Lastpass Password Manager, And Vault.
Hi everyone. Leo, Noteboom here for Askleo.com.
Whenever we talk about passwords and the importance of having unique,
complex passwords for every site we use, the problem comes up.
How do I manage all these things that I'm
supposed to have lots of and I'm not supposed to be able to remember?
The answer, of course, is a password vault or password manager, as they're known.
Now, I want to be clear.
I recommend you use a Password Vault.
Honestly, I'm not sure that I really care
that much about which one you use, as long as you use one of the good ones.
However, I do want to point out LastPass
because I've been using it probably for the better part of a decade,
and I've been very happy with how it works and how it's kept me secure.
Now I'm not going to walk through the steps of installing Last Pass.
The original article,
askleo.com/5744
will walk you through that process. But that's a one time thing.
The important takeaway from the setup process that I do want to reiterate here,
though, is the importance of your master password, or more correctly,
the importance of remembering your master password.
Here's the thing.
One of the reasons that I trust LastPass
as much as I do is they don't know my master password.
They literally do not.
My master password never leaves the device that I'm using.
How is that possible?
How do they know you Typed it in correctly?
Well, there's magical mathematics involved called a hash, where we calculate a number
on the PC, and then we compare that number to what's stored up on LastPass's server.
Given the hash, there's no way to know what the password is.
The only thing that LastPass knows
on my machine is whether or not I Typed it in correctly.
So as long as I've Typed in the same thing
I Typed in when I originally set up my password, then we're good.
If I forget, though, that means there is no way to recover it.
Do not forget your master password.
You will lose everything in your vault if
you do, which is actually true for good security or good encryption anyway.
So the bottom line here is to make sure
you use a good, memorable, long and strong password.
I typically recommend using the multiword approach.
If you've ever seen the xkcd comic: correct horse battery staple. That gives you
an example, four words unrelated to one another, that are instantly memorable. You
probably have it memorized already and yet are very unlikely to be guessed.
Now, obviously, don't use those four words.
But if you're able to pick four words of your own and build your own kind
of mental model around it, that helps you remember that's a great master password.
So how does the Password Vault work?
How do you get all the data into it?
Well, it really boils down to how
the Password Vault remembers Automatically. So here we are at Ask Leo!.
I'm not logged into my account or to any account for that matter.
So I'm going to log into an account that I don't yet have stored in LastPass.
But what I'm going to use is essentially my backup admin account.
And this is the only time you end up
having to type in a difficult to type in password.
Now I have it sitting on a screen next
to me that you don't see, and it is a strong password by any stretch.
So I've entered my username and my password.
I'm going to go ahead and click Remember Me because I want it to remember.
And I'll click Login.
Lastpass noticed that I Typed in a user
account and password combination that it had not seen before
for this site, this is my opportunity to remember it, and I'll just click Add.
That's how you build your database of passwords.
You log in like you normally do,
but each time you do, LastPass will remember,
or at least offer to remember what it is you've just logged in with.
Now, if I go to my account and we will log
in as somebody else, so we'll hit Log out here.
Now, you'll notice that LastPass has
offered an account that is not the one we just did.
And in fact, you'll see here next to this
little Gray Last Pass icon, the number three.
That's because LastPass has three
different sets of credentials for this website.
If I click on the three,
I get a little drop down that says, okay, well, which one do you want to use?
This one, this one or this one?
The last one being the one we just
created, I'm going to go ahead and use this one, the one that it recommended.
Just click on it.
What you don't see is that even though it had already filled things in by default,
it filled them in again based on my choice.
Now all I have to do is click on Log in and I'm in.
Well, I've got two factor. So it passed the login test.
My username and password were correct.
Now I'd have to do the two factor authentication step to complete the login.
But the bottom line here is that you'll
notice for that account, I didn't have to type in a password.
I didn't have to remember a password.
Lastpass remembered it for me, one of the things that LastPass has that I
use quite a bit is the opportunity to open your vault.
What this is, is it's a list of all of the passwords for all of the services
that LastPass happens to have remembered for you?
I'm going to turn off this. Welcome to your vault.
Of course, there's a tour, and I also tend to not like the tiled view.
So I go to the list view and I also like
it to be smaller just to put more things on the screen.
Now what's interesting about this is that this page of credentials
that LastPass has saved for me kind of acts as a page of BOOKMARKS.
For example, I am not currently logged
into Gmail, but if I want to log into Gmail, all I need to do is hit Launch.
Lastpass, in this case, didn't automatically enter my username
for me, so I can click on one and click on it and it will enter it for me.
I'll hit next, it entered the password for me, and boom, I'm in Gmail.
This tends to work in varying ways
depending on the service that you're logging into.
Many services, LastPass will simply just log you straight in.
For example, on my personal account, which you're not looking at here.
If I want to log into my bank, as soon as I click on that Launch button,
LastPass sends me to the bank's web page, notices that there's a login page,
fills in the username and password, and automatically hits Enter for me.
What that means is that simply clicking
on the Launch button in LastPass takes me to my bank automatically without having
to know or remember the password that LastPass has remembered for me.
Now, this is simply usernames
and passwords for all of the accounts that you have online.
And you can see in this example account, I've got several.
I've got three logins to askleo.com.
I've got a Google account, I've got a couple of different Microsoft
accounts, I've got Dropbox accounts, I've got Facebook and Twitter.
You get the idea all of those credentials are saved here in my LastPass account.
I don't need to know those passwords.
All I need to do is use LastPass to log me in automatically.
However, there's more to LastPass than account credentials.
For example, if we go over here to the side, you can see it says Notes.
I use Notes heavily in my personal account.
All these are is a text box.
You can give it a name,
and you can then put information into that box.
When you hit Save, the information is encrypted using your
local credentials and saved to your LastPass account.
Whatever that note contains,
it's available in your LastPass account regardless of where you happen to sign in.
Similarly, you can have addresses
to automatically fill in when you come across, say, a shopping site that needs
your name and address, or a site that requires your billing address.
Speaking of billing, you can enter in credit card information.
And again, when you're on a site that is asking you for your credit card
information, a couple of clicks with LastPass will enter it all for you.
Everything here is securely encrypted
and saved in a way that is not accessible to hackers.
It's simply stored in a way that makes it very convenient for you.
And indeed, you can do the same with bank
accounts, routing numbers, and account numbers.
All that information can be stored here in LastPass securely.
Now, I keep talking about security.
And as I've said, I use it myself,
and I use all of the features that I've just described.
I have my credit cards in LastPass, I have bank account information
in LastPass, and I have all of my 300 or more login accounts listed in LastPass.
How is it secure?
Well, they do encryption, right?
And they only do the encryption on your device.
In other words, the only thing that ever travels over the wire is encrypted data.
The only thing that's ever stored at Lastpasses servers is the encrypted data.
They do not store your password.
They don't have your password.
The only way to access that data is if you personally provide the password.
As long as you don't as long as all that's
available is the encrypted data, nobody can see it now like anything.
Of course, any password vault like any other kind of login.
Sure, it's susceptible to keyloggers. I get that.
But the fact is, if you're logging in manually to a site or
you're using a tool like LastPass to log into a site, both of those techniques are
vulnerable to keyloggers and malware on your machine.
That's an argument for using
good antimalware tools, not an argument against using a password vault.
Using a password vault like LastPass
basically makes it possible for all of these passwords,
for all of these accounts that you see on my screen to be long and complex
and something that I could never, ever remember and be different for every
site without my even having to think about it.
We can make LastPass even more secure by adding two factor authentication two
factor authentication to your vault, which means that should somebody somehow
get the master password to your vault, they still would not be able to sign
in and extract your Last pass information without having your second factor.
Two factor authentication is in fact available on the Free account.
I'll go to account settings here and then immediately flip over to multifactor
options where you'll see LastPass MFA, Google Authenticator,
Microsoft Authenticator, or something called Twofer.
Point being that these three, I believe, are all compatible.
The one that I use is in fact, Google Authenticator.
I actually use the Author app to generate these two factor codes,
but you could use the Google Authenticator or any of these options here.
I strongly recommend that you do.
So let's face it, master passwords,
password vaults, that's really important stuff.
So making sure that it's as secure as possible just makes sense.
And I do it even on this example account, because I don't want people diving
in and getting access to all these accounts that I have here.
Now, where LastPass became a little bit
controversial in recent years is how they've divvied up Free and Premium.
The important thing to understand is
that Free will work on a certain number of machines of one type, be it desktop,
laptop, Windows, Mac kind of machines, or it will work on mobile devices,
iPhones, iPads, Androids, those kinds of things.
You can't necessarily use the same information on both.
In other words,
your vault will work either on PCs or on mobile devices, but not on both.
Premium, on the other hand,
enables using a single vault across both of these environments.
It's what I do and what that means is that all of the accounts that I have
in my last password I can use on my phone to log in when necessary.
There's a last Pass app for my mobile device that actually does the same thing
that we've just discovered here with the last Pass extension in my browser.
Now, as I said when I started,
I understand that there are several good password management tools out there.
There are and I'm not necessarily
suggesting you switch from one that you're happy with.
If you're happy with some of the others, you're using some of the others.
If you're more comfortable with some of the others, if you dislike LastPass
for whatever reason, great most importantly, use a password vault.
It's consistently the number one recommendation from security professionals
when it comes to managing your personal account, Privacy and security.
That being said, if you're on the fence,
if you don't have one, I can highly recommend LastPass.
As I said, I've been using it myself
for over a decade and been quite happy with it.
For Updates For related Links For a few, a few more examples and more,
visit Askleo.com/5744. I'm Leo Notenboom and this is Askleo.com.
Thanks for watching.