Password Best Practices
Everyone that interacts with the Internet has a password and these days most people have many passwords that they need to keep track of. At the time of writing this blog I have a list of 375 usernames and passwords that I have accumulated over the years!? Even if you only have a few passwords, it starts to become more challenging to remember them.
A lot of customers write their passwords down in a book, is this a bad thing? Not necessarily, as long as the book is stored away securely. You may even want to add some old school encryption to your passwords, by adding in some extra numbers, letters or symbols. The problem can be that most of the times these books are not secured and could be easily lost, stolen or seen by others.
Some people use Notes on their phones or an Excel Spreadsheet. This can also be a risk if not properly secured, in most cases I would recommend against using these options.
Using a Password Manager
A password manager is an application that specialises in storing and securing your passwords.
There are many available password managers, but the one I have been using and recommending is “1Password”.
https://1password.com/
1Password uses the latest encryption methods to protect your data and the company are unable to access your data without the Master password that you set on your account. You are the only one who holds the key to access your data. (This is known as zero-knowledge encryption)
You only need to remember 1 master password and that’s it. You may have 375 passwords in your account like me, but they are all accessible with the 1 master password. It’s important this password is memorable, but also highly secure. 1Password can also be setup with 2FA authentication as a 2nd layer of security and also requires a Secret Key when setting up a new device.
You can also save other important information like your birth certificate, drivers license, medical cards, passports, bank details, secure notes and documents etc. This can be handy if you need this information quickly, you can also store a photo of these cards as an attachment.
I also like 1Password as it easily integrates across Mac and Windows.
Using Browser based Password Managers & Apple KeyChain
Browser based password managers are getting more secure and can be a simple and easy option for some people. For example Google Password Manager can be used if you use Google Chrome as your main browser and this will sync across all of your devices if you are signed in with the same Google Account.
Apply KeyChain/Passwords can also be used and could be a good option if you only use Mac devices (Macbooks, iPhone, iPad etc), this will also integrate with your Mac fingerprint reader if you have one on your Mac which is great.
* It’s also possible to use Apple KeyChain on Windows with iCloud for Windows installed or by installing the iCloud Passwords browser extension
These options are also free and can be a good solution for some customers. (With 1Password there is a yearly subscription fee)
What are recommended password practices?
Another advantage of a password manager is that it will recommend passwords for you for the sites you are signing up to. These recommendations use extremely strong combinations (can be up to 19-20 characters) and will automatically save them, so you don’t have to remember them.
Using 1 Password, I have no idea what my other 375 passwords are and I don’t need to know.
As a best practice for setting your Master password, laptop password or other logins manually ~ they should be at a minimum of 12 characters long (ideally longer) and they should contain a combination of lower case, upper case, symbols and numbers. Also a password should not contain easily guessable words or common dictionary words.
A great way to set your password is to use a passphrase, these are easy to remember i.e My F@v Car is a Ferrar1! or I l0ve eating Pizz@
As an example, here is a list of passwords and how long it could take a hacker to crack them:
* Data obtained from https://nordpass.com/secure-password
CDiamondIT – Cracked in 5 seconds
CDiamondIT1* – Cracked in 7 minutes
CDi@mondIT123* – Cracked in 1 day
I L0ve CDi@mond-IT – Cracked in 81 years (passphrase)
CDi@mond IT is Amaz1ng! – Cracked in Centuries (passphrase)
Be creative with your passwords, they need to be a combination of something you can remember, but at the same time be difficult to crack.
We can assist you with reviewing your current password strategy and recommend the best solution that will suit the devices you have and they way that you work.
~ Clete Diamond IT
