Responses to Three Common Password Manager Objections.
Hi, everyone.
Leo Notenboom here for
askleo.com.
Ask Leo exists in part because of its patrons.
askleo.com/patron
has more information about what you get when you sign up, as Patron
exclusive benefits. Again to my patrons for supporting me.
Thank you. So on a recent podcast I was listening to,
there was reference to an article in the Wall Street Journal called
What Keeps People From Using Password Managers.
They listed three specific objections that I want to address.
I want to talk about this because I really believe, and most security experts will
agree with me, that these objections actually don't have much merit.
And as a result, people aren't using password managers.
When again, most security experts agree that's one of the single most important
things you can do to keep your online life secure.
The first objection is that it's difficult to set up.
It seems interesting to me
that the article talked mostly about importing the data that you choose
a password manager to use, and somehow you then need to import
some previous collection of password information.
Maybe you've got it stored in a file.
Maybe it's all written down, whatever.
Honestly, from my perspective, there is no import. The steps
to getting started with a password Manager and to get all of your data
in your password manager is very, very simple.
You install it, you start using it.
That's it.
That's literally all that it takes. And here's why,
as you use your Password Manager as you go on about your day to day,
when you visit a site that your password manager does not yet have the information
for you'll have to log in like you normally do, like you have been.
Whatever technique that might be, you'll enter your username,
you enter your password, you'll sign in, and your password manager
will say, Would you like me to save that for you?
You say, yes, that entry is now part of your Password managers database.
You continue your day to day use of your computer, your online accounts,
and so forth, and very slowly over time, your password vault is built up
based on all of the places that you visited and logged into.
The Password Manager has dutifully recorded the information and is building
up its database of all the places you care about.
Of course, you can enter things manually if you want to, but you don't have to.
All you have to do is use your computer database will come along.
Now, there is one interesting opportunity I'll call it.
That happens once you do this,
I'm going to make an assumption that your passwords are perhaps less than ideal.
Perhaps they're easy to remember.
Perhaps they're short.
Perhaps they're not particularly strong.
Once you've got it into Password Manager, you don't have to remember that password
anymore, so change it, make it long and strong
and random and something that you could never, ever guess or remember because your
password manager is going to remember it for you.
But you only need to do that after you've
already entered the first piece of data you've signed in.
The password manager saved your
information, and at that point, you can elect to change it if you want to.
Setting up is just not a big deal.
Number two on the list I call Trust.
Now, the article talks about things like rogue employees at the Password manager
data center or their development team, or whatever.
The issue is that a well designed password manager and almost all of the name brands
that you and I can think of are indeed well designed.
They don't know your password.
They don't.
They can't know your password to your
vault, very much like in a previous article,
I discussed how websites know that you Typed in your password correctly without
themselves actually knowing what your password is.
These password vaults do exactly the same thing.
They don't know your password.
They couldn't tell you your password if they needed to.
And what's more important is that they
don't have the ability to access your encrypted data.
Remember, all of your password information
is encrypted before it gets sent to the online service.
All of the encryption,
all of the decryption happens on your device, on your PC, on your phone.
Whatever.
The only thing that the service ever sees is a blob of encrypted data that it stores
and dutifully synchronizes with your other devices.
It's not until you get to your machine
and you've entered your master password correctly that any of that data is made
accessible to anyone and that anyone is you.
And perhaps the browser extension
that you've installed to enable the password manager to do its work for you.
You don't necessarily have to trust the employees because even if they did
have access to the database of all the password vaults of everybody
in the universe, they still couldn't get in because they don't have the password.
Now, the other issue that this dovetails
with very nicely is the one I actually hear more often.
That is what if the password manager, they're good guys.
They're doing everything right.
What if they get breached?
What if their database becomes exposed and accessible to a hacker?
In other words, what if my password vault lands in the hands of a hacker?
Well, to begin with, best of my knowledge, that's never happened.
And even if it had, you know what?
There's still nothing to worry about
for exactly the same reason your data is encrypted.
It's encrypted strongly, and that means that the hacker has no way to decrypt it.
At least not in a reasonable amount of time.
We're talking centuries here for brute forcing it.
So the hacker has this blob of encrypted
data that they can do absolutely nothing with your information remains secure.
Always, regardless of who's looking at it,
the only person that can see the data inside of your vault is you
on your equipment when you specify your master password.
Objection number three.
What happens if I forget my master password?
Okay, I get that. I do.
It is related to losing access to your database.
Losing if you lose access to your password
vault for some reason, be it the master password.
Be at some other issue.
A couple of different things come to mind
right away that make this ultimately a nonissue.
First of all, of course, please.
This is the one password you'll want to remember.
So make it memorable.
The scenario that I like,
the technique that I like is to use four random words that perhaps seem random
to everybody else, but maybe have some meaning to you when we
take a look at correct horse battery staple.
That as a meme, has become so incredibly memorable.
But it was memorable from the start.
The moment you understood exactly what it was that created that ForWord password.
You remembered it.
I didn't even have to look at my screen to read it to you, right?
It's burned into the pack of my memory.
It's that memorable.
Create one of those for yourself.
It's not that hard, and that's the only password you need.
It's the password to unlock your password vault.
Okay, what happens if you forget it?
Well, my go to response always is backup, but that's something you need.
Before you forget your password,
I strongly recommend you get in the habit of backing up your password vault.
I do it roughly monthly, and I do it in plain text.
I actually download comma separated values CSVs, so that if I wanted to,
I could open up that file in Notepad and see all my information.
Or I could load that file into Excel or
some other spreadsheet program and see all my information.
Yes, that does mean that that file needs to be protected some other way.
But that's one that's easy to copy to a USB stick and store it in a safe or
encrypt it some other way, or do any number of other things to keep
it secure, just inaccessible, so that in case you ever need to recover
what was in your database, you can even without that.
If you lose your password vault for any
reason, you haven't lost access to anything you have it.
All you need to do is rebuild it in a sense.
So you've forgotten your Outlook dot com password.
It was in your vault.
It was a password that was completely impossible to memorize like mine.
It's 20 characters, 20 random characters of that.
No way could I memorize it?
No way could I tell you what it was if I
lose my password vault, I don't have that password.
Great. I'll do a password recovery.
I mean, that's all that it takes for those passwords for those accounts that you need
to regain entry to, you do a password recovery,
and once again, you're back into all of the services that you're using.
Obviously, with new passwords use strong
passwords, I hope, but you haven't lost access to anything.
It's a great opportunity at that point to do that to go through and recover
access to all of these accounts while you're building up your presumably
replacement master vault, your replacement password manager.
But that's up to you.
But it's just so incredibly important
to understand that even if you lose access to your password vault for any reason,
you have not lost access to the accounts that it talks about
need to have your recovery information up to date for all those accounts.
But that's true anyway, regardless of whether or not you use
a password vault or not, with that recovery information up to date.
With those accounts being online and ready
to recover your password, you can get back in.
So I hope that helps set aside some of the big objections to password vaults.
I have to reiterate.
Security experts across the board all agree that using a password vault
is one of the most important things you can do to keep yourself safe online
because it enables using different passwords everywhere,
and it enables using passwords that are stronger than your memory would allow.
I hope that was helpful for updates.
For comments for related links and more, visit
askleo.com/136938
I'm Leo Notenboom.
This is askleo.com