Just a couple of years ago, our advice for managing passwords was “no worry.” After all, password recovery for both web-based as well as internal systems had matured to the point where a password reset would take a matter of seconds. Recently, though, we’ve changed our tune. Nowadays the best way to keep your passwords safe and secure is to use a password management system.
What changed? You may have noticed that resetting a password has become more complicated and, in some cases, downright unreliable. This is, ironically, due to attempts to make the reset process more secure to avoid being hacked. Extra steps have been added, such as ensuring that it’s
really a person trying to change the password and that the person is authorized to change the password.
Believe it or not, there are several good free options for password management systems. Windows has had Credential Manager built in since Windows 7, but it relies upon Edge or Internet
Explorer to function optimally. So, if you use another browser, such as Chrome or Firefox, it’s not very effective. Mac users have had Keychain for years, and while it’s better than Credential Manager, it still has its shortcomings; for example, it is dependent upon Safari.
A more flexible solution is an open-source package known as KeePass (keepass.info). It is extremely flexible in the information it stores, but the downside is that it requires you to manually enter usernames, passwords and any other information you want to save. It’s also not the most whiz-bang piece of software you’ll ever see, but it is functional and the lack of flashiness actually makes it easier to use for a lot of folks.
There are versions of KeePass for Windows, Mac and Linux. In the enterprise, KeePass can easily be set up for multi-user access. There are several derivatives of Kee
Pass, perhaps the most popular being KeePassX (kee
passx.org). Additionally, there are versions that allow you to truly use KeePass in the cloud, but you must pay for these.
Perhaps the best thing about KeePass is that it’s what information technology folks like to call “lightweight.” That is, it doesn’t take a lot of processing power or disk space to run. Many of the commercial password managers, especially those bundled with other services such as antivirus, are resource hogs, causing overall slowdown of your machine.
There are several good commercial password managers on the market, with costs typically $20 to
$40 per year. Most of these have a free version. The free versions of these systems, however, are feature-limited. Favorites in this category include Dashlane (dashlane.com) and LastPass (last
pass.com).
Regardless of which password management system you use, continue to follow the tried-and-true rules. For example, don’t use the same password on multiple systems. The Yahoo hack, which just seems to get worse and worse, revealed that the bad guys had managed to decrypt and steal passwords for users of Yahoo Mail. This was previously unheard of. It used to be that even system administrators could not get encrypted passwords. So, if you used your Yahoo password for online banking, it is now compromised, even more so if your login is your Yahoo email account.
Also, keep your password complex. At least eight characters, upper- and lowercase, numbers and symbols if they are allowed. Of course, a password management system helps you implement these practices.
John Agsalud is an IT expert with more than 25 years of information technology experience in Hawaii and around the world. He can be reached at jagsalud@live.com.
