Are you keeping your passwords in an Excel spreadsheet, or handwritten in a book that lives in your desk drawer (which is technically better than the spreadsheet)? You probably need a password manager.
Password managers have been around since at least 1997, when Bruce Schneier released Password Safe, originally for Windows 95.
So why has their use only recently become common practice in non-technical circles? One reason is that we are more connected than ever, and the number of online accounts you need to do almost anything keeps growing. Just keeping track of what accounts you have, regardless of password management, is hard enough.
Another reason is how easily anyone can buy or rent extremely powerful computing services to crack weak passwords quickly. What used to be reserved for nation-state threat actors with deep pockets is now more affordable and accessible.
A password manager is software that can manage, maintain and audit your online accounts and passwords. It is the single source of truth for your digital life. Modern password managers let you manage your two-factor authentication codes and even securely share passwords with others.
Password managers can sync to the cloud so you can get to them from all your devices, or they can be completely offline for extra peace of mind.
Humans suck at creating and remembering secure passwords, and we need a way to take the strain of keeping accounts, passwords, security questions and so on in our heads.
We tend to create predictable (and thus easily cracked) passwords because every new online account brings thoughts of "I can't forget this important password" and "What password am I going to come up with now?". We solve this in the most human way possible: basing passwords on personal and circumstantial information.
Think about your current passwords. How many contain easily guessed words, your company name, dates of birth, pets or family names, or interests and hobbies? Another classic I have seen is the same "base" password followed by the initials of the account or website it belongs to.
Example (for Facebook): MyPassword01FB!. This meets the complexity requirements of most online platforms and is unique for every website, but it's highly predictable and easily cracked.
Once you've chosen a password manager that works for you, you'll be prompted to create a master password. The master password is the Big Kahuna, the be-all and end-all of passwords. It's what stands between you and access to all your other passwords.
This should be a complex passphrase that isn't used anywhere else, and it should be kept under lock and key (literally). If you forget it, you can kiss your passwords goodbye.
An example of a good passphrase might be something like Wheat-Swing-Universe-Signal-Which-Gulf5. It's long, uses uppercase and lowercase letters, numbers and symbols, and is relatively easy to commit to memory.
Keeper Security has a passphrase generator to help you create these.
The joy of having a password manager is not having to remember any password except your master password. Let the software do what it's best at: generating secure passwords. Depending on your password manager, adjust the generation settings so your passwords are at least 15 characters long and contain uppercase and lowercase letters, numbers and symbols.
All of the above applies to individuals and businesses, but there are some specific advantages to using a password manager in your business.
Without a password manager, onboarding a new employee gets slow. How much time and money is lost tracking down passwords, or resetting ones that have been lost or forgotten, before a new employee can become productive?
These issues tend to be slow-burning, too. You might waste an hour or two over the first week and then feel like you're out of the woods, but as an employee needs to access more systems, they find they're still missing passwords.
The likely chain of events is that they talk to a colleague or manager, and now two (or more) people have been taken off-task to locate account credentials.
It gets worse. Without a password manager, every time an employee creates a new account for your organisation it's done in isolation, and now they're the only one who knows it. You have now compounded the problem for the next new hire.
Being able to restrict access to passwords by job role, department or business unit is important for most businesses. You want each employee to have access to what they need, no more and no less.
Keeping this process smooth as an employee moves, changes roles or leaves makes transitions quicker.
Most good password management tools let you audit your entire password "vault" to highlight weak passwords, passwords used for multiple accounts, old passwords, or even passwords that have shown up in data breaches. These audits keep you on top of your password health and let you react quickly to any issues.
There are many good options, so we recommend trialling a few to find the one that fits your needs and that you like best. Some well-known options are:
If you or your business want help choosing and deploying a password manager, give us a call or use our contact form.
Kyle Murphy
Practical cyber security steps for your business, from two-factor authentication and password managers to offboarding, device security and training.
Kyle Murphy
Why a password isn't enough, how two-factor authentication works, why SMS codes are the weakest option and how to manage 2FA codes. Part 2 of 3.
Kyle Murphy
A quick fix for the "sh: mysqldump: command not found" error when running Spatie's Laravel-Backup from a web interface, by setting the dump binary path.
Take a moment to celebrate, give that scrolling finger a break, then contact us because we'd love to hear from you.
0466 624 345
