Dangers of Digital Keychains

[@JoshChristiane]

Be my friend on X at: x.com/Josh_Christiane

[@JoshChristiane]

For those that continue to comment that "writing passwords on paper is bad advice", I want to make a contextualized case for why that is incorrect. Firstly I'd like to mention that nuclear launch codes are the most protected and important pieces of data/codes in the world, and they are stored hard-printed on a physical sheet of plastic-paper. They are also stored digitally, encrypted, on a server that can only be accessed by a few people and is completely disconnected from the internet in every way possible. Both of these methods are safe enough assuming you go to the correct lengths to protect that data. By writing down your passwords in a notebook and then storing that notebook in a fire and water proof bag in a safe (that's preferably hidden in your home) you are disconnecting your passwords from the IoT entirely. This means your passwords cannot be hacked, leaked, digitally stolen, or decrypted. This also removes the necessity of a master password, which is an inherent risk due to keylogging events/software on your PC. The vast majority of accounts that are hacked come from a remote location, not local in that person's home, and are usually the result of a phishing scheme of some sort. While it is possible a thief could break into your home, find your safe, break into it, and steal your passwords inside... This is unlikely as thieves are generally only interested in cash, jewelry or things they can easily fence. While this method still presents natural risks, I believe those risks are far less concerning or likely than digital theft or leaks. Many password managers have been hacked, and their customer data leaked (including passwords). While most password managers do encrypt that data, it's still possible for the hackers to delete all of their server data, possibly causing you to lose access to all of your passwords. This is especially true if the company controlling the password managers servers did not do their due diligence to cold-storage backup those encrypted files. Even if they are backed up they are still at risk of loss if there is a bad actor within the organization that maliciously deletes or steals data for ransom. There is no perfect method to store passwords as in the end they must connect through public portals. However, I do believe that storing your passwords on paper or on a USB flash drive that's encrypted, then storing it in a safe is the safest method. You may also considering SALTing your passwords with a master pre-phase to protect your data even further. Thanks for reading, and watching!

[@annives]

Absolutely agreed, good post.

[@Tldrx]

I agree with you partially, putting all eggs in one place is quite risky, but it is so convenient to use the password by just using fingerprint or face. If everything online can be hacked, key logged, it really doesn't matter whether you use a digital password manager or not. Even you write your passwords on paper, at one point, you will need to actually use it online.

[@JoshChristiane]

You're completely right. There almost is no truly good solution. Anybody who figures this out is going to be very rich.

[@callmeNeno]

Love 1Password & conjunction with Yubikey.

[@JoshChristiane]

Yeah absolutely! Me too.

[@toondesmarets3033]

you are not at all consistent with your video!

[@lorenzoskyhawk]

Unfortunately the Internet has destroyed peace of mind.... we store so much useless information and worry.

[@JoshChristiane]

I completely agree. IoT makes life much less secure, despite the conveniences.

[@CERAC...]

Situational awareness of these simple safety precautions goes without saying. Unfortunately not always heeded by many.... Thanks for reminding us

[@ChimpRiot]

Definitely something to consider. Although a hidden keylogger could also probably get access to your 1Password or other password manager the moment your unlocked it. Be careful what you download!

[@JoshChristiane]

Very true... Always have to be weary and watching your accounts.

[@timhershel2940]

Except with iCloud there really isn't a single point of failure. The data can only be decrypted by your specific device secure element + your device passcode. You need both of those things. Storing the password on a piece of paper is. Once someone has it that is it. They have everything. A keylooger attack or phishing attack would happen regardless whether or not you use a password manager. It has nothing to do with storing the passwords in the cloud. So I don't understand why that is a reason for not using a password manager.

[@JoshChristiane]

You make some good points. My perspective is that there are a few points of failure (or disaster) with cloud storage of passwords. The first is that if somebody were to hack into the network or system where the actual data is stored, EVEN if they can't decrypt it or read the passwords, they can still delete them or hold them ransom for pay. This has actually happened twice to two major cloud storage services, and people lost EVERY password they have to every account, which can make it difficult to recover many of them. The next point of major failure is if you lose access to your master password or authentication (like losing a phone number for 2FA) to that pool of data. Then the third is if somebody hijacks your phone number (assuming it's 2FA again) then they gain access to everything in one single hack. Storing all of your data in one place is never really that safe, digitally or on paper. Storing them on paper is probably a bad idea, but it could be done relatively safely especially if you SALT the passwords and if you had a hidden safe that's water and fire proof for example. Technically that will still be far safer than a single pool connected to IOT. None of these things are facts, just my opinion based on research.

[@fearless6947]

@@JoshChristiane what do you think of passkeys?

[@JoshChristiane]

I have never heard of any issues with them. I'd check to see if they've had any leaks nationally or otherwise.

[@alexandradyachenko9674]

very useful and informative channel, you are great, you tell everything very clearly and accessible

[@JoshChristiane]

I appreciate the comment, I'm just doing my best, thanks!

[@givenfool6169]

Ive been trying to set my family members up with password managers recently. Specifically my parents and my grandparents. My parents are gen X so theyre a bit more saavy with tech. But my grandparents are boomers and have trouble with these advanced things on the web. Theyre not clueless, but in their old age, people get easier to fool and maybe get careless. Ive considered setting them up with bitwarden only on their phone and use biometric authentication pin for it. I dont want it on their computers just in case, even though it will be less convenient. I just want my family to be secure and actually know their passwords for once and not reuse them either.

[@JoshChristiane]

Bitwarden in my experience is the best of the options. The only thing you have to be exceedingly careful about with these password managers is if you were to get a virus/rootkit/keylogger on your phone. A lot of mobile operating systems are even more susceptible to these types of viruses than desktop computer are. If somebody were to keylog your computer or your phone then they'd know the central password to your password manager, thus giving them immediate access to every account you have. Bitwarden is completely safe to use, just be sure you keep your phones and other devices that its used on very secure and safe.

[@givenfool6169]

@@JoshChristiane Oh man. I was thinking the phone OS's were less susceptible due to the app store lock down.

[@JoshChristiane]

That's what you'd think, but unfortunately that's security theatre. The app store(s) are locked down to make Apple/Google more money, not to protect you. Many MANY dangerous and virus infected apps have gotten through, plenty of testing and experiments have been done to prove that. And that's just the apps... Not to mention the open exposure phones have to the web through their browsers.

[@fearless6947]

I think the best way for old people, is write in a notebook. They might create weak passwords and not know how to use the yubikey

[@JoshChristiane]

I think a notebook then protected in a safe or something that's hidden is probably still technically one of the safer ways to manage passwords despite people all claiming that "writing it down" is bad. Writing it down is local, writing it anywhere connected to a cloud leaves you a lot more exposed.

[@tracyaoki3147]

How do I get rid of the annoying pop up for the local items keychain password?

[@JoshChristiane]

Don't have quite enough info to answer that, are you talking about on mobile or desktop? And which OS?

[@ЯнаНевмержицкая-я4щ]

Very cool video. Clearly explained! Nice man and cool channel! I recommend to everyone!

[@JoshChristiane]

Much appreciated! Have a lovely night!

[@danielmohamady2615]

I like your channel very much

[@donniecarrascosr.9912]

By the way, A couple of weeks ago I had a notice of a password leak/breach. I did have several emails that had the same password, I think that it was better that I had independent separate passwords for each account. So I did change passwords around but in the back of my mind, I didn’t know if this was a scam? I haven’t heard anything since.

[@JoshChristiane]

Definitely a good idea to keep every password for every account different. I highly recommend that. Glad you haven't been hacked.

[@jenniferpalacios2143]

Siempre tan lindo 😊... No entiendo nada , pero me gusto verte por aquí 🤩

[@JoshChristiane]

Lo siento, supongo que necesito aprender español.

[@bohobohorkez3524]

TOTALLY AGREE WITH YOU!

[@JoshChristiane]

Thanks for the view!

[@danielmohamady2615]

I love your channel

[@sefikkurt5133]

Awesome video!

[@JoshChristiane]

Thanks! Glad you enjoyed it.

[@nathanzebedee5263]

your content is awesome

[@JoshChristiane]

Thank you so much! I'm glad you're watching it!!

[@denisbublikvevo8377]

Wish I heard this sooner

[@JoshChristiane]

Thanks for watching.

[@aurayt951]

Excellent work

[@JoshChristiane]

Thank you! Cheers!

[@aaaa-jt8pz]

this will help a ton

[@danielmohamady2615]

It was very useful

[@Credo-Production]

Kinda thought at the end, he'd suggest something a lot more ridiculous. It would have been a nice joke ngl😂... Or not😅

[@JoshChristiane]

Haha, I wish. Humour is a good way to spread a message so that's a great point! Thanks for watching :D

[@Credo-Production]

@@JoshChristiane Don't worry, you don't need to be funny. The value of the content and the ability of the title to hook the viewer is all you need. First time I say your vids, I actually thought you had a million subs, ngl 😅.

[@JoshChristiane]

@@Credo-Production You're so nice, thanks for the support!

[@danielmohamady2615]

Your videos are very useful

[@JoshChristiane]

Glad you think so!

[@babapro2798]

Appreciate you bro

[@JoshChristiane]

The feeling is mutual, thanks!

[@danielmohamady2615]

thanks for your help

[@danielmohamady2615]

It was great

[@danielmohamady2615]

nice

[@danielmohamady2615]

You said very well

[@azizdz7730]

thank you for doing good

[@JoshChristiane]

Thank you as well for watching and commenting.

[@danielmohamady2615]

very niceee

[@youtuberdersi7701]

i will be smarter thankz

[@drxzzy5674]

Hi

[@JoshChristiane]

Hello there :)

[@ci-ty9kk]

need ur help plz cmmt

[@JoshChristiane]

With what exactly?

[@leksandradubovik6291]

Sorry but I never seen a worse advice than writring all your passwords on a paper....

[@JoshChristiane]

Context matters in this case. Writing it on a piece of paper is a pretty darn bad idea if you leave it out on your desk, lol. But if you have a safe or somewhere to protect it then it's still better than what I've seen a lot of people doing with their passwords. Nuclear codes are stored this same way and not trusted to IoT connections for a reason. If hard-printed is safe enough for nuclear codes then it's safe enough for my passwords. I write them down in a notebook, store that in a hidden safe in a fire/flood proof bag. While this certainly is not perfect, in my opinion it is safer than most cloud services that have a history of leaks, hacks, and even internal misuse of customer data. How to protect yourself and your accounts is up to you, but I don't trust my passwords connected to IoT.

[@donniecarrascosr.9912]

Thank you👍🏽