How safe are password managers

@chrisbhoffman
Updated July 10, 2020, 1:15pm EDT

A password manager stores all your passwords and automatically fills them in your web browser and mobile apps. But is trusting an app with your passwords and storing them all in one place a smart idea?

Yes, yes, it is. We recommend everyone use a password manager, which is far superior to other ways of keeping track of your passwords. Here’s why they’re a safe choice.

Password Managers Are Safer Than the Alternative

A password manager stores your passwords in a secure vault, which you can unlock with a single master password—and, optionally, an extra two-factor authentication method to help keep everything extra secure.

Password managers let you use strong, unique passwords everywhere. This typically isn’t possible for most people—can you really remember unique, strong passwords for every website you use? Password managers can generate and remember passwords like E.wei3-uaF7TaW.vuJ_w.

If you don’t use a password manager to store your passwords, you probably can’t remember all the unique, strong passwords you would need to use. Most people end up reusing passwords on multiple websites—that’s the most dangerous thing, as a password database leak at once website means your accounts on another site are wide open. Someone just has to try signing in with the same email address and password combination from the breach.

You could try creating “unique” passwords yourself based on a pattern. For example, maybe your base password is [email protected]_. You could modify it based on the domain—for example, when signing into facebook, you could take the “f” and the “a” and make it [email protected] Repeat this for each account you use, and you have unique passwords you can remember yourself, right? Well, not really—your passwords are now predictable. And what happens when a website doesn’t allow special characters or limits you to a specific number of digits and your method doesn’t work?

With a password manager, you just have to create one strong password and remember it.

While you do have to place some trust in whatever password manager you choose, using a password manager is more secure than the alternatives. The password managers we recommend have never had their passwords compromised, but many people have gotten in trouble through reusing passwords. Exploiting those reused passwords is often how attackers “hack” accounts these days.

How Password Managers Secure Your Passwords

We—and many other sites—recommend 1Password and LastPass as our top picks. Both protect your password vault with strong encryption (AES-256, specifically), even while it’s stored in the cloud. While the passwords are on your PC, phone, or tablet, they’re protected with a “master password” you know that makes them unreadable by anyone without that password. On modern devices, you can also unlock your vault with biometric authentication—like Face ID or Touch ID on iPhones.

Both services say the master password never leaves your device, and they couldn’t access your passwords if they want—they have “zero knowledge” of your passwords. They’ve undergone third-party audits and code reviews. Neither has ever suffered a serious breach, and both are up-front and transparent about how they protect your data. See the 1Password and LastPass websites for more details.

Prefer doing it yourself? Open-source password managers like Bitwarden and KeePass also exist. You can use these open-source applications to store your password on your own devices or servers. For example, you could set up your own sync server for Bitwarden or manually sync a KeePass database between your devices. It will likely be more complex and more work—and the apps aren’t as user-friendly—but if you prefer open-source software, options are available.

Can You Trust Password Manager Companies?

Ultimately, you are placing some trust in the password-manager companies here. Sure, the companies promise to keep your passwords safe, but they could update their software to capture your passwords, or a massive security hole could open your passwords to attack. The companies are audited for security, but what if they turned bad?

Sure, that’s a risk. You trust your password manager like any other application you use. The same is true for any application on your PC or most browser extensions: They could spy on you and phone home, reporting your passwords, credit card numbers, and communications to someone else.

But that hasn’t happened yet. These are reputable companies in the business of security. It’s probably more dangerous to install random browser extensions—many of which get full access to everything that happens in your browser and could phone home with those details—than store your passwords in a password manager.

We Use Password Managers and Recommend Them

We follow our own advice and use password managers like 1Password and LastPass here at How-To Geek, too. The password managers built into browsers like Chrome and Apple’s Safari are getting better, but they just aren’t as powerful or fully featured yet.

On top of the safety, password managers offer many convenience benefits. You can easily share your passwords with a friend, family member, or coworker. You can automatically fill those passwords on mobile without typing them in—even on an iPhone or iPad. Password managers like 1Password and LastPass provide alerts if any of the passwords you’re using have been breached in an attack and recommend passwords you should change. It’s a big improvement over trying to keep track of all your passwords without any help.

Best Offline Password Managers – Today on SocialPositives.com, we are listing some of the best offline password managers for 2020.

What is a local password manager? Local Password managers mean Passwords are stored locally on your device with a master password.

Offline Password Managers 2020

Here we go with some of the best Local Password Managers of 2020.

1. KeePass Password Safe

KeePass Password Safe is an open-source password manager tool. It’s easy to use a password manager where you can put all your passwords in one database, which is locked with one master key or a key file. Here we go with some of the best KeePass features.

• Multiple User Keys
• Support of Password Groups
• Export To TXT, HTML, XML and CSV Files
• Import From Many File Formats
• Random Password Generator
• Multi-Language Support

2. 1Password

1Password is not an open-source Password manager but store Passwords locally. 1Password is not a free password manager but you can try their service for free.

You need to install 1Password on your Mac or PC then install browser extensions to start and use the service. Yes, 1Password has stored your Passwords on the local system and you are accessing the data’s through the browser plugins. Here we go with some of the best features of 1Password.

• Mac, Windows, iOS & Android
• Web access
• Offline access
• 1 GB storage space to save documents
• 365-day item history to Restore deleted items & passwords
• Securely share passwords & documents
• Permission control

3. Password Safe

Like KeePass, Password Safe works in an open-source platform allows you to safely and easily create a secured and encrypted user name/password list.

• Start your safe and simplified digital life
• Free open-source software
• Installs in minutes on Windows 7 and later
• Over 4 million downloads

4. LessPass

LessPass comes next into our list. LessPass computes a unique password using a site, log in and a master password. You don’t need to sync a password vault across every device because LessPass works offline. LessPsss is really worth to try because

• It is open-source and free to use
• It does not save your passwords into their database
• It does not need to sync your devices

5. Sticky Password

Sticky Password is another popular password manager comes with synchronization options including Wi-Fi syncing with local devices. There is also synchronization via our their own cloud servers only if you want. Sticky Password is free to use but the version doesn’t give major features like Cloud Sync Across Devices, Cloud Backup, Local Wi-Fi Sync Across Devices, etc.

Here we go with some of the major features of Sticky Password.

• Two-Factor Authentication
• Cloud Sync Across Devices
• Cloud Backup
• Local Wi-Fi Sync Across Devices
• Saving Endangered Manatees

These are our best local Password Managers worth to try in 2020. If we missed your favourite one, let us know through the comments.

Our independent reviews and recommendations are funded in part by affiliate commissions, at no extra cost to our readers. Click to Learn More

Password managers are a safe, secure way of logging into your various online accounts – in fact, they’re vastly preferable to the alternatives of either trying to remember multiple unique passwords, or re-using the same password over and over.

Given that even industry-leader LastPass was once the victim of the hack, it’s understandable that concerns remain over using password managers. Even so, we’d strongly recommend doing so.

Let’s be honest – passwords are a pain. Having to juggle multiple logins across multiple sites can be taxing, not to mention trying to remember which password is for which – especially with each password needing to be unique. Your passwords are unique, right? According to research, over half of us have up to 25 password protected accounts online. That’s a lot. The solution to your password woes is a password manager. These handy apps automatically store all your logins, meaning that you’ll never have to remember one ever again. Not only that, but they can generate secure passwords for you, and some will even alert you should your details be compromised.

Sounds great, but you’re probably wondering about the wisdom of storing all your passwords in one place. It’s a legitimate concern to have, but research has shown that using a password manager is far more secure than not using one. With cases of these services being hacked being extremely rare, there’s little reason not to use one.

As for which password manager you should choose? We’ve tested some of the best password managers around, and while they’re all safe and secure, the best on test was 1Password. This stands out thanks to a simple interface, secure setup, and brilliant family sharing options. Plus, you can try 1Password for free to see if you like it.

If you’re still using your dog’s name to log in to your bank, you are courting disaster.

Freelance contributor, PCWorld |

Today’s Best Tech Deals

Picked by PCWorld’s Editors

Top Deals On Great Products

Picked by Techconnect’s Editors

We are terrible at passwords. We suck at creating them (the top two most popular remain “123456” and “password”), we share them way too freely, and we forget them all the time. Indeed, the very thing that can ensure our online security has become our biggest obstacle to it. This is what makes a good password manager essential.

A password manager relieves the burden of thinking up and memorizing unique, complex logins—the hallmark of a secure password. It allows you to safely share those logins with others when necessary. And because these tools encrypt your login info in a virtual vault—either locally or in the cloud—and lock it with a single master password, they protect the passwords themselves. If you’re looking to up your security game, a password manager is the way to go.

But password managers vary widely in their capabilities and cost, so we compared several of the most popular. All support Windows Mac OS, Android, and iOS, as well as the major browsers. And all will let you sync your data across multiple devices, though you may have pay extra for the privilege.

Here are our top two picks, followed by tips on what to look for when shopping for a password manager and links to full reviews of all the products.

Updated 5/28/20 to include our review of Trend Micro’s Password Manager, a product that’s as basic as its name. We can appreciate a product that sticks to a narrow mission but does it perfectly—unfortunately Password Manager makes a few missteps. Scroll to the bottom of this article for links to all of our password manager reviews.

Best overall password manager

LastPass offers all the features you need in a password manager at an affordable price.

LastPass ticks all the boxes on our password manager want list. It makes it a breeze to create unique, complex passwords; capture and manage login credentials; sync them across multiple devices; and share them with others you trust. Its password auditing and updating features let you identify and eliminate weak or duplicate passwords with just a mouse click or two. It also stores credit card numbers and other personal data to autofill web forms when you’re making a purchase, signing up for a service, or paying a bill.

LastPass also supports a range of multi-factor authentication options for protecting your vault, including app-based authenticators like Symantec VIP and Google Authenticator, hardware tokens like YubiKey, and fingerprint readers.

Runner-up

With its strong password analysis and polished interface, Dashlane is one of the best password managers available.

Dashlane is the strongest contender for LastPass’s crown. It has a beautiful interface, is easy to use, and is stocked with features to help you strengthen your online security. Chief among these is a stellar security dashboard that grades your passwords and suggests actions for boosting your score and your protection. Dashlane is free for a single device, but if you want syncing across multiple devices you’ll need a Premium plan, which has a $60 price tag—the highest in our roundup. This is the only thing that slightly dampens are enthusiasm for this fantastic password manager.

What to look for in a password manager

At their most basic, password managers capture your username and password—usually via a browser plugin—when you log in to a website, and then automatically fill in your credentials when you return to that site. They store all your passwords in an encrypted database, often referred to as a “vault,” which you protect with a single master password.

Of course, most password managers do much more than this and many extend protection beyond your login credentials to other types of personal data. We narrowed it down to a few essential features that we looked for and you should too:

• Password generation: You’ve been reminded ad nauseam that the strongest passwords are long, random strings of characters, and that you should use a different one for each site you access. That’s a tall order. This is what makes password generation—the ability to create complex passwords out of letters, numbers, and special characters—an indispensable feature of any good password manager. The best password managers will also be able to analyze your existing passwords for weaknesses and upgrade them with a click.
• Autofill and auto-login: Most password managers can autofill your login credentials whenever you visit a site and even log you in automatically. Thus, the master password is the only one you ever have to enter. This is controversial, though, as browser autofill has long been a security concern, so the best managers will also let you toggle off this feature if you feel the risk outweighs the convenience.
• Secure sharing: Sometimes you need to share a password with a family member or coworker. A password manager should let you do so without compromising your security.
• Two-factor authentication: To an enterprising cybercriminal, your password manager’s master password is as hackable as any other password. Increasingly, password managers support multi-factor authentication—using a second method such as a PIN, a fingerprint, or another “trusted device” for additional verification—to mitigate this risk. Choose one that does.
• Protection for other personal data: Because of how frequently we use them online, credit card and bank account numbers, our addresses, and other personal data can be securely stored in many password managers and automatically filled into web forms when we’re shopping or registering an account.

No online security measure is 100 percent foolproof, though, as we were reminded when LastPass, one of the most reputable password managers, recently scrambled to fix a pair of vulnerabilities that could have compromised users’ passwords and their computers. And just last month, OneLogin was victim of a breach that compromised customer data, including the ability to decrypt data.

Still, most security experts agree that password managers are still the safest way for people to manage their myriad logins, and we agree that the benefits far outweigh the risks. Just choose your password manager carefully after researching all the options starting with the guide.

All of our reviews

If you’re curious to see what other options exist outside our top picks, we’ve listed them all below. We’ve started with six password managers to kick off our guide, but we’ll continue to evaluate more as time goes on—as well as re-evaluate services we’ve already reviewed.

Editor’s note: Because online services are often iterative, gaining new features and performance improvements over time, our reviews are subject to change in order to accurately reflect the current state of the services.

@chrisbhoffman
Updated July 10, 2020, 1:06pm EDT

We recommend using a password manager like 1Password, LastPass, or Bitwarden. But modern web browsers have built-in password managers, so why install a different one? There are many good reasons to avoid your web browser’s built-in tool.

Why You Need a Password Manager

Using a password manager is crucial. The biggest risk to your accounts online is password re-use. If you use the same passwords over and over, a breach at one website means your email and password is out there. Attackers will try to use that email and password to log into other sites. This simple trick is how accounts are often “hacked” these days.

The solution is using strong, unique passwords everywhere. But who can remember hundreds or even dozens of strong passwords? A password manager can remember if for you. You remember your password manager’s master password, which unlocks your secure vault. Your password manager can randomly generate strong passwords, remember them for you, and log you into websites with them.

1Password, LastPass, Bitwarden, and Dashlane are all reliable, stand-alone password managers. The open-source KeePass is okay, too, but it doesn’t have built-in sync features.

Web browsers have been able to remember your passwords for many years, but their password managers are now getting more sophisticated. Still, we recommend skipping the password manager built into your web browser—whether that’s Chrome, Firefox, Safari, or Edge—and using a dedicated password manager.

Your Web Browser’s Password Manager Is Just Okay

Your web browser’s password manager is better than nothing. With no additional software, your web browser can remember all your passwords and securely sync them between your devices. They can be stored encrypted in the cloud. You can use strong, hard-to-remember passwords because your software is automatically remembering them for you. This keeps your accounts secure, as you won’t need to re-use passwords.

The account it’s synced with—like your Google account in Chrome or your Apple ID in Safari—can be protected with two-step authentication to prevent people from signing in.

But there are some problems. Built-in password managers in web browsers aren’t as powerful and useful as third-party password managers. They are catching up, but they’re not as good yet. Here’s why.

Beyond Just One Browser

Third-party password managers are cross-platform and cross-browser. Built-in browser password managers are limited to that specific browser. Let’s say you use Google Chrome on your PC or Mac and Safari on your iPhone. If you use a third-party password manager, you can have your passwords in any browser. If you use a built-in web browser password manager, you can’t mix and match browsers.

Beyond that, password managers offer good desktop and mobile applications, making it easy to access passwords, license keys, Wi-Fi codes, and anything else you want to store everywhere.

Generating Passwords

Third-party password managers don’t just remember your existing passwords—they can automatically generate strong new ones when you’re creating an account or changing an existing account’s passwords.

Some browsers are now adding built-in password generators—Chrome and Safari now have this feature—but they don’t necessarily offer all the options found in password managers, such as the ability to control how long the password is and what type of characters it contains.

Easily Sharing Passwords

Password managers have easy password-sharing features. Want to share your Netflix password with your family members? You can do it with a password manager with a built-in sharing feature. You’ll all get access to the same password entry and, if you update the password, it’ll change for everyone else.

Browsers don’t have built-in password-sharing features. You can send a password to someone else in a text message or email, which isn’t very secure. If you do that, it also won’t be automatically updated if you ever have to change it. Password-sharing features are a great way to share household accounts.

Warnings About Password Dangers

Password managers have built-in warnings like LastPass’s Security Challenge and 1Password’s WatchTower. They’ll point out weak and reused passwords to you and even tell you when a password you use has appeared in a leaked password database. This helps you stay up-to-date on protecting your digital accounts. There’s no need for a separate service to check whether your password has been stolen.

Web browsers are slowly getting features like these, too—Google has a password-checker in its password manager. Google also offers the Password Checkup extension for Chrome, which it’s building into the browser, but this isn’t as powerful as the similar features built into password managers.

Storing More Than Passwords

Password managers let you store more than just passwords. For example, you can create secure notes containing text like building entry codes and Wi-Fi passphrases. You can even add file attachments to your vault, which makes it a great place to store tax documents, scanned copies of your passport and driver’s license, and other sensitive information.

To store files like these securely, you might find yourself creating encrypted archive files and uploading them to a cloud storage service. Taking advantage of your password manager’s vault is more convenient.

This works nicely with sharing, too—you can store all sorts of sensitive information and documents and share them with anyone else who needs access.

Making the Switch Is Easy

We’re happy web browser password managers are getting more powerful, but they aren’t competitive with the more powerful password managers just yet.

If this has convinced you and you’re currently using your web browser’s password manager, don’t worry—you can switch to a password manager and import all your usernames and passwords from your web browser’s built-in password manager. The password manager you choose will walk you through the import process.

Are Password Managers Safe?

Storing all your passwords in a single program may seem a little odd—weren’t you supposed to remember all these things?—but we (and many other experts) argue it’s safer than the alternative. Here’s why you should trust password managers.

When your security needs more security.

Today’s Best Tech Deals

Picked by PCWorld’s Editors

Top Deals On Great Products

Picked by Techconnect’s Editors

In a world where we’re being told to change our passwords every five minutes thanks to the latest massive breach, it’s hard to imagine life without a password manager. Though now that these killer apps are a dime a dozen, the market has predictably been flooded with options you should think twice about using.

Once you’ve started using a password manager, you realize just how absolutely insane things have gotten that we’d be expected to not only remember a jillion passwords, but also be able to spontaneously make up words and phrases that follow all the different and bizarre password-creation rules that sites require of us.

If you’re reading this and not using a password manager, keep reading. You’re in a high-risk category for getting hacked and exploited. Even if you’re already utilizing the best consumer tool for computer security since antivirus, you should also keep reading—because not all password managers are created equal.

If you’re unfamiliar, a password manager is an app that remembers your passwords for you and stores them in an encrypted vault. One master password unlocks the vault when you need to retrieve a password or create a new one, and does it without anyone being able to read what you type over your shoulder or track the login with a keylogger.

1Password: All you need to remember is a single master password, which will unlock a vault that holds all your other passwords.

For those of us who’ve long known about the risks of allowing a browser or operating system to remember and autofill password fields, trusting a password manager doesn’t come easily. But the attack surface is significantly minimized with a manager, and the encryption on top seals the deal.

A manager usually has other nifty features too, like helping you search for (and change) duplicated passwords. One common way people get their social media and email accounts hacked is when malicious hackers comb through old breach dumps online, grab the logins and passwords, and then try them on your current accounts in the hopes that you’ve reused the password since.

LastPass: Additional features, like a duplicate-password tool, can bolster your online security.

The 2012 LinkedIn breach dump has been a hacker gold mine for five years, with news items still cropping up in 2017 about individuals and businesses who didn’t change their LinkedIn passwords after the breach and then had other accounts hijacked. It’s embarrassing, and worse.

Password managers also give users a way to automatically create new, long, complex passwords that follow all the crazy rules sites make for us: things like including upper- and lowercase letters, numbers, symbols, and a given number characters.

But like I said, not all of these cool tools are as secure as you’d think. Choosing the right one is critical when you’re keeping all your password eggs in one basket.

For a couple weeks in a row, leading password manager LastPass was schooled by a security researcher at Google, which found multiple flaws that put its users at risk. One was a “major architectural problem” that could’ve given attackers access to people’s passwords. The researcher published his findings, and while LastPass was worryingly quiet about dealing with its problems, the public scrutiny forced the company to act fast in fixing its service. Still, not everyone is convinced that LastPass has brought its service up to snuff.

It goes to show that even the most reputable password manager, like any other company, can have problems. And LastPass isn’t alone in falling under the scrutiny of Google’s security team. Keeper, Dashlane, and even 1Password have had bugs found and outed over the past year.

1Password: A password manager can also provide an easy and secure way to register for various online accounts.

The harsh attention on password managers might be because the next version of Android, called “O”, is going to officially (and efficiently) support password managers.

That’s because despite issues of bugs and a market flooded with good and bad choices, security experts agree—a rarity—that password managers are the safest way for people to manage their accounts. The security benefits far outweigh the risks. So choosing carefully is key.

Research password managers individually before you settle on one. Search their names with words like “hacked” and look for their names in news articles. Search Twitter to see what the infosec community might have to say about them. Pay attention to which managers are used by hackers and researchers, and which ones they don’t like. An absence of recommendations or reviews is as much a negative as stories about flaws that didn’t get patched.

A company’s response to uncovered flaws is also telling: Was the company accountable and quick to remediate, or did it go silent? Did it act only when caught, or did it promptly inform customers about an incident or flaw?

When all is said and done, some of the most highly regarded password managers include KeePass, 1Password, and Dashlane.

Despite its past product flaws, I, like other hackers and security nerds, use 1Password. I understand the technology, the attacks, and the product sector—and I was really satisfied with the way 1Password handled their bugs and PR.

And believe me: I spend a lot of time watching these companies screw up.

10 essential mobile security tips

Read this practical guide to learn about the biggest security threats affecting mobile devices today and how you can protect your data.

Published Sep 29, 2020 By: Mark Stone

As we all spend more and more time online, we inevitably create more and more accounts to log into apps, websites, subscription services and resources. And as these account credentials pile up, we need a secure way to remember and manage all the associated passwords.

How many people have sticky notes placed in secret locations around their desks, in their wallets and in their homes? It’s no wonder: According to a 2019 LastPass survey, in the U.S., employees at an average midsize company must manage about 75 passwords for work. The same study reports that employees reuse their passwords an average of 13 times.

When you have a ton of passwords to remember, their quality tends to diminish. Simple passwords are easy to crack. And if the account you’re protecting with an easily hacked password contains valuable data or assets, the ramifications can be severe. In 2019, the average cost of a company data breach was almost $4 million.

Essentially, passwords are a static secret, and as malware and security breaches proliferate, stealing passwords is an easy way for hackers to get what they want. Once a password is stolen, the hacker gains whatever access is assigned to the account. If it’s something as sensitive as your bank account, the damage can be significant.

When it comes to passwords, the more complex the better. And with a good password management system, you only need to remember one.

Password managers: How safe are they?

A password management service lets you generate complex, unique passwords for each of your accounts and keeps track of all your passwords for you, with one master password that unlocks your “vault.”

The mobile security top 10

Get your free guide to better securing the personal and work data on your mobile phone. Download Now

As long as you’re logged into the password manager with your master password, it will automatically fill in your passwords, sometimes using biometric authentication to verify your identity. But, remember, if a hacker compromises your master password, they get full access to all of your accounts.

While there is still some risk associated with master passwords, password managers make keeping up with good password practices much easier and reduce your potential exposure to cybercrime. The average hacker looks for the easiest targets. Using a password manager to store all your passwords in one vault isn’t foolproof, but it improves your overall online safety significantly.

Best practices are still essential

Using a password manager doesn’t mean you can neglect proper security hygiene. Especially when it comes to your master password, you’ll need to choose a phrase — not just a word — that’s difficult to guess or hack. It’s critical that your master password is more of a passphrase — or even pass sentence — that contains a mix of letters, numbers and special characters. One solution is to string together a few unrelated words and mix in a few characters. Never use your master password with another account — many password manager help to flag duplicate usage.

Most of today’s password management solutions offer some form of multifactor authentication (MFA). With MFA, you need two or more credentials to successfully log in: something you know (like a password), something you have (like a token) or something you are (like a biometric face scan or fingerprint).

Experts agree that MFA benefits both employees and IT departments, as it bolsters security and users don’t have to worry about remembering all their work passwords.

Password management, simplified

A password management system is an attractive solution for its functionality and for its low cost. Many password managers on the market have a free version and a full version, which come with different features at different prices. For many people, it makes sense to sign up for the full versions for their added benefits and low monthly cost. They can also save you a lot of time from resetting passwords that you’ve forgotten.

One great free alternative is Samsung Pass, which comes on the latest Galaxy smartphones and tablets. Samsung Pass is a service that lets you save your usernames and passwords for apps and websites, and instantly sign in with your fingerprint or via facial recognition. The master password for Samsung Pass is built around your Samsung account. If you just switched to a Galaxy smartphone, activating Samsung Pass is one of the first things you’ll want to do to get your new device set up.

For more tips on securing data on your smartphone, download this free white paper. And learn more about enhancing security with biometric authentication.

Mark Stone

Mark Stone is a content marketing writer with over a decade of experience covering technology, business, and cybersecurity. Earlier in his career, he was a cybersecurity analyst in the public sector. He is a regular contributor to Forbes BrandVoice and helps large tech companies with thought leadership. He lives in Kelowna, BC with his wife and two black cats.

• Data Privacy
• samsung pass
• Tech Tips

Share This

Related Posts

Connecting Heroes program helps Bay Minette PD expand smartphone capabilities

Connecting Heroes gives law enforcement agencies a budget-friendly opportunity to gain connected-officer capability.

Knox Capture transforms Samsung’s rugged devices into enterprise-grade scanners

Samsung is responding to the needs of businesses by adding scanning capabilities to their rugged mobile devices with Knox Capture.

How to create dynamic video for your business’s social media

The Galaxy Note20’s video effects can help you create more professional, more diverse — and therefore more engaging — content.

Copyright © 1995-2020 SAMSUNG All rights reserved.

Posts on this site reflect the personal views of each author and do not necessarily represent the views and opinions of Samsung Electronics America. Regular contributors may be compensated for their time and expertise.

A major issue is affecting password managers such as 1Password, Dashlane, KeePass and LastPass. But . [+] the services are still far better than using weak passwords.

Password managers are great. They combine security with convenience by storing all your credentials in one place, allowing you to use strong, complex passwords that you don’t have to remember.

But password managers themselves need to be super secure. Of course, if they are hacked, all your passwords are there for attackers to see – and that would be a disaster.

So major password manager firms will be feeling the heat today after a report from Independent Security Evaluators (ISE) found fundamental flaws that expose user credentials in computer memory while locked. According to the researchers, this renders them “no more secure than saving passwords in a text file”.

The ISE evaluated 1Password, Dashlane, KeePass and LastPass, which are used by a total of 60 Million users and 93,000 Businesses globally. It found that all the products failed to provide the security to safeguard a user’s passwords “as advertised”.

The study looked at the underlying functionality of these products on Windows 10 to understand how users’ secrets are stored even when the password manager is locked.

You would, naturally, think the password manager was safe when locked, but it’s not, according to the ISE. Worryingly, the researchers found that in some circumstances, the master password was residing in the computer’s memory in a plain text readable format. And once the master password is available to the attacker, they can decrypt the password manager database.

As the ISE points out, this is no safer than storing it in a document or on the desktop; something that certainly isn’t advised.

“Given the huge user base of people already using password managers, these vulnerabilities will entice hackers to target and steal data from these computers via malware attacks,” says ISE lead researcher, Adrian Bednarek.

Should you stop using your password manager?

It’s all well and good to call out problems with password managers, but what should you use instead? First, do not throw away your service just yet: even the ISE recommends that you keep using password managers, just follow a few simple steps.

Crucially, you should not leave a password manager running in the background, even in a locked state. Meanwhile, terminate the process completely if you are using one of the affected password managers.

And how serious is it? For this attack to pay off, the hacker would need access to the RAM. This would require either physical access or remote access into the victim’s machine.

Stealing master passwords still may not be effective for hackers, says Jake Moore, cyber security expert at ESET. This is because setting up most managers requires two factor authentication on any new device, which “talks” to the server where the stored passwords are held.

At the same time, he says, if you use a password manager on your smartphone, you will be far better protected as this attack focuses primarily on computer RAM. “Plus, if you attach an authenticator application, such as Authy or Google Authenticator, to the password, your accounts will remain far safer,” he advises. “As long as people are not committing the cardinal sin of reusing passwords and can recognise password managers as a security measure rather than a vulnerability, we will all be far safer in no time.”

Emmanuel Schalit, CEO, Dashlane – one of the affected password managers – points out that the ISE findings cover “a very standard theoretical scenario in the world of security”. And he says: “This is not limited to Windows 10 but applies to any operating system and digital device connected to the internet.”

Schalit is also keen to point out that data stored by Dashlane on the device is encrypted and cannot be read by an attacker even if they have full control. “This only applies to the data present in the memory of the device when Dashlane is being used by a person who has typed the master password.”

Schalit says Dashlane is working on improving over the long term and adds: “We respectfully disagree with the researcher’s claim that this can be truly fixed by Dashlane, or anyone for that matter. Once the operating system or device is compromised, an attacker will end up having access to anything on the device and there is no way to effectively prevent it. There are solutions that amount to ‘putting the information under the rug’ but any attacker sufficiently sophisticated enough to remotely take control of the user’s device would go around these solutions very easily.”

So please don’t stop using your password manager just yet. Just ensure you close the service completely when not using it and set up two-factor authentication for extra protection.

Security researchers from Independent Security Evaluators (ISE) have recently found vulnerabilities in password managers – we take a look at the potential risks

Share this page

Researchers at US security specialists ISE have declared that popular password managers have vulnerabilities that could allow hackers to gain access to your passwords. The news caused alarm as millions of people now use these services to store their online passwords.

The ISE specialists discovered that popular services 1Password, KeePass, LastPass, and Dashline all have vulnerabilities that would potentially allow malicious software on a Windows machine to steal either the master password or individual passwords stored by the applications.

Should you be concerned, and are password managers still safe to use? We take a look at the risks.

Antivirus software is important to keep your computer free from all types of threats. Browse our antivirus software reviews to see which packages come out on top.

Is there a risk to using a password manager?

The researchers found that each of the four password managers left passwords accessible in the computer’s memory.

But in reality, to peer into your PC’s memory, a hacker would likely either need to be sitting at your computer or trick you into installing malware that has control over your computer.

This sort of activity is unlikely. Instead hackers typically tend to try to hack companies so they can acquire a mass of data rather than spending time trying to go after individuals. Or they look for easy targets, such as people that have weak passwords, or poor protection.

The bottom line is – using a good antivirus package should always be the first line of defence against any type of threat.

1Password’s Jeffrey Goldberg explained:

‘The realistic threat from this issue is limited. An attacker who is in a position to exploit this information in memory is already in a very powerful position. No password manager (or anything else) can promise to run securely on a compromised computer.’

Should I stop using a password manager?

Password managers are important tools that keep us safe online. Not only do they enable us to keep track of the multiple passwords that we need, they also help us to avoid bad practices such as using weak or common passwords.

And the researchers at ISE agreed, concluding, that:

‘Password managers are a good thing. All password managers we have examined add value to the security posture of secrets management.’

How to choose a good password manager

Although this new report is somewhat alarming, it’s still good practice to use a password manager – and if you don’t already you should consider doing so.

We’ve put a range of the most popular password managers through rigorous tests to see how easy they are to use and how effectively they safeguard your online security. Our tests include setting up and using the password managers on a computer (both PC and Mac), as well as on an Android or Apple iOS mobile device (including the app and mobile web interface).

Make sure you select a Best Buy password manager and avoid a Don’t Buy, whether you choose to opt for a free or premium service.

But there are also a number of other things you can do to boost your online security.

Three simple steps to boost your online security against hackers

The key thing is to protect your personal computing devices. There’s no point worrying about potential vulnerabilities in password managers if you leave your computer wide open to abuse.

So take these simple steps:

1. Keep all your software up to date. New versions often contain important security patches.
2. Be very careful about installing software that comes from third parties other than Microsoft, Apple and Google-managed app stores.
3. Say no to web-browser extensions and pop-up messages – these are often not what they seem.
4. And of course, use good antivirus software to keep your computer free from threats.

Viruses and malware can infect your computer in several ways, but Best Buy antivirus software will give you peace of mind that your computer and personal data are safe.

Every day, we hunt for the worst malware in the world to test antivirus packages. Each package is bombarded with more than 10,000 samples of new malware, including more than 700 samples of ransomware, in online and offline tests.

All free antivirus packages offer the same basic underlying malware protection as their paid rivals, but differences come in the additional elements. For example, paid antivirus software can offer a more effective defense against phishing, and protect more than one device.

Find out more about antivirus software in our how to buy the best antivirus software guide.

Password managers are the most recommended tool by security experts to protect your online credentials from hackers. But many people are still hesitant to use them. Here’s why password managers are safe, secure and your best defense against password-hungry cyber criminals.

What is a password manager?

Think of it like a safe for your passwords. When you need something inside the safe, you unlock it. Password managers work the same for your online credentials.

You create a single, super-strong password, which acts like a key. Install the password manager app on your phone, computer, browser and other devices. Your passwords are securely stored inside it. Anytime you need to log in to an account, unlock your password manager and retrieve your login info.

Myth 1: Password managers aren’t safe or trustworthy

With website vulnerabilities and security incidents on the rise, some people are wary of trusting a tech tool to manage their passwords. What if the password manager gets hacked? Reputable password managers take extra steps to lock down your info and keep it safe from cyber criminals.

A good password manager:

• Doesn’t know your primary password (so hackers can never steal it)
• Only stores encrypted versions of your credentials and data on their servers
• Can generate strong, secure passwords

Myth 2: Password managers aren’t 100% secure, so I shouldn’t use one

No tool can completely guarantee your online safety. Even the most elaborate lock can be broken into. Yet we still lock our doors to our houses and cars.

The alternative to using a password manager is to rely on your own memory to remember all your credentials — or worse yet — writing them down. This inevitably leads to recycling passwords or using variations — a bad habit that hackers love.

Password managers can be such an effective security tool because they help us improve bad habits. With a password manager installed on your computer and phone, it’s a lot easier to take your logins everywhere so you can use unique, strong passwords on every account.

Myth 3: Storing all my passwords in one place makes them vulnerable to hackers

Depending on the password manager, your passwords could be stored on your local computer or on a remote server run by the password manager. Any data you store in a trustworthy password manager — passwords, logins, security questions and other sensitive info — will be securely encrypted.

The only way to access your data is with a single primary password that only you know. You use this password to unlock the manager on your computer, phone or other devices. Once it’s unlocked, a password manager can fill in your logins to websites and apps. It’s important that your primary password be strong and unique.

Myth 4: Remembering all my passwords is safer than trusting technology to do it for me

Our memories sometimes fail us. Ever clicked a “forgot password?” link? It’s very common to use variations of the same password to make them easier to remember. With a password manager, you don’t need to remember any of your credentials. It can be installed on all your devices and will auto-fill your passwords for you. Once you get in the habit of using one, you’ll no longer have to worry about forgetting your credentials.

Myth 5: It’s a huge pain to set up a password manager

Sure, it takes time to log all your credentials in a password manager, but you don’t need to do it all at once. You can always start small and change just a few passwords at a time. Try installing a password manager and creating new, unique passwords for the websites you visit most frequently. Over time, as you log in to other sites, you can add others.

Firefox Lockwise is an app for iOS and Android that gives you access to passwords you’ve saved to Firefox. It works by syncing logins from the browser to the app, allowing you to take your login info with you. To get started, sign into Firefox account on your computer (start here if you don’t have one), then sign into Lockwise on your device and sync your logins.