Bien aimé cet article qui m’évitera de partir from scratch quand on me re-demandera mon avis sur le sujet.
Je le reprends donc ci-dessous intégralement en y intégrant mes commentaires afin que personne ne puisse penser qu’il puisse s’agir d’un abominable plagiat.
A couple of years ago, there was some debate over the usefulness of password managers. Some argue that password managers are a bad idea, because they create one vector of attack that can breach all of your online credentials. These concerns were hightened when OneLogin was subject to a major cyber attack on May 31st, 2017. From OneLogin:
“Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the actor created several instances in our infrastructure to do reconnaissance. OneLogin staff was alerted of unusual database activity around 9 am PST and within minutes shut down the affected instance as well as the AWS keys that were used to create it…
The threat actor was able to access database tables that contain information about users, apps, and various types of keys. While we encrypt certain sensitive data at rest, at this time we cannot rule out the possibility that the threat actor also obtained the ability to decrypt data. We are thus erring on the side of caution and recommending actions our customers should take, which we have already communicated to our customers.”
Troy Hunt of Have I Been Pwned fame argues that password managers are very necessary, you just need to choose a good one and practice good opsec (operational security) with your use of it. Keep in mind that he has an endorsement deal of some sort with 1Password, which is a password manager. But despite this possible conflict of interest, I think his advice is good:
“Your brain is a very bad password manager. It’s incapable of storing more than a couple of genuinely random strings of reasonable length (apologies if you’re a savant and I’ve unfairly characterised you in with the rest of our weak human brains). That leads to compromises. If you’re one of these people who says ‘I’ve got a formula that always gives me unique passwords that are strong,’ no you don’t, they probably aren’t and no they’re not. You’re making concessions on what we empirically know is best practice and you’re kidding yourself into thinking you aren’t. I’ve had this debate many times before and there’s dozens of comments raging backwards and forwards about this in my post on how the only secure password is the one you can’t remember.”
My friend John Opdenakker also has good advice about password managers. He likes the password manager that’s built into Firefox. While you’re there, I recommend you check out the rest of his very informative blog. But without further ado, here’s some of what he has to say about password managers:
“The security of most browser’s built-in password managers is still inadequate. At the moment Firefox is the most secure. The built-in password managers of the discussed browsers and Google’s (cloud-based) password manager still can’t compete with the most third party password managers. Both when it comes to security and integration of necessary features.
If you want to use a built-in password manager Firefox is the best choice at the moment. If you want to use a cloud-based password manager I recommend you to do some research and choose a third-party password manager that is most suitable for you. If a password manager is nothing for you use a password book that you keep close to you.
Keep in mind that the goal is to create strong passwords and store them in a secure way. Which tool you use is irrelevant, as long as it supports you to reach that goal.”
And here’s my own general advice about password managers, in a nutshell:
- Using a password manager is better than not using a password manager. So use one! We all have dozens or perhaps hundreds of credentials for various websites and online services these days. Writing them down in a book can be vulnerable if other people can have physical access to where you keep the book at work or at home. Plus that method encourages users to come up with their own passwords. User created passwords are almost always less secure than randomly generated passwords that a password manager can create. And if your list of passwords is digital, like a text file on your local hard drive or on the cloud as a note in Evernote or Google Keep, that’s cleartext that can be exposed in a cyber attack. If you encrypt a local file with your credentials, that’s still a hassle as you need to execute your text editor or word processor each time you need a password. And the method still encourages weaker user-generated passwords. Pretty much all password managers can generate a much more secure, random password for you.
- Be careful with the opsec of the phone, tablet, and PC endpoints that you keep your password manager on. A password manager on your home or work PC should be in a user account with a password. (Damn it! Ha.) You don’t want your family members or coworkers to be able to access your password manager without your operating system user account behind a password. The same applies to mobile devices. You could lose sight of your phone or tablet, make sure your mobile endpoints with password managers are protected with a lockscreen. And have a “find my device” service set up in case you lose your phone or tablet– which is also often a means of two-factor authentication.
- On that note, have two factor authentication set up on as many of your online accounts as possible!
Alright, now here’s a brief rundown of the different password managers you could use.
- Google Chrome, Mozilla Firefox, Opera, Microsoft’s Edge, and Apple’s Safari all have built-in password managers in their most recent versions on PC and mobile devices. For convenience, you may want to use the built-in password manager in your favourite web browser. I don’t recommend Chrome these days due to Google’s tendency to profit from selling your data. Firefox’s, Opera’s, Edge’s, and Safari’s built-in password managers are all pretty good. I personally use Firefox’s password manager.
- Third-party password managers, unlike the password managers built into web browsers, tend to not be freeware. But because they are maintained by entities that are separate from the web browser platforms, that separation may be good from a security perspective. Cyber attacks to Google, Mozilla, Apple, and Microsoft’s cloud servers may put their browser-stored credentials at risk while leaving the third-party password management platforms unscathed. And pretty much all third-party password managers have web browser plugins for most popular browsers on desktop and mobile. It also occurs to me that perhaps, by paying a fee rather than using freeware, they may have extra incentive to secure their credential storage. Here are some third-party password managers for you to consider:
- 1Password has apps for macOS, iOS, Windows, Android, Linux, and Chrome OS, with 24/7 email support. Prices range from $2.99 to $7.99 per month, depending on your personal or business needs and they offer a 30 day free trial. Check it out here.
- Bitwarden has apps for Windows, macOS, Linux, Android, and iOS, with web browser plugins for Chrome, Firefox, Opera, Microsoft Edge, Safari, Vivaldi, Brave, and Tor Browser. There’s a free version, plus subscription options from $1 to $5 per month depending on your personal or business needs. Check it out here.
- Dashlane has apps for Windows, macOS, Linux, Android, and iOS. The free version can store up to 50 passwords, the paid version has Dark Web monitoring, a VPN, and unlimited password storage for $3.33 per month. Check it out here.
https://www.peerlyst.com/posts/so-you-need-a-password-manager-kimberly-crawley
