True Images Wiki

A collection of information Steve finds useful

User Tools

Site Tools


security_topics

This is a work-in-progress. If you have suggestions on what to cover (and/or what not to discuss) please let Steve know.
This page last changed 2021.12.22 13:51

Overview

We all have bank accounts, credit cards, insurance policies, healthcare accounts, the list goes on. Many are online. There are so many of these, each with its URL to go to for access, phone numbers, account numbers, and requiring a password to access–one that is complex and hard to guess. The challenge is how do you keep track of all of this information in a way that is secure, yet easy to access, that's stored in multiple locations so it's unlikely to get lost, and that you can make available to your next-of-kin if necessary? We will discuss a solution that your presenter uses to solve all of these challenges in a cost affordable–free–way.

Summary, or How I Secure and Use Secure Passwords

For what it's worth, I use KeePass and on multiple devices.  I will summarize below.  Note, there are no costs (to purchase or recurring) for any of the following (further down on the page some items may have a cost and it is noted). These are my practices and I'm only putting them here for readers to consider when setting up their database security system. You should do what you feel is best for you.
The major benefit for using a password manager are: (1) You only have ONE password to remember, and (2) You can use Long, Complex, and Hard-to-guess passwords

  1. KeePass refers to both (a) an encrypted database holding information and (b) the name of one application that can access the database.
  2. A KeePass database can hold
    1. Logins and password
    2. Other information you feel useful, such as: Social Security numbers, Secret passwords (answer to “what was your first dog's name”), telephone numbers
    3. Past passwords.  Date you started to use a given password.
    4. And all of the data in the database is encrypted. 
  3. There are many applications that can access a KeePass database, and the same database can be accessed from each of them.  You choose one that is available and that you find works for you.
    1. On my iPhone, I use or have used: KeePass Touch, KeePassium, MiniKeePass
    2. On Windows (a while ago) I was using KeePass2
    3. On Mac OSX I'm using KeePassXC
  4. When I first started using KeePass, I would keep the database on a USB stick and copy it to/from any computer I was using to access/modify the database.  The risk of course is that the database might differ on different machines or that I might misplace the USB stick.
  5. Then I started using Dropbox to hold the database.  This way I could access the KeePass database from any machine or phone that could access Dropbox.
  6. Then Dropbox started restricting free use to 3 devices.  Then I switched to storing it on iCloud, and periodically copy it from iCloud to: Dropbox, pCloud, and into the Documents directory on the machine I'm using.
  7. I have an entry in KeePass with a name I modify that indicates the last important change I've made to the database.
    1. For example: “Last Changed 2021 1202.1003” so I know the last change was December 2, 2021 at 3 minutes after 10.
    2. This way I can see how current a database is on the other devices and determine whether I need to update it on that device.
  8. I use the KeePass application to create new entries and especially passwords for logins. My passwords are typically 14 characters or longer (upper/lower case and numbers) and the KeePass application considers them secure.
    • Here is a possible password I might use (and it's one I am not using): cqLbq2NHcuNmgU – 14 characters, upper and lower case letters, and at least one number. This one has entropy 82.06 which is “good”.
    • This one: M6dehfJRn7dz7lM82K 18 characters with entropy 101.60 and is considered “excellent”.
    • Using a password manager you can create quite long passwords
    • Using a password manager you can create secure passwords and not have to remember all of them
    • Using a password manager you have all of your access information in one spot, the encrypted file
      • (your next of kin would likely find this useful)

There are other capabilities of a KeePass password manager like autofill (it'll copy and enter passwords for you) and URL entry (it'll enter your site's URL into your browser), and more; but I do not have experience with these.

Care and Maintenance of Secure Passwords

The idea for this started when I heard that someone had someone access their Facebook page. It's possible this happened because Facebook passwords were stolen but it's also that the password was guessed. Let's explore ways that passwords are compromised and how to protect your passwords without causing unnecessary effort on your part.

And is there a way to store all of your account and login information, securely, and easy to access?

How passwords are compromised

Much from How to hack like a pro

  • Guessing
    • Dictionary attack
    • Brute Force (try all combinations in order)
    • Commonly used/easy guess passwords (password123 Password123 password ilovejohn)
    • Commonly used passwords with simple changes(p@ssw0rd !l0v3j0hn)
  • The password is easy to get
    • written down
    • watching over shoulder
  • Password cracking software (ophcrack, cain and able, THC-Hydra, Brutus)
  • The password is stolen from a company

How long does it take to crack a password? (From Keithieopia 2017 link)

LengthA-Z,a-z,0-9with special chars @#$%& etc
9 characters2 minutes2 hours
10 characters2 hours1 week
11 characters6 days2 years
12 characters1 year2 centuries
13 characters64 yearsreally long time

or this from Kim Komando

Lengthnumbers onlylowercase lettersU/L lettersNumbers, U/LNumbers, U/L, Symbols
10instantly58 min1 month7 months5 years
112 secs1 day5 years41 years400 years
1225 seconds3 weeks300 years2000 years34k years
134 mins1 year16k years100k years2m years
1441 mins51 years800k years9m years200m years
156 hrs1k years43m years600m years15 bn years

Yes, there are differences in time to crack, but the key is that it's best to do a 14-character mix of upper/lower letters and numbers.

You should assume that the attacker knows a lot about you: e.g., Facebook. Guessable things like the following have no business being in your password (or as one the answer to any of your recovery questions:

  • Your: name, birthday, anniversary, social security number, etc
  • Name, birthday, etc of your parents, friends, spouse, dogs, etc
  • Sequences like 12345
  • Any of the above but combined – adding guessable things together does not make them un-guessable
  • Passwords you've used before, they've probably already been breached

How to protect your password

  • Change it often
  • Make it hard to guess - upper and lower chars, digits, special chars. 14+ characters long.
  • Watch the news for company security breaches and change password

How to create hard-to-guess passwords

If a human is going to guess the password then make it unhuman. Consider: a password “safe”. Here are some free alternatives. From Tech Radar, The best free password manager 2019 with updates I took from the application sites 20211007
Also see PC Magazine's picks
Do a DuckDuckGo (or Google if you're still using Google) search for “Best Password Managers” and look for those with 2020 or 2021 information.

All offer unlimited login and text note storage in a secure vault protected by your master password, and can generate (and store) strong passwords.

ManagerFree version. Paid version. Cost. platforms
LastPassAccess on one device type 1GB Secure cloud storage
Multi Factor Authentication
Contingency plan (loved one access in emergency)
Free for one device type; $3/month 1 user, $4/month 6 users (group and share items, family manager)Win, Mac, Linux, Mobile
DashlaneUp to 50 passwordsunlimited passwords $2.99/mo billed annually, two devices
$4.99/mo billed annually, unlimited devices
Win, Mac, iOS, Android
Keeper Securityaccess on one deviceunlimited device access$2.91/month, $34.99 annuallyMac, Windows, Linux, iOS, Android
RoboForm sync across devices, cloud backup, web access, all cost$23.88/1yr, $64.44/3yr, $99.50/5yrWindows, Mac, iOS, Android, Linux, Chrome OS
BitWarden passwords file kept online
(but you can install it on your own server)
1GB encrypted storage $10/yr one user, $39.96/yr up to 6 users Windows, Mac, Linux, iOS, Android
KeePass Password Safe* Can run from USB
* Many customizable options
* A little intimidating? You judge.
FOSS1) - there is no paid version – all features in free version
Many ports, with different features and UI
Note, no cost. Does not provide place to store the Safe, that's up to youWindows, Android, iPhone/iPad, Mac, Chromebook, Blackberry, Linux, and more

Has your email been compromised in a data breach?

You enter your email address and this site (https://haveibeenpwned.com/) will tell you if your email address has been picked up during a data breach and which sites. Note that it also suggests using a paid password manager system; check my advice on password managers above.

Steve's Opinions

I use a combination of KeePass on my Mac, PC, iPad, and iPhone to access, create, maintain passwords and related information in a secure password safe (encrypted file). I store and access the safe using iCloud, pCloud, and Dropbox.

Note that KeePass has different applications you can use to access the password safe, as they differ by device.

While I started using Dropbox as you could access your free 5GB from any number of devices, they have restricted its use to 3 devices unless you pay. Now I am using iCloud (with pCloud as a backup) to hold the password safe as there is no limit on number of devices.

If you do not want to use the cloud (Internet storage) to save your password crypt, you can store it on your computer and use a USB stick to copy it from machine to machine and as a backup.

On Mac Computer

  • KeePassXC
  • Dropbox, iCloud, pCloud

On iPhone and iPad

  • KeePass Touch
  • iCloud

on Windows

To Consider

  • While some apps store passwords in their space, this means it's a SPOF2) – if they close or lock you out, you're SOL3)
  • KeePass lets you decide where to store it – on your computer, on USB stick, cloud storage of your choice – and this provides a level of security, backup, and access you control

Glossary

Password Crypt, Password SafeA secure file where passwords and related information are stored and unavailable unless someone has the software and knows the password to access the contents
PortAs in “Application ported from Mac to Windows 10” means that the application has been rewritten from that on (Mac) and is also now available on (Windows 10)
FOSSFree Open-Source Software
SPOFSingle Point of Failure

page stats

page stats

This page has been visited 1 time today, 0 time yesterday, and 182 total times since 8/27/2021. Thank you for your interest!

1)
FOSS=Free, Open-Source Software
2)
Single Point Of Failure
3)
Sadly, Out Of Luck
security_topics.txt · Last modified: 2021.12.22 13:51 by 127.0.0.1