone=== | + | ===On iPhone |
| - | * Strongbox (MiniKeePass) | + | * KeePass Touch |
| * iCloud | * iCloud | ||
| ===on Windows=== | ===on Windows=== | ||
| * KeePass2 (download directly from [[https:// | * KeePass2 (download directly from [[https:// | ||
| - | * Dropbox or iCloud | + | * Dropbox or iCloud |
| - | ===Comments=== | ||
| - | * There are other ports of KeePass for Mac OS X, iPad, iPhone, Android, Windows 10, Chromebook, Blackberry, etc. Visit the KeePass site and choose Download. | ||
| ===To Consider=== | ===To Consider=== | ||
| - | * While some apps store passwords in their space, this means it's a SPOF | + | * While some apps store passwords in their space, this means it's a SPOF((Single Point Of Failure)) -- if they close or lock you out, you're SOL((Sadly, Out Of Luck)) |
| - | * KeePass lets you decide where to store it -- on your computer, on USB stick, cloud storage of your choice -- and this provides | + | * KeePass lets you decide where to store it -- on your computer, on USB stick, cloud storage of your choice -- and this provides |
| ====Glossary==== | ====Glossary==== | ||
| Line 85: | Line 130: | ||
| |SPOF|Single Point of Failure| | |SPOF|Single Point of Failure| | ||
| + | <hidden page stats> This page has been visited {{counter|today| time| times}} today, {{counter|yesterday| time| times}} yesterday, and {{counter|total| time| total times}} since 8/27/2021. Thank you for your interest! </ | ||
security_topics.1608663713.txt.gz · Last modified: 2021.12.22 14:25 (external edit)