…everyone is unique, precious and can never be duplicated.  If only those words were true.  Passwords and the management of them, continue to be the weak link in authentication to both enterprise and personal systems.  I’m going to cover a couple of methods on how to effectively manage passwords and why it may be one of the most important things you do.

Protecting passwords can be broken down into two categories, namely, Password Strength and Password Management. 

Password Strength

Password Strength deals with the complexity of the passwords that you choose.  Having a stronger passwords, makes it harder for your password to be guessed or cracked in a brute force attack. The lockdown site has a great matrix effectively showing the importance of password complexity.  While complex passwords are great in theory, maintaining these can be a pain in the membrane.  I would like to think that as we push ourselves into the next century, humans will evolve to remember 22 alpha-numeric codes to protect ourselves.  That being said, my own experience indicates that I’m still a monkey at this point of that evolution.

Below is a small graph indicating as you create stronger passwords, the ability to remember these passwords becomes increasingly difficult.

What would a normal person do to address this?  Perhaps create one complex password and use it on all of services they have membership to?  …or maybe just create really simple passwords.  Neither methods are particularly effective.  Would you use the same key to unlock your car, house, garage, P.O. Box and safe?  Not likely.  If you lost your key, all of those physical assets would be at risk of compromise.  Likewise, protecting those assets with a lower quality lock to would present and ineffective control mechanism.

When I was at this point in own evolution, I used the strategy to create “theme” based passwords.  For example, I would choose something like “Last Names of Presidents of the United States”   Then I would use the widely accepted convention of replacing “e”, “i”, “o”, “a”, “s” with “3”, “1”, “0”, “$”, “@”, respectively.  So a password like “Washington” would be converted to “W@sh1ngt0n”.  It worked for a while, but the explosion of web based services I use has pushed this to limits of my abilities.  Which brings me to my next point, Password Management.

Password Management

Password management has evolved from simply having to remember your one email account on your ISP to having to cram in your Amazon, Bank, Email, Credit Card, eBay, Paypal, Gmail and Work Authentication passwords.  You get the picture. 

I asked a security-minded friend recently about their password management strategy and they said they had a USB drive containing all their passwords locked in a safe.  This sound secure to me, however, it’s definitely not convenient.   This makes me think of overprotective parents wrapping their kids in bubble wrap before going out to play.    Little Timmy WILL NOT be hurt…but how the hell will he swing a baseball bat?

Luckily, new applications and services have evolved to meet these needs.  The one I’ve used the most is LastPass.  They have a robust cross platform strategy of web browser plugins to store all of your passwords.  All of your passwords are protected with one password and encrypted on their servers.  Hence the name, LastPass….they claim it’s the last password that you’ll ever have to remember.  While this seems like a risky proposition, choosing a complex password for this service is paramount.  Just don’t lose it!!! (or forget)

LastPass offers an integrated customer experience in your browser with secure password generation for new accounts, auto filling of your credentials for existing accounts and secure note functionality.  In addition, if you want to spring for the premium version ($12/year), you can use it on mobile devices and enable the ability for two factor authentication (which I’ll talk about later). 

Another strong contender, which I’ve briefly used, is KeyPassX.  They offer all of the same features, however, their cross platform strategy is a local application that stores an encrypted database on your local machine.  Choosing comes down to: do you want to trust LastPass as a steward of my password information in the cloud or do I prefer to manage my database locally.  There are compelling arguments for each, but at this point, I’ll leave it at personal preference.

So What Do I Do Now?