Need help securing my passwords online???

Diablo2K

Diablo2K

Supreme [H]ardness
2FA
Joined
Aug 10, 2000
Messages
6,849
I recently had my ID stolen and it got me thinking about my password habits. I am not going to say what they are, but I had some bad habits, and I am looking for help making things more secure.

Is there an app I can get that will help manage passwords both on my PC and my Phone (Android)? I know sometimes when I create a password, I will get a suggestion for a "Strong" password, the reason I don't use it is because there is no way I can remember it in case need it in the future. What happens if I reset my phone or PC and have to reenter all my passwords? Something I do often, and if I am using the suggested passwords there's no way I could remember them.

When it comes to this subject, I don't even know enough to know what questions I should be asking.
 
Bitwarden is a good choice.

Free for individual use. Very affordable premium plans and family plans.

Basically, you create one (or more) very secure passwords to secure one (or more) vaults full of unique passwords/notes/etc. You enter that one password to unlock the vault of complex passwords that you would otherwise never remember, and either copy/paste them where needed, or use a browser plugin to auto-fill credentials.

It's cloud based, with zero-knowledge encryption... meaning they and others likely have no way of knowing what you've stored. You can then access this database through an app, browser plugin, or directly by logging into the website. If you lose a device, you haven't lost the password data.

There are other similar tools, all with benefits and downsides, and you can spend a lot of time researching and getting lost in the details. Read up a bit, pick one, and then stick to it. There will be a learning curve, and it might take a bit to get used to.

Commit to using a tool like this to ensure that you're always using unique passwords for every website/app/etc. Aim for a minimum of 14 characters using a mix of uppercase, lowercase, numbers, and symbols. They should look something like this: Yb4wXA%p@z6l!e

And always use Multifactor Authentication methods where possible. A minimum of 2 factors, either text message or email based. For banking or things where appreciable sums of money are involved, use an MFA tool like Cisco Duo.

A quick google search turned up a free course on Khan Academy that might be informative. I've never run through this one, but the bullet points seem to touch all the right subjects.
 
Definitely opt for 2fa. App based where possible/available.

I use chromes built in password manager, but I'm not sure it's recommended. Google 2fa uses sms and if someone gets my Google account, I'm boned. That said, everything has unique passwords, and it's seamless. No extra apps or expenses. 🤷
 
I use Keepass on my PC with my password file stored on my Google Drive. And then I use KeePass 2 Android on my phone that also syncs to Google Drive.
It also includes a password generator for when you create new accounts.
 
I'll cast another vote for BitWarden as a password manager, and don't really have anything to add to Azzkicker's real comprehensive synopsis. If you want competitors to also look up, I've used Keeper in the past for work, without issue. Aside from that, can't suggest any others from experience. It may also be worth having a copy of your passwords yourself....but I'd personally only store a paper copy in a safe or something like that, as opposed to a Google Doc. Realistically, neither is 100% secure, but I just feel better about a geographic restriction on people who can steal my plain text credentials. Not trying to start a fight, just a different measure of security.

SticKx911 is also correct about MFA - that has saved my workplace before, where users have been phished and subsequently followed instructions to "log into" a fake website using their corporate password. Their password was compromised, but the account was still locked. MFA is like a deadbolt on your front door - still not technically 100% secure, but its a ton better than just the handle lock. App based MFA is more secure than text message MFA.
 
I use keepass because it's FOSS and all that which is cool but honestly if I was doing it again I would go with Bitwarden, maybe 1pass. Lastpass has gotten breached too many times in the past for me, not sure how they're so popular in spite of all that. Our company is considering Bitwarden.

You could also just let Firefox or whatever inferior browser you prefer to generate passwords for you, syncs them across devices.

MFA mandatory.
 
I use keepassdx, magickeyboard and foldersync (android). Keeps my vault synced up with my other phone and PC just fine.
 
You must log in or register to reply here.
Back
Top