{"id":28250,"date":"2019-12-19T12:03:08","date_gmt":"2019-12-19T11:03:08","guid":{"rendered":"https:\/\/markosaric.com\/?p=28250"},"modified":"2020-08-14T11:15:43","modified_gmt":"2020-08-14T09:15:43","slug":"password-security","status":"publish","type":"post","link":"https:\/\/markosaric.com\/password-security\/","title":{"rendered":"How I keep my passwords and logins safe and secure"},"content":{"rendered":"\n<p>Passwords and login security seem to be in shambles. Many companies and many consumers use poor security practices. Here&#8217;s how I deal with my passwords and login security. <\/p>\n\n\n\n<p>The <a rel=\"noreferrer noopener\" aria-label=\"most commonly used password (opens in a new tab)\" href=\"https:\/\/en.wikipedia.org\/wiki\/List_of_the_most_common_passwords\" target=\"_blank\">most commonly used password<\/a> is &#8220;password&#8221; and the second most popular one is &#8220;123456&#8221;. And how do we know this? It&#8217;s because all the passwords exposed in data breaches are accessible for anyone to see.<\/p>\n\n\n\n<p>We have way too many accounts to individually remember all passwords, we reuse our easy-to-remember favorites on multiple sites and we waste excessive energy on the &#8220;forgot password&#8221; links. <\/p>\n\n\n\n<!--more-->\n\n\n\n<p>Using weak passwords or reusing the favorites is risky. A data breach on one site where your login details are exposed puts all your other accounts at risk. <\/p>\n\n\n\n<p>And data breaches of the apps we use are in the news frequently.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">We&#8217;re stuck with passwords<\/h2>\n\n\n\n<p>Even for those who take more care of their login security, the recent news hasn&#8217;t been too positive. <\/p>\n\n\n\n<p>1Password, one of the most popular password managers, <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/blog.1password.com\/accel-partnership\/\" target=\"_blank\">took<\/a> $200 million in venture funding while LastPass has been <a href=\"https:\/\/techcrunch.com\/2019\/12\/17\/logmein-agrees-to-be-acquired-by-francisco-partners-and-evergreen-for-4-3b\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"bought (opens in a new tab)\">bought<\/a> by a private equity firm. <\/p>\n\n\n\n<p>These moves may not turn out bad but chances are that some not so user-friendly decisions will be made in the future on the hunt for growth and value optimization.<\/p>\n\n\n\n<p>And I think we&#8217;re stuck with passwords in the foreseeable future. I don&#8217;t see some new technology coming in to replace them any time soon. <\/p>\n\n\n\n<p>So it&#8217;s a sensible idea to take precautions and extra care about your passwords. Take a few minutes to rethink the way you deal with your account logins and optimize that process. This is how I deal with it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"one-of-my-passwords\">I only know and remember one of my passwords<\/h2>\n\n\n\n<p>I use a password manager to help me create and remember strong, long, random and impossible-to-remember passwords such as this one. These are the most secure passwords.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"895\" height=\"264\" src=\"https:\/\/markosaric.com\/wp-content\/uploads\/keepass-new-password-895x264.png\" alt=\"An example of how my strong password may look like\" class=\"wp-image-28258\" srcset=\"https:\/\/markosaric.com\/wp-content\/uploads\/keepass-new-password-895x264.png 895w, https:\/\/markosaric.com\/wp-content\/uploads\/keepass-new-password-300x89.png 300w, https:\/\/markosaric.com\/wp-content\/uploads\/keepass-new-password-768x227.png 768w, https:\/\/markosaric.com\/wp-content\/uploads\/keepass-new-password.png 949w\" sizes=\"auto, (max-width: 895px) 100vw, 895px\" \/><figcaption>An example of how my strong password may look like<\/figcaption><\/figure>\n\n\n\n<p>I only remember one of my passwords even though I use a strong and unique password for each and every account that I have. That one password that I remember is the password to my password manager. <\/p>\n\n\n\n<p>That single password unlocks access to all of my other passwords. All 293 passwords that I have saved at the time of writing. My password manager does the rest of the heavy work for me. All this without compromising my security and data protection.<\/p>\n\n\n\n<p>I recommend you start using a password manager too. Pen and paper or our memory are simply not efficient enough to deal with this problem in most cases.<\/p>\n\n\n\n<p>You can either use the built-in password manager that great browsers such as Firefox have or a standalone password manager. Here are the two best options. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"password-manager-service\">Password manager service such as Firefox Lockwise<\/h2>\n\n\n\n<p>The easiest option to start using strong and unique passwords is to use the in-built password manager within your browser. <\/p>\n\n\n\n<p><a href=\"https:\/\/markosaric.com\/firefox\/\">I use Firefox<\/a> and Firefox has a great password manager called &#8220;Lockwise&#8221; built-in. It is a relatively new feature and this is what it can do:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Remembers all your usernames and passwords to all the websites you&#8217;ve signed up with so you don&#8217;t have to.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>It allows you to set the master password that unlocks access to the rest of the passwords.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>You can sync your account logins and passwords between the different devices including your mobile phone or you can keep it offline on your machine only.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>&#8220;Monitor&#8221; feature automatically warns you if and when your login details have been exposed in data breaches on the different websites you&#8217;ve signed up to so you can reset your password and make sure you don&#8217;t reuse that password other places. <\/li><\/ul>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-medium\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"132\" src=\"https:\/\/markosaric.com\/wp-content\/uploads\/firefox-monitor-prompt-300x132.png\" alt=\"Firefox &quot;Monitor&quot; feature automatically warns you if and when your login details have been exposed in data breaches\" class=\"wp-image-28251\" srcset=\"https:\/\/markosaric.com\/wp-content\/uploads\/firefox-monitor-prompt-300x132.png 300w, https:\/\/markosaric.com\/wp-content\/uploads\/firefox-monitor-prompt.png 741w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<ul class=\"wp-block-list\"><li>You can manually <a rel=\"noreferrer noopener\" aria-label=\"scan your email address (opens in a new tab)\" href=\"https:\/\/monitor.firefox.com\/\" target=\"_blank\">scan your email address<\/a> for data breaches, see a list of <a rel=\"noreferrer noopener\" aria-label=\"recent known breaches (opens in a new tab)\" href=\"https:\/\/monitor.firefox.com\/breaches\/\" target=\"_blank\">recent known breaches<\/a> and you can even set it up to notify you if other email addresses were exposed too so you can inform your non-technical family members.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>It generates strong and unique passwords when you&#8217;re signing up to a new account or when you&#8217;re changing your password.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>You can even install Lockwise as a standalone <a rel=\"noreferrer noopener\" aria-label=\"iOS or Android app (opens in a new tab)\" href=\"https:\/\/www.mozilla.org\/en-US\/firefox\/lockwise\/\" target=\"_blank\">iOS or Android app<\/a> and use it for the app logins outside of the Firefox browser.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>All this is safe, encrypted and protected using 256-bit encryption.<\/li><\/ul>\n\n\n\n<p>To get started, simply download Firefox and in <strong>Preferences &gt; Privacy &amp; Security &gt; Logins and Passwords<\/strong> tick all these boxes:<\/p>\n\n\n\n<figure class=\"wp-block-image size-medium\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"107\" src=\"https:\/\/markosaric.com\/wp-content\/uploads\/firefox-logins-passwords-1-300x107.png\" alt=\"Firefox logins and passwords options in Preferences\" class=\"wp-image-28262\" srcset=\"https:\/\/markosaric.com\/wp-content\/uploads\/firefox-logins-passwords-1-300x107.png 300w, https:\/\/markosaric.com\/wp-content\/uploads\/firefox-logins-passwords-1-768x275.png 768w, https:\/\/markosaric.com\/wp-content\/uploads\/firefox-logins-passwords-1.png 875w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><figcaption>Firefox logins and passwords options in Preferences<\/figcaption><\/figure>\n\n\n\n<p>The only negative I see about Firefox Lockwise is that there is no import\/export functionality. <\/p>\n\n\n\n<p>Hopefully they&#8217;re working on it but for now, you cannot import all your passwords from another password manager and you cannot export your Lockwise logins and take them somewhere else either.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"standalone-password-manager\">Standalone and local password manager KeePass<\/h2>\n\n\n\n<p>If you really want to take your login and password security game to another level you can try KeePass.<\/p>\n\n\n\n<p>KeePass is an open-source application available for all the different operating systems. Being open-source it&#8217;s also less liable to get acquired by someone who may not have your best interests in mind.<\/p>\n\n\n\n<p>It&#8217;s not a full service like Firefox Lockwise so it doesn&#8217;t offer sync between devices built-in. You basically get a single, secure and encrypted file (in the kdbx format) which has all your password data. <\/p>\n\n\n\n<p>Syncing that one password file between your devices is up to you. You can use whatever service you want (Google Drive, Dropbox, Nextcloud&#8230;). <\/p>\n\n\n\n<p>KeePass synced using <a href=\"https:\/\/syncthing.net\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Syncthing (opens in a new tab)\">Syncthing<\/a> is what I use to sync between <a href=\"https:\/\/markosaric.com\/linux\/\">my Linux laptop<\/a> and my Android phone. This means that I&#8217;m not using any third-party cloud service for syncing.<\/p>\n\n\n\n<p>There are multiple KeePass apps for all the different operating systems but these are the most popular options:<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-regular\"><table><tbody><tr><td>Linux\/macOS\/Windows<\/td><td><a href=\"https:\/\/keepassxc.org\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"KeePassXC (opens in a new tab)\">KeePassXC<\/a><\/td><\/tr><tr><td>Android<\/td><td><a href=\"https:\/\/github.com\/PhilippC\/keepass2android\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Keepass2Android (opens in a new tab)\">Keepass2Android<\/a><\/td><\/tr><tr><td>iOS<\/td><td><a href=\"https:\/\/strongboxsafe.com\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Strongbox (opens in a new tab)\">Strongbox<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>KeePass also has multiple browser extensions so your passwords are automatically filled in on your favorite sites. These are the KeePassXC extensions <a rel=\"noreferrer noopener\" aria-label=\"for Firefox (opens in a new tab)\" href=\"https:\/\/addons.mozilla.org\/en-US\/firefox\/addon\/keepassxc-browser\/\" target=\"_blank\">for Firefox<\/a> and <a rel=\"noreferrer noopener\" aria-label=\"for Chrome (opens in a new tab)\" href=\"https:\/\/chrome.google.com\/webstore\/detail\/keepassxc-browser\/oboonakemofpalcgghocfoadofidjkkk\" target=\"_blank\">for Chrome<\/a>.<\/p>\n\n\n\n<p>The only negative about KeePassXC that I use on my laptop is that the look and feel is not the most modern but it&#8217;s something I can live with for my login details. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"two-factor-authentication\">Use two-factor authentication as an extra protection level<\/h2>\n\n\n\n<p>I also recommend you turn on the two-factor authentication (2FA) on every account that offers it. You do it using a mobile application and that adds an extra level of protection to your accounts.<\/p>\n\n\n\n<p>You basically login using your regular username and password and then you are asked to input your always-changing and always-unique six-digit code too. <\/p>\n\n\n\n<p>Even though you may use a weak password or your password was exposed in a data breach, the 2FA will stop someone from entering your account. They would need to have access to your mobile phone too to successfully break-in.<\/p>\n\n\n\n<p>I believe every business should provide the 2FA feature and make it a requirement for every account. Many already do offer it. You can even set <a href=\"https:\/\/markosaric.com\/secure-wordpress\/\">two-factor authentication on your WordPress site<\/a>. <\/p>\n\n\n\n<p>Here are some popular 2FA apps for Android and iOS which you can explore:<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-regular\"><table><tbody><tr><td>Android<\/td><td><a href=\"https:\/\/beem.dev\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Aegis Authenticator (opens in a new tab)\">Aegis Authenticator<\/a><\/td><td><a href=\"https:\/\/github.com\/andOTP\/andOTP\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"andOTP (opens in a new tab)\">andOTP<\/a><\/td><td><a href=\"https:\/\/freeotp.github.io\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"FreeOTP (opens in a new tab)\">FreeOTP<\/a><\/td><\/tr><tr><td>iOS<\/td><td><a href=\"https:\/\/freeotp.github.io\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"FreeOTP (opens in a new tab)\">FreeOTP<\/a><\/td><td><a href=\"https:\/\/authy.com\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Authy (opens in a new tab)\">Authy<\/a><\/td><td><a href=\"https:\/\/www.tofuauth.com\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Tofu (opens in a new tab)\">Tofu<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"2fa-backup\">Choose a 2FA option that supports backups<\/h2>\n\n\n\n<p>Make sure to use a two-factor authentication app that allows backups as you may need that backup in case you switch phones or your phone gets stolen or broken. <\/p>\n\n\n\n<p>I&#8217;ve learned that lesson the hard way as my first two-factor authentication experience was using Google Authenticator which turns out does not offer an easy way to backup. <\/p>\n\n\n\n<p>When I broke the screen on my phone a few years ago, I decided it was time to invest in a new phone. I logged into Google Authenticator on my new phone only to find it completely empty.<\/p>\n\n\n\n<p>None of my 2FA codes were in there and I had to figure out how to log into the services I enabled two-factor authentication for without having my 2FA codes. That&#8217;s not something you want to deal with.<\/p>\n\n\n\n<p>It&#8217;s much easier to simply import your backed up file to your new phone and restore the access to all the 2FA logins you have.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"5-step-plan\">A 5-step-plan to better password and login security practices<\/h2>\n\n\n\n<p>Here&#8217;s how I recommend you start the process of improving your login security practices:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Pick the password manager you prefer (<em>I use KeePassXC on laptop and Keepass2Android on my phone<\/em>)<\/li><li>Pick the 2FA application that you prefer (<em>I use Aegis Authenticator on my Android phone<\/em>)<\/li><li>The next time you log into a site or service you use, go into the &#8220;Security&#8221; settings and explore the options:<ol><li>Enable the two-factor authentication for those services that offer it<\/li><li>Change the password from the old and weak one to a strong password created by your password manager<\/li><\/ol><\/li><li>Save the new entries in your password manager, backup the 2FA codes and sync to the different devices using your preferred cloud provider or another method (<em>I use Syncthing<\/em>)<\/li><\/ol>\n\n\n\n<p>This may be a bit inconvenient in the short term as you must spend a couple of extra minutes on each site to do this, but you&#8217;ll be in a much safer and more secure situation after you make these changes. <\/p>\n\n\n\n<p>In the world of the regular data breaches that we live in, you&#8217;ll be happy with that inconvenient choice.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Passwords and login security seem to be in shambles. Many companies and many consumers use poor security practices. Here&#8217;s how I deal with my passwords and login security. The most commonly used password is &#8220;password&#8221; and the second most popular one is &#8220;123456&#8221;. And how do we know this? It&#8217;s because all the passwords exposed&hellip; <a class=\"more-link\" href=\"https:\/\/markosaric.com\/password-security\/\">Continue reading <span class=\"screen-reader-text\">How I keep my passwords and logins safe and secure<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":28714,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-28250","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-all","entry"],"_links":{"self":[{"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/posts\/28250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/comments?post=28250"}],"version-history":[{"count":1,"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/posts\/28250\/revisions"}],"predecessor-version":[{"id":29031,"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/posts\/28250\/revisions\/29031"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/media\/28714"}],"wp:attachment":[{"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/media?parent=28250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/categories?post=28250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/markosaric.com\/wp-json\/wp\/v2\/tags?post=28250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}