- You want to know what's so frustrating about security,
no matter what I say here on this channel,
no matter how careful I am with my own passwords
and no matter what software or strategy I use,
there's always a but
I create strong passwords.
But what if a key logger gets installed on your computer?
Okay well, I write down my passwords.
But what if you lose that book or it gets burned in a fire?
I use a Password Manager.
Okay now wait Josh,
what if those password managers get hacked?
Aahhh! it's like playing a game that you can never win,
but instead of getting frustrated
or confused by all the new technology available,
let me share with you the three levels of password security,
two of which are quite common.
And the third of which quite frankly is just insane.
You need to choose which level
you feel most comfortable with.
And I'll give you some tips to make sure you can minimize
your risk at each one of these levels.
(upbeat music)
Welcome to All Things Secured.
My name is Josh.
And let's start by saying that
if you're just using the same password
for all your online logins,
I'm not even counting that as a level of security.
Nowadays, that's simply irresponsible.
If that's you listen carefully to what I'm about to say
and choose which direction that you want to go.
The first level is the most low tech,
but it's not an altogether bad method
manually writing your passwords down.
This is what my parents like to do.
You can either keep a password journal
or a document on your device that you reference
when you need to log in
obvious advantage with a password journal
is that it's usually not uploaded to the internet,
but that also means that you have to have that journal
or that document physically with you,
anytime that you need to log in.
This first level of password security is great for those
who know how to create strong passwords already.
And for the sake of your loved ones,
make sure you have some sort of backup of this password
journal or document in case it gets stolen, lost,
or burned in a fire.
And here are two quick tips for those who feel comfortable
at this first level of password security.
First,
don't just use a scrap piece of paper
that you keep near your desk.
Invest a few dollars in a nice password journal on Amazon.
They're really cheap.
I've got a few links in the description below
and start using something that will remind you
of how valuable these passwords really are.
Second, if you want a bit of extra security,
don't write down your
actual passwords in the notebook or document
instead write out something that has meaning to you
and helps you remember the password,
but makes no sense to anybody else.
So for example,
if your password is your favorite NBA team
followed by the street number for your first house
you lived in,
instead of writing down Bulls.2508
you could write down MJ.house,
as long as you can remember
that MJ stands for Michael Jordan
who played on the Bulls
and house reminds you of that particular number.
The code could work.
Now, let me play devil's advocate here for a moment.
Sure, you've added a little bit of security
or password journal,
but this only works.
If you can actually remember code and
someone in your family can decipher it as well.
Otherwise your online accounts just die when you do,
of course you could jump down to the next level
of password security level two,
which is the Password Manager.
Sometimes the greatest advantage
of a Password Manager is that it usually helps you
to create stronger passwords
by suggesting random passwords that you would have never
thought of on your own.
I categorize Password Managers into two camps.
You've got the offline and the online.
Offline apps like Kee Pass and Password Safe
are usually free,
but they don't upload your vault to the cloud.
In other words,
you can't sync your password vault between devices
and there's no backup stored anywhere on the internet.
Now, someone argue that this offline method
is better for security
since your password vault isn't traveling
through the internet,
but I could also counter by saying
that you still need to have
a backup of your offline vault to minimize the risk.
If you lose your device, right?
And your security is only as strong as how securely you
store that backup, right?
And on and on and on, we go into deeper levels of paranoia,
online password managers, like 1Password,
which is what I use.
They offer a slightly better user experience,
but they do cost a bit of money.
These companies store your vault online
so that you can sync your password
between all of your devices
and always have a backup in case you lose that device.
But wait what if those password managers hacked?
Well that's highly unlikely
and there are security measures that still require
my master password before the hacked vault is even usable.
Well, what if your master password gets leaked or
one of these companies are lying about their encryption
or their privacy policies?
Gee-whiz do you have trust issues or what?
Okay if you feel comfortable at this Password Manager level
of password security,
but you still feel a little bit skeptical
about trusting one company
with all of your passwords.
Here's what I suggest.
I use a strategy called a double-blind password,
where the password I store from my most valuable logins
at stuff like my bank, my email and my investments.
They aren't the real password.
Try to follow along with me here.
I allow my Password Manager app
to create the first 12 to 15 unique characters
of each password.
And then I always add the last four to five digits
manually each time I log in .
With this method,
my Password Manager doesn't know my full password,
but then again, neither do I.
It's a double blind password.
This protects me against key loggers
or that crazy scenario where my password vault
somehow gets hacked,
which honestly I've never heard of happening anyway.
All right,
I'm going to go into more detail
or I already have gone into more detail
about how to set up a double-blind password
in this video that I suggest you watch here.
Here's the bottom line,
whether or not you use the double blind password manager,
a password manager,
it's an excellent way to create and store strong passwords
and despite any perceived risks.
I can easily recommend this as a secure option.
Like I said earlier,
I use 1Password and I have an affiliate link in the
description.
If you want to give it a try for free
before we go deeper into this black hole,
that is your online security risk management.
Go ahead and click that like button
and the subscribe button.
These are the kinds of videos that are going to really help
you increase your privacy and security.
And there's a lot more great content
that you don't want to miss.
Okay.
So there are probably a number of different directions.
I can head with this third level of password security,
but no matter how you slice it,
we're moving into territory of absolute paranoia.
Pretty much close to insanity
this last month I've been working with a new tool
known as OnlyKey.
The best way that I can describe this
is really a cross between a physical Password Manager
and two factor authentication key.
This little device that I can carry with me on my key chain
will hold up to 24 login password combinations that
there aren't stored in the cloud.
And it's on not on my computer either.
It's only stored here
and protected by a seven to 10 digit number combination
that I can set.
Now I have to plug this key into my USB port
type in the correct password,
and then press the number that corresponds
to the appropriate login.
So if I set Twitter as preset
number three here which I've done
the key automatically logs into Twitter
by typing in the username and password
that I've previously set on here.
If somebody tries to hack the pin code,
the key auto deletes itself after 10 failed attempts.
Oh yeah.
And I can also set a dead man's code
that wipes the whole key clean.
If somebody forces me to open it for them
super paranoid right?
Well, it's a novel approach to password security I admitt,
but the set up process was a bit technical.
So it's not something I would recommend
unless you consider yourself tech savvy.
I've put an affiliate link to the OnlyKey
in the description if you're interested to learn more.
So which level of password security do you prefer and why?
leave a comment below to explain a bit of your strategy
so we can all learn together.