Password storing apps such as Keeper

[172007]

Like most I have so many password for online use it's difficult to keep track.

What do our IT professionals / experts on the forum think about apps such as Keeper. Keeper can also store photos of passports etc which could be useful?

Do you trust these apps, eggs in one basket argument....

 

[bleeder4]

In my workplace we're all required to use the 1Password app/browser extension. We each have our own individual area within it where our own work passwords are stored, and then each team has a shared area for shared passwords. Each area is locked down by permissions so that only the proper people have access to it.

I personally have never liked them, as you can never be 100% sure exactly which country the passwords are stored in and how secure they are.

At home, in my own private life, I have my personal passwords written down on an A4 piece of paper which is kept in a locked heavy-duty safe, inside a locked cupboard, inside a locked room. I think that is far more secure than storing them in the cloud somewhere.

 

[lxfe_mxtterz]

I am by no means an IT professional or expert, but I personally prefer to note my passwords down with pen and paper. Not to say that I don't trust these apps, but it just feels safer in case of any technical issues.

I do have many of my passwords also saved on my phone as "auto-fill" though as it makes life easier when logging into websites.

 

[JamesT]

Our Infosec people are generally in favour of password managers. You can have passwords that are different for every service, and more importantly those passwords can be longer and more complex than you would likely be able to remember.
Personally I'm using Bitwarden. I used to use Lastpass until they started wanting payment to be cross-platform (and then they had a security breach so I may have dodged a bullet there).
If you've got a decent master password then it should be pretty secure. Brute-forcing AES-256 is lifetime of the universe stuff.

 

[Crossover]

We’ve recently started using KeePass at work (within the IT team) based off a recommendation from a consultant we had working with us back in June. I am trying to incorporate it into my personal life too as I have too many passwords to remember (and both at home and work, shamefully given us pros advise against it, it has led to password reuse)

KeePass is completely offline and the file is stored on a place of your choosing. For personal use I may sync it to a cloud service so I can use it on my phone as well, but at least ‘you’ can choose where to put the resultant file

 

[johntea]

We use KeePass too at work and it has done the job for many years now, but certainly print out a copy of your password database every so often and store in a fire proof safe or similar as you never know when that proverbial bus will run you over! (almost like having a will for all your digital footprint!)

In my first job the IT Manager actually sadly passed away completely unexpectedly one weekend and it was a bit of a nightmare sorting everything out as they didn't have a password manager back then, we basically ended up having to reset his email password and dig through things to find what the business needed which was a horrible thing to have to go through on top of the shock of it all

 

[Buzby]

I’ve tried many systems - usually it was the introduction of monthly charges that made me move on to something new. Currently I’m musing BitWarden which is still free for personal use, but the arrival of 2FA has meant is is becoming less useful as a one-stop shop for accessing websites.

 

[jon81uk]

I mainly use the built in Apple one.

 

[3141]

I feel I ought to follow the advice to use a password manager but I don't, for reasons I'll explain a bit later. Most passwords are in a Word document on my home computer, and some passwords, which I can easily remember, are used more than once. Both of these are bad ideas, I know. But all of these relate to sites which aren't crucial. Someone else might log into a site and buy things in my name, if they had first hacked into my computer, but they couldn't pay using my bank details.

The really important passwords are ones I am able to remember. For example, an important date backwards. I can say that here because I don't use social media and no-one can go to Facebook and find possible dates and then experiment by reversing them. Or what I've written in the file is something like "the Victoria route". No-one hacking into the computer could know that that means the bus route which went to Victoria from the place I lived in as a child. (Not a genuine example, actually.)

The reason I've shied away from password managers is that I don't fully understand what they do, and instead of making themselves clear when I've looked into two or three of them, they say things like "Right, friend! Let's get started!! Enter your name and email address below. Relax, we'll have you secure in seconds!!!" This doesn't fill me with confidence.

 

[JamesT]

I feel I ought to follow the advice to use a password manager but I don't, for reasons I'll explain a bit later. Most passwords are in a Word document on my home computer, and some passwords, which I can easily remember, are used more than once. Both of these are bad ideas, I know. But all of these relate to sites which aren't crucial. Someone else might log into a site and buy things in my name, if they had first hacked into my computer, but they couldn't pay using my bank details.

The really important passwords are ones I am able to remember. For example, an important date backwards. I can say that here because I don't use social media and no-one can go to Facebook and find possible dates and then experiment by reversing them. Or what I've written in the file is something like "the Victoria route". No-one hacking into the computer could know that that means the bus route which went to Victoria from the place I lived in as a child. (Not a genuine example, actually.)

The reason I've shied away from password managers is that I don't fully understand what they do, and instead of making themselves clear when I've looked into two or three of them, they say things like "Right, friend! Let's get started!! Enter your name and email address below. Relax, we'll have you secure in seconds!!!" This doesn't fill me with confidence.

With respect, passwords based on dates, even reversed are probably terrible from a security point of view. A good password is a long string of characters as it will take a huge number of guesses for an attacker to get it. (Putting ‘01122023’ into https://bitwarden.com/password-strength/ reckons it would take less than a second to crack)

Password Managers at their heart are an encrypted file. You are the only person with the key to that file, so if you’ve chosen a good one then the passwords inside are safe. Around that is then a program to let you interact with the passwords, often hooking into your browser to save copying and pasting. Versions that keep the file up in the cloud let you sync between multiple machines and protect against the chance of your computer failing.

If you want to stick with your Word document, I hope at the very least you choose the option to password protect it. I believe the encryption of a docx file from Office 2016 or later isn’t hopeless like previous versions.

 

[Crossover]

A good password is a long string of characters as it will take a huge number of guesses for an attacker to get it.

This is good advice to follow regarding passwords.

Password Strength

xkcd.com

Random mixtures of letters and numbers is a complete nightmare (maybe unless you can copy and paste it)

 

[Springs Branch]

This is good advice to follow regarding passwords.

Password Strength

xkcd.com

Random mixtures of letters and numbers is a complete nightmare (maybe unless you can copy and paste it)

So I can forget all those mixtures of letters, numbers, capitals & characters for my passwords. Just use three or four consecutive stations on one of my local rail lines, provided there’s around 24 letters. E.g. WiganInceHindleyDaisyHill?

Or your favourite classic traction, e.g. WhistlerHooverRoarerDuff

 

[Crossover]

So I can forget all those mixtures of letters, numbers, capitals & characters for my passwords. Just use three or four consecutive stations on one of my local rail lines, provided there’s around 24 letters. E.g. WiganInceHindleyDaisyHill?

Or your favourite classic traction, e.g. WhistlerHooverRoarerDuff

Preferably three or four unrelated words.

Either way it’s easier to type, as well as remember (and likely easier if you need to write something down, to just do some cryptic reminders rather than the whole thing)

 

[najaB]

Preferably three or four unrelated words.

Indeed. When I have to reset my password I usually use three objects within eyesight and a number. So while they are somewhat related, brute-forcing TelevisionFlaskSofa25 is going to take a lot longer than 20050821.

 

[Crossover]

Indeed. When I have to reset my password I usually use three objects within eyesight and a number. So while they are somewhat related, brute-forcing TelevisionFlaskSofa25 is going to take a lot longer than 20050821.

Yes - I suppose linked by circumstance is different to linked by subject. Either way, it’s a pretty easy password to remember and easy to type but not so easy to brute force. Add in a special character for an extra zing

No matter what the password, fall prey to a scam site and it doesn’t matter how good the password is, it’ll harvest it. However that’s also why it’s good to not re-use them as one site getting hijacked is better than the lot. Also why sometimes password managers are good if they plug into the browser, as you may never need to know the password (and it should never offer it to a lookalike page)

 

[philthetube]

I don't use one, I use the same password for all unimportant sites, eg. anything which does not have credit card details and the rest are hidden away in a place which I will not mention.

 

[bravesirrobin]

If you have to ask "Do I need this?" when it comes to information security, the answer is almost certainly "Yes". Any major vendor will be audited to ensure that they're doing what they say they are in respect of security (in particular look out for ones which offer enterprise pricing).

For all major vendors, storing your password vault in the cloud is not a problem. The password used to encrypt and decrypt never leaves the client device, and without this cracking the vault is practically impossible (as @JamesT points out). In general, for the average person, the risk of breach of one of these services is far lower than that of accidentally reusing a password (or using a weak one!) so should be the default option.

Also, 2FA where ever you can, and keep the second factor separate from your passwords!

 

[172007]

Thanks for all the replies.

I must admit the one stand out comment was about a free service and then mention of a data breach. I would never trust a security system that I didn't pay for as other than advertising how do they manage the service properly and securely themselves.

 

[najaB]

I would never trust a security system that I didn't pay for as other than advertising how do they manage the service properly and securely themselves.

In many cases they offer a free version for personal use, which is really intended as a taster for their enterprise offering.

 

[172007]

In many cases they offer a free version for personal use, which is really intended as a taster for their enterprise offering.

What does "enterprise" mean? I have skim read the word an number of times as always assumed it was aimed at business owners wanting it for their network.

 

[najaB]

What does "enterprise" mean? I have skim read the word an number of times as always assumed it was aimed at business owners wanting it for their network.

Exactly that. It refers to products aimed at larger businesses.

 

[JamesT]

Exactly that. It refers to products aimed at larger businesses.

Such features may include things like being able to share passwords between users or having levels of users. If you work in a team, there are likely credentials you all need to systems, so it makes sense to store them centrally and make access available, rather than everyone having to take copies and keep them up to date. In an organisation, you almost certainly want some administrators, who can add or remove employees to the system, or have the ability to unlock accounts where someone has forgotten their key.

 

[weepingwillowb]

All mine are written down on a piece of paper and a Severn Trent Water envelope.

 

[ComUtoR]

If you have to ask "Do I need this?" when it comes to information security, the answer is almost certainly "Yes". Any major vendor will be audited to ensure that they're doing what they say they are in respect of security (in particular look out for ones which offer enterprise pricing).

It's a logical fallacy. The ever increasing security protocols and password strengthening doesn't improve security. The biggest security risk is the squishy part. The Human.

On topic :

My 'Password keeper' is built into the web browser and it stores all my passwords. It is currently storing 149 unique passwords to various websites. Access to that 'password keeper' only requires 1 password. Yeah, that isn't 'secure' Even if you don't have access to the browser password keeper password; all you need is my laptop and it will log you in to almost all my websites because the browser will ******* and log you in. Even when it can create those "$£$%£djl3;3#]{*54!!"£xhop3" passwords, it becomes meaningless when you click a link and it always 'remembers your password'

Off topic (ish) :
If you need to change your password regularly - The Human will: RFUK01, RFUK02, RFUK03
If you need letters numbers etc - The Human will: RailUK Forums#1, **RFUK01**, RFUK_Tr@1n5
Using a mnemonic - Silly Humans : My_Frum_Train, My_Frum_Bus, My_PW_Bank
Overly complicated - Lazy Humans : I'll just write it down
Security Questions : Mother's Maiden name, First school, favourite football team
Multiple login names : C0mut0r, Com_you_Tor, Comut3r, or the same email for every website.

Even as we move towards biometrics, security is still susceptible to Social engineering and the plethora of human failures. I can unlock my phone with a thumbprint (how many of you always use the thumb ?) and then it will give me pretty much unlimited access to everything. Apologies in advance but something hit my news feed this morning about porn and 'safe' access. They are now saying that a new safeguard could be introduced to scan face data for older faces.

UK porn watchers could have faces scanned

New draft guidance sets out how porn websites and apps should stop children viewing their content.

www.bbc.co.uk

Facial age-estimation tech, that will scan users' faces and use software to infer if they are an adult, is also an option.

So now you can have your biometrics scanned and stored on a server a million miles away; yep, that's a sensible option...

Even 2FA has its limitations. If I log into google it just sends a notification to my phone and all I need to do is click the "yes, its me" anyone with access to my phone will again, have unlimited access.

Be very careful with anyone trying to tell you their system is 'secure' or has the 'best encryption' The Human is the weakest part.

 

[yorkie]

I am by no means an IT professional or expert, but I personally prefer to note my passwords down with pen and paper. Not to say that I don't trust these apps, but it just feels safer in case of any technical issues.

You do this at home, but not at work presumably?

I do have many of my passwords also saved on my phone as "auto-fill" though as it makes life easier when logging into websites.
Edit

Saved directly on the phone, not by signing in to a web browser?

I am a bit confused; do your paragraphs not contradict each other somewhat? Or is there something I am missing?

 

[lxfe_mxtterz]

You do this at home, but not at work presumably?

Well, I only have a handful of passwords to use on my work phone - but yes, I note these down on paper, although I have managed to memorise most of them.

Saved directly on the phone, not by signing in to a web browser?

I'm not sure - it's just on the pop-up that frequently appears asking me whether I would like to memorise my passwords for automatic login in the future.

I am a bit confused; do your paragraphs not contradict each other somewhat? Or is there something I am missing?

Perhaps so, although possibly I wasn't very clear. I meant that I'll always note down my passwords on paper in the first instance, however I have many also saved for "automatic login" for convenience. I'll always do the former but never the latter on its own.

 

[najaB]

It's a logical fallacy. The ever increasing security protocols and password strengthening doesn't improve security. The biggest security risk is the squishy part. The Human.

Yes, and no. You are correct that the weakest part of any security system is the human. As always, there's an XKCD for that:

However, where systems are designed so that they are relatively easy to use then it makes it easier for the squishy part to be secure.

Even 2FA has its limitations. If I log into google it just sends a notification to my phone and all I need to do is click the "yes, its me" anyone with access to my phone will again, have unlimited access.

Thing is, you will probably notice fairly quickly that you don't have your phone, so for the vast majority of applications the fact that someone would have to both know your password and have your phone increases security considerably. Especially where a code is displayed on your phone that has to be entered into the website since it makes push notification fatigue a non-issue.

 

[ComUtoR]

As always, there's an XKCD for that:

Isn't there always

However, where systems are designed so that they are relatively easy to use then it makes it easier for the squishy part to be secure.

Absolutely. The best systems are those that accept that there needs to be a balance between Human/Machine. I find it very amusing that my bank will always say "we have saved your.." when verifying my laptop. The second I delete cookies... They magically no longer have my laptop as a verified device.

We are convincing that squishy part things are secure, when they aren't.

Thing is, you will probably notice fairly quickly that you don't have your phone, so for the vast majority of applications the fact that someone would have to both know your password and have your phone increases security considerably.

My children have full access to many of my websites. Other than the occasional Just Eat or Playstation purchase; they will still need access to card+pin+password+CVV(lol)+login...

Especially where a code is displayed on your phone that has to be entered into the website since it makes push notification fatigue a non-issue.

The Human stupidity here; as well as tech ignorance / end user functionality.. is where "notifications" can be seen on lock screens. One of my banks shows the code and then the blurb. They always shown on the lock screen. The other bank shows the blurb and then the code. You need to unlock my phone and click the messaging app to read it. On a side note.. There are multiple instances where notifications cause security issues. **Cough**Crapple**Cough**

Ultimately,.storing passwords behind single user logins worries me far more than specific password.l securoty.

 

[bravesirrobin]

It's a logical fallacy. The ever increasing security protocols and password strengthening doesn't improve security. The biggest security risk is the squishy part. The Human.

Quite! Preaching to the choir, there

 

[bleeder4]

The Human stupidity here; as well as tech ignorance / end user functionality.. is where "notifications" can be seen on lock screens. One of my banks shows the code and then the blurb. They always shown on the lock screen. The other bank shows the blurb and then the code. You need to unlock my phone and click the messaging app to read it. On a side note.. There are multiple instances where notifications cause security issues. **Cough**Crapple**Cough**

You should be able to set your phone not to display the text of notifications on the lock screen. I have my Samsung phone set like that. The lock screen displays that a new message has arrived, but it doesn't show the text until I unlock the phone. I set it like that earlier this year when there was that well-publicised scam case where people would nick a phone and card, use their own phone to add the stolen card to their own online banking app, and then look at the lock screen of the nicked phone for the confirmation code from the bank.