- Should you use a password manager,
and how to keep your passwords safe.
We're talking about that today on The Journey.
Now today on The Journey,
I have a special guest, Alycia with Sucuri.
She is our security expert.
Thanks for coming on the show today.
- Thank you for having me.
- And today we're talking about
how to keep our passwords safe
and what is a password manager.
But let's start with how to keep our passwords safe
'cause I'm probably rocking
not the most secure password right now.
- Well I would say that C-L-U are the things to remember.
So complex, long, and unique.
Complex meaning a mix of characters,
so uppercase, lowercase. - Okay.
- Some symbols, some numbers.
Long, so the longer the better.
It just adds more permutation
the more characters that you add.
And then unique.
So try not to reuse passwords.
I know pretty much all of us are guilty of it.
If you're gonna do that,
keep it for the accounts that you really don't need,
the throw-away accounts for some social media website
you're never gonna use that much.
That's a really good way to do it,
keeping tiers of passwords,
but just making sure that you get them
as unique, complex, and long as you can.
- That makes perfect sense,
and it was super important that you said
don't use the same password for every single account,
'cause if lo and behold,
a hacker gets a hold of one,
that means they have access to everything:
your banks, social media, any sites you've accessed.
- Totally, and there's some really great tools,
like Have I Been Pwned?
It's a website where you can put in your email address
and find out if your email address has ever been involved
in a data breach.
If it has,
and you use the same password all the time for everything,
that means all of your other accounts are pwned.
(both laugh)
- All right, what are some other concerns
that we should really think about with our passwords?
- Well, some people will default to a strategy like,
"Okay, well I'm just gonna use my dog's name
"and I'll replace some of the letters with numbers."
Okay, first of all,
if a hacker's really trying to go after you,
they're gonna do some research
and find out somethings about you,
so birthdays,
dog's names,
like- - Yeah.
I definitely saw that on "Mr. Robot".
That was the first thing that he did
to try to find passwords. - Totally.
- Did research on the person,
and the passwords were usually related to that.
I know it's a TV show,
but it's a lot more real than you think.
- Yeah, actually, at Sucuri,
all the people who work there just love that show
'cause they put a lot of effort
into making sure that it's accurate.
But another consideration that you should think about
is not sharing your passwords.
You never really know,
you don't want 'em written down on notepads
or something like that.
You don't really know how safe they are
that way. - Right.
- If you're sharing with somebody,
there's more secure ways of doing it.
There's tools like QuickForget
that'll allow you to put a little secret online
and share a link with somebody
that expires after it's been viewed.
So sharing passwords via chat and stuff like that
for different things are not a good idea,
or emailing passwords,
really not safe.
- It's super not safe.
I've ran into lots and lots of situations
working at GoDaddy,
talking to the small business owner
that gave their password to their employee.
After a while that employee was no longer an employee
and they had all their information.
And it was not pretty, what they did.
- Totally, that's why it's also important,
as we mentioned in some of our previous videos,
like the network security tips
for small businesses up there,
that you wanna make sure that you're documenting this stuff.
If you're gonna share- - Right.
- A password with somebody or you have access for somebody,
when they leave your organization,
you wanna make sure that you're changing those passwords.
- So something that I have on my phone
is Google Factor Authentication,
but tell the audience about 2FA.
- So two-factor authentication,
or multi-factor authentication if it's more than two,
is just another step after your password.
So you've typed in your password,
and for most people,
they'll got to their mobile phone
and open an app like Google Authenticator,
and it'll have a list of time-based codes
for each of your accounts.
Those expire after 30 or 60 seconds.
So you've typed in your password
and you only have so long to enter that 2FA code.
It's usually six digits or something like that.
- Makes sense.
- But that would mean that a hacker
would not only have to have your password,
but they also have to have your mobile phone
with the app installed in order to break into your account.
So by all means,
if there's 2FA available on your account,
please turn it on.
It's one of the best things you can do
to secure your accounts.
- Now with passwords,
I have so many sites that I login to.
Sometimes I forget,
Google doesn't always save it for me
and it's just a battle.
Is there something that I can use
and the audience can use to help us out?
- Yeah, well first of all,
stop using Google to save passwords,
'cause Google saves them in plain text.
And use a password manager.
These applications are designed
just to store and protect your passwords.
- Okay.
- So what you do is,
you set up a super crazy master password.
This is like your one password to rule them all.
And so essentially,
once you login to the password manager,
it'll start storing the passwords as you login to sites
and offering to save them.
The next time you come back to that site,
it'll autofill it for you.
- Okay, that's awesome. - So you can get it
for your phone,
you can get it for all your browsers.
You just have to login to that password manager application
and then from there on,
it takes care of it for you
and it'll even generate passwords for you
so you can have long,
crazy, completely scrambled passwords.
Most of my passwords are 20 characters,
just for reference.
- Security expert. - But it goes to,
like 64 on the password generator.
So that's a really great way to make sure
you absolutely have unique passwords for everything.
Last Pass, the one I use,
even has a security test
that will go through all of your saved passwords
and let you know which ones are not unique
and how you can make them a little more strong.
- Now can you give us a little demo,
with the audience at home, of- - Yeah.
- How to use that password manager?
- For sure, let's do it.
- Cool.
All right, so we're here.
You're gonna give us that demo of a password manager, right?
- Totally, yeah.
And there's a lot of different password managers out there,
so you can look and see what's right for yourself.
I know a lot of the people at Sucuri use Keypass.
- Okay.
- It's not online.
You can use a USB stick,
like a yubikey in order to- - That's pretty intense.
- Login to it.
Yeah, so you have to have that with you.
I use Last Pass personally.
It makes it really easy for me to share passwords
with my team and that kinda thing.
It is available on Windows, MAC, Linux, and mobile
so you can- - Convenient.
- Take it with you everywhere,
which is awesome.
So first, to start off,
you need to make an account.
So I've just used a quick ten minute mail,
fake email address right now for the purpose of this video.
And let's make a master password.
So this one has to be a really good password
so complex, long, and unique.
- [Nealy] That's CLU. - [Alycia] Perfect.
So I like to think of one that's a little bit easy.
And in fact, the advice that Last Pass gives
is to tell a story that's unique to you.
I'm Canadian,
so what's the most Canadian thing you can think of?
- So two things come to mind:
maple syrup and Justin Bieber.
- All right, okay.
I can work with that.
So let's type the word maple,
but that's a dictionary word.
It's easy to actually hack that
because brute force programs will actually go through
and just combine a bunch of different words together
and try to replace stuff and that kinda thing.
- [Nealy] That makes sense. - [Alycia] Yeah.
So we'll just change the a to an @ symbol,
change the e to a 3,
and then we'll do Bieber.
And maybe we'll add- - [Nealy] And then,
the same things - [Alycia] Like this hashtag,
or something like that. - [Nealy] Okay.
- [Alycia] Okay.
So we've got at least 12 characters
and now we need to make sure that we can type it in again.
My favorite thing to do here is to write it down briefly
and then just practice typing it in a bunch,
and you'll eventually get muscle memory
and be able to type a super long password in no time.
- [Nealy] Pretty easy. - [Alycia] So we'll just,
maybe make a note here,
pancakes for,
cakes and pop music.
All right, cool.
So now we can unlock the vault.
- [Nealy] New band name.
- [Alycia] And now that we're logged in,
we can go ahead and just get into Last Pass in the browser.
Because I've downloaded it here to Firefox,
all I need to do is login,
which Last Pass has already done for me here.
- [Nealy] Sweet.
- [Alycia] Now I'm creating an account
on another website.
So instead of having to create a password right now,
and as you can see, Go Daddy's got
their little strong password
meter there, so- - [Nealy] Sure.
- [Alycia] I can click Generate a Password
right from Last Pass
and I can even change the options
to make the password longer.
I can make sure that it's- - [Nealy] That's a winner,
right there.
- [Alycia] Yeah!
Obviously that one is not gonna get hacked, right?
- [Nealy] Right. - [Alycia] Super difficult.
They even have options
to make it easy to say or easy to read,
although honestly, once you get to 26 characters,
I think-
- [Nealy] Nothing's easy to read.
- [Alycia] So I'll just go ahead and fill that password.
It's gonna offer to save it right away.
So I just go ahead and add it.
- [Nealy] That's awesome. - [Alycia] And now,
I'm good to go.
I create my account
and the next time that I go ahead
and log back in to Go Daddy,
so I'll log out right now,
and go to log in.
And when I go to log in,
because I'm still logged into Last Pass,
it's just gonna go ahead and let me know
that there's a matching username and password.
And boom, I can log in.
So I never have to remember my password.
It's way stronger than I would be able to make it on my own.
- Wow, so that was super easy.
Thank you so much for sharing how to use
a password manager with us.
- My pleasure.
- So that's all we have for you today.
Go ahead and smash that like button if you liked this video.
Add a comment below
on what password manager you're going to use.
And while you're here,
subscribe to our channel,
ring that bell so you get these videos first.
This is The Journey.
We'll see you next time.