{"id":6410,"date":"2017-12-04T08:38:47","date_gmt":"2017-12-04T16:38:47","guid":{"rendered":"https:\/\/cldc.org\/?post_type=organizing_resources&#038;p=6410"},"modified":"2022-10-27T14:03:20","modified_gmt":"2022-10-27T21:03:20","slug":"passwords","status":"publish","type":"post","link":"https:\/\/cldc.org\/hi\/passwords\/","title":{"rendered":"Passwords: Best practices"},"content":{"rendered":"<p><strong>If you do nothing else, use a password manager (keepassxc.org, lastpass.com, 1password.com) that is protected by a strong password &#8212; here&#8217;s a checklist and a zine to help you make one.<\/strong><\/p>\n<p>At a minimum, we recommend:<\/p>\n<ul>\n<li>Using a different password for every account or login, so that if one account is compromised, only one account is compromised.<\/li>\n<li>Strong, randomly generated passwords or passphrases that are sufficiently long to resist password attacks, such as <code>))FpFS#Q(%ma_+7bh&gt;<\/code> or <code>remake.catfight.dwelled.lantern.unmasking.postnasal<\/code>.\n<ul>\n<li>* Tap here for our guide to making a strong password! *<\/li>\n<\/ul>\n<\/li>\n<li>Complement your passwords (where possible) with 2-factor authentication (a.k.a. 2-step verification).<\/li>\n<\/ul>\n<p>For more details on how to do this in practice, keep reading.<\/p>\n<p><!--more--><\/p>\n<h4>Password managers (in general)<\/h4>\n<p>To accomplish this, use a password manager to generate and store all of your passwords that you don&#8217;t need to manually type in.\u00a0 If you are already using a password manager, great!\u00a0 But still consider the following selection criteria for password managers:<\/p>\n<ul>\n<li>Is your password manager trustworthy?\u00a0 Do you trust the developers of the software?\u00a0 Do you need to fully trust the developers (is it open source)?<\/li>\n<li>Does your password manager store your passwords &#8220;in the cloud&#8221;, and if so, is it protected with strong encryption and an equally strong password?<\/li>\n<\/ul>\n<p>If you aren&#8217;t backing up your whole computer (even though you should be), you should at least be backing up the file containing all your passwords, particularly if it isn&#8217;t stored in the cloud.\u00a0 How to access this file will depend on the password manager.<\/p>\n<p>The password manager should be able to generate strong random passwords for you such as <code>bdY,Fsc_7\\}*Q]cFP<\/code>.\u00a0 This is great for a password that you never have to type in, that is, a password that the password manager will input for you or that you can copy-paste from the password manager.<\/p>\n<h4>Passwords that you need to type in<\/h4>\n<p>For passwords that you will necessarily need to type in (for example: a password you enter on your phone, the password you protect your password manager with, the password you use to encrypt your computer) use a <em>diceware <\/em>password a.k.a. <em>passphrase<\/em> a.k.a. a random sequence of words such as <code>remake.catfight.dwelled.lantern.unmasking.postnasal<\/code>.\u00a0 You can generate this password manually using dice and a word list.\u00a0 We have a guide available here. Many password managers will also generate such passwords, although you probably won&#8217;t need many of these.<\/p>\n<h4>Recommended software<\/h4>\n<p>We always recommend, where possible, software that will work on all computers and that is open-source. To that end, we recommend <a href=\"https:\/\/keepassxc.org\/\">KeePassXC<\/a>. The Tools tab gives access to a password generator, where you can generate long random passwords and passphrases as described above.\u00a0 The Database (file of passwords) tab gives you the option to create a new file to store your passwords.\u00a0 Remember to use a strong passphrase (which you can generate via the Tools tab) to protect this file.\u00a0 We recommend that you write this passphrase down and store it somewhere safe (away from whoever your adversary is).\u00a0 You choose the location to save the file, so you know where it is for backing it up.<\/p>\n<p>KeePassXC does provide integration with Firefox and other browsers (so that you don&#8217;t have to copy and paste passwords every time you log in), however, for simplicity, we recommend the built-in password manager that comes with Firefox (our recommended browser) for managing any password that you type into a webpage, which is most passwords.\u00a0 To set a strong password to protect the file that Firefox uses to store your passwords, navigate to the menu, preferences, security and select use a master password.\u00a0 Use KeePassXC to generate a memorable passphrase; you will need to type in this passphrase whenever you restart Firefox.\u00a0 Unfortunately the Firefox password manager does not include a password generator.\u00a0 If you don&#8217;t want to use KeePassXC, you could use a Firefox add-on for this.\u00a0 We recommend &#8220;Secure Password Generator&#8221; (to install, navigate to the menu, add-ons, search for &#8220;Secure Password Generator&#8221;, select install) which adds a lock icon to your toolbar and allows you to specify the often ridiculous requirements that websites have for passwords (no special characters, at least 3 numbers, etc).<\/p>\n<h4><a href=\"https:\/\/www.xkcd.com\/936\/\"><img decoding=\"async\" class=\"alignnone\" src=\"https:\/\/imgs.xkcd.com\/comics\/password_strength.png\" alt=\"\" width=\"740\" height=\"601\" \/><\/a><br \/>\nPassword length and strength<\/h4>\n<p>One final note.\u00a0 We always get asked &#8220;What length of password should I use?&#8221; and it is a difficult question to answer.\u00a0 For passwords that are stored in your password manager, you may as well use as long a password as is allowed.\u00a0 30 characters is likely a good number to try first (and this gives you an extremely strong password).\u00a0 For passphrases that you need to type in, you need to balance security with convenience.\u00a0 The more words, the more security, but the longer it takes to type in.\u00a0 So consider how often you need to type in this passphrase.\u00a0 For the passphrase to encrypt your computer or external hard drives, that you are likely not typing in very often (perhaps once a week), then try starting with 7 words.\u00a0 For the passphrase to encrypt your password manager, which you might type in more frequently, you may not be willing to use 7 words.\u00a0 For the passphrase you use to turn off your screensaver, you may only be willing to type in 3 or 4 words.\u00a0 Start with as secure practices that you are willing to try and see how it goes, and only adjust as you need to so that you aren&#8217;t frustrating yourself.\u00a0 <em>Note that &#8220;password strength&#8221; meters may erroneously judge a passphrase of many plain English words to be weak, because these meters are looking for passwords of the form <code>Tr0ub4dor&amp;3<\/code> instead of <code>correct horse battery staple<\/code>; see above.<\/em><\/p>\n<h4>2-factor authentication<\/h4>\n<p>This is where, in addition to entering a password to access an account, you must also enter an authentication code that is delivered to you via text, app on smartphone, or <a href=\"https:\/\/en.wikipedia.org\/wiki\/YubiKey\">app for a usb key<\/a>. To compromise your account, an adversary would need your password as well as your device that receives the authentication code.\u00a0 Beware though, that SMS text messages offer somewhat limited protection.\u00a0 Black Lives Matter activist Deray McKesson and Federal Trade Commission\u2019s top technologist Lorrie Cranor have seen unauthorized access to their accounts by way of adversaries <a href=\"https:\/\/www.wired.com\/2016\/06\/deray-twitter-hack-2-factor-isnt-enough\/\">gaining control of their mobile accounts<\/a>, thus defeating their 2-factor authentication setups.<\/p>","protected":false},"excerpt":{"rendered":"<p>If you do nothing else, use a password manager (keepassxc.org, lastpass.com, 1password.com) that is protected by a strong password &#8212; here&#8217;s a checklist and a zine to help you make one. At a minimum, we recommend: Using a different password for every account or login, so that if one account is compromised, only one account [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[12],"tags":[237,252],"class_list":["post-6410","post","type-post","status-publish","format-standard","hentry","category-blog","tag-fundamentals","tag-passwords"],"acf":[],"_links":{"self":[{"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/posts\/6410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/comments?post=6410"}],"version-history":[{"count":0,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/posts\/6410\/revisions"}],"wp:attachment":[{"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/media?parent=6410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/categories?post=6410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cldc.org\/hi\/wp-json\/wp\/v2\/tags?post=6410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}