How Password Managers Work - Computerphile

[@StreuB1]

Dr. Pound is one of the best presenters......his dryness is also absolutely hilarious. LOL

[@BlueZirnitra]

Ok, so WHAT WE'RE GONNA DO, right? Is this..

[@StreuB1]

@@BlueZirnitra HAHAAHAH!!!! I think he's likely as awesome lecturer as well. Would love to sit in on one.

[@Swipe650]

Pound that like button for Dr Mike

[@abandonedmuse]

Swipe650 not gonna say what I was thinking. Nope. Just gonna walk away from that one.

[@maharajahdann]

@@abandonedmuse Pound Dr Mike's Button perhaps?

[@Wilker_uwu]

this is The Lockpicking Lawyer and what i have for you today is the concept and function of the password managers.

[@RBXTrains]

Very funny 10/10, off to Edinburgh now!!

[@maddoggLP]

A little click out of 1..2...3,..., 256 aaand we got our AES-Key

[@bundy1688]

Meta

[@Envinite]

Nothing on ksda34bw4t4748797sjTe.........nothing on WxB7ww3n7464se4etesimyf8e4qwq.............

[@bubboydarker9030]

*50 million years later*

[@gold4963]

Personal bookmarks. 4:55. True explanation starts. 5:25. Two derivations from the password. 5:47. Master password authentication; how it's used in the grand scheme of things. 6:31. How LastPass creates a master password; appends email | master password; hashes this many times. 8:36. A main idea! 9:06. Difference between OnePass.

[@Lambda_Ovine]

Just remember people, if you get an email that seems to be from your password manager saying that you need to "verify" your account and they need your password, or if they ask you your master password for whatever reason, DO NOT send them your master password, don't click the link and report the email as a fishing email! It's a fishing attack! Your password manager should and will never ask you your master password.

[@jamesedwards3923]

If you used KeePass or Password Safe. That is not an issue now is it?

[@hi_its_me1337]

Phishing*

[@iamaduckquack]

Indeed. Also any password manager worth anything wouldn't even know your master password due to zero knowledge so that's another red flag if receiving such an email

[@paulsteenbergen4223]

💡 Security tip: Do not store email credentials in the password vault, in case it gets cracked you still have your email secure to retrieve all of your logins...

[@x3ICEx]

vault* Edit: it's been fixed :)

[@jamesedwards3923]

Not bad advice at all.

[@paulsteenbergen4223]

Thanks... corrected

[@kurihunt92]

@@BattousaiHBr or... use MFA(2FA) on your PWmanager

[@tuxlivonchur435]

who in the world should hack my password-vault keepassxc? how?

[@saadhassan3521]

Would really love to see an actual programming language or any subject tutorial from Dr.Mike Pound. love the way he conveys knowledge, so easy to understand.

[@nxrada]

i’m r que le hemos

[@kn0bhe4d]

1:05 Who is Kate? Is Bob cheating on Alice?!

[@t0cn413]

yes

[@RexGalilae]

ProBob drama ensues

[@josue_mejia]

It's his and Alice's daughter. He loves his daughter.

[@jmullentech]

@@josue_mejia ^ So he's bangin his daughter? Seems legit.

[@omiorahman6283]

@@jmullentech this is not game of thrones

[@Robert_Browne]

What about "password321"? I bet that one's rock solid, but I can't use it now because wanting to share my brilliance has foiled me yet again.

[@lyrimetacurl0]

A scammer once created a profile for something without my consent and put the password as "123456". I changed it to something really complicated that I would forget.

[@MrMineHeads.]

Don't worry, hunter2 is the best password

[@conradrobinson7941]

Dont you just hate it when that happens.

[@go9565]

You are your own nemesis

[@lanceareadbhar]

Password321 for extra security

[@HechTea]

"Go and animate that."

[@AndOne23]

I maybe understand 10% of what Dr Pound is talking about but he does it with such a passion and enthusiasm that I´m still clicking on the videos when I see his face.

[@jamesedwards3923]

You can look up articles and academic sources while you are listening. It is what I do. I am not an expert either, but I made some remote effort to understand.

[@Kydos37]

So much less stress watching these out of interest and not as part of a cramming session.

[@peti826]

@Sassy The Sasquatch You would be surprised how many exams and tests people (including me) manage to pass (hehe) by learning from YT videos.

[@GrimmerPl]

Tip of the day: always use 2FA if able. Thanks to that you can add an extra layer of security on top of your password manager.

[@jamesedwards3923]

Also turn on an app locker or app blocker on your android device. It is not encryption. It is a stop gap to hinder casual or criminal intrusion.

[@GRBtutorials]

James Edwards And how would that differ from just using a device-wide code?

[@jamesedwards3923]

@@GRBtutorials App Lockers are typically integrated into the application. App Lockers are also associate with android antivirus software. Note: The ones I will be referring to unless stated otherwise. Are the app 'blockers' associated with android devices via third party antivirus security programs. It is not encryption, more of a stop gap measure. For example, let us say I am on a train and I setup an app locker. Somebody runs off the train and snatches my phone in the process. However my phone is not locked. Most of us do not completely log out of our phones' mobile apps. Keep in mind unless you are using an application specific locker. This just prohibits them from interacting with the application directly. The application is indeed 'open.' A decent hacker could bypass the app locker; or blocker as it should be commonly called. This will give you time to lock and wipe the device. Keep in mind you can find third party 'standalone' versions of this. My personal recommendation is that is if you are out on the town. Try having two that overlap with each other say in 1 minute and 30 second intervals. It will make it much harder for a common thief to access your applications buying more time. If they keep your phone active the phone will not lock until you get to a computer to remotely do it.

[@VitorGiannasi]

I use KeePass and for the most important passwords I also include a last sequence of characters which I memorise, then even if someone has access to my database they won't get the whole password.

[@jamesedwards3923]

The double blind method is efficient.

[@MacShapow]

Well, I use my password manager for most things but I'm a bit paranoid and I do have 5 passwords that I just remember: Laptop, bank, email, phone, and. of course, the password to my password manager. (I guess phone and laptop are also practical; can't get to the password manager before I turn them on anyway!)

[@baldeepbirak]

Same here

[@totlyepic]

Not that you really need to even worry too much about the strength of your laptop or phone passwords. If someone has physical access to the device, all bets are off anyway. They don't need to ever learn your password to get access to anything locally stored on the device. Web-authenticated services (like your email) would still be safe though, I think (would have to see what is/isn't stored locally).

[@jamessadventures1380]

@@totlyepic Not *strictly* true, yes in the vast majority of cases 'if you hold the box you own the box' but things like fully encrypted drives, full secure boot / locked bootloaders, etc. mean that data can still be secured!

[@MrGilRoland]

Plot twist: “Laptop”, “bank”, “email”, “phone”, “and. of course”, are the actual 5 passwords he’s using.

[@jamesedwards3923]

You are being logical. I do not remember my bank password, but more logical than most I have encountered.

[@rabidbigdog]

How much more tractor feed paper does the computing department have from the 1980s?

[@sbalogh53]

See that storeroom over there? .......

[@darthmonks]

That storeroom is where we keep the list of storage locations for the paper.

[@michelfeinstein]

I would love to see an open-source password-manager core, and the companies use this core on their services, just like Signal does for messaging. This way we can be more confident about the implementation details of those architectures.

[@knightsljx]

Bitwarden says hi

[@adrianozambranamarchetti2187]

For those hailing from the future, which is unlikely given the age of the video but here's hoping. You can use KeepassXC or any KeePass variant as a password manager without sync, then use Syncthing to sync the vault across devices. No server needed!

[@lohphat]

The key (get it?) is not select a password manager which will not entrap you to a perpetual subscription to function. e.g. they keep your vault in their paid cloud service. You don't want to be caught out that either a missed payment or the company having an operational issue separate you from your password vault. Always select a product which allows you to control where the vault is. e.g. I use 1Password but elected to use a local vault and then I use Dropbox to sync between devices. If I decide to use another cloud storage provider, I can move the vault freely. Also, most of these products don't read each other's formats so you can easily migrate between products should one raise their prices or go out of business, forcing you to start from scratch. Customer lock-in is evil.

[@azuravian]

Agreed on your concept of customer lock-in. Almost all password managers, however, have the capability for you to export your entire vault into a file, which can then be imported into another password manager. As a matter of fact, I don't know one that doesn't have this function, although I'm sure they exist. If they do, those are the ones I'd never use.

[@jamesedwards3923]

I try to support open source software.

[@lohphat]

Gregory Booth It may have an export function but more importantly, how can other products import the data? The database schemas are different. The devil is in the details. If you have to tweak a large number of imported entries then the “feature” isn’t really a feature.

[@jamesedwards3923]

​@@lohphat The data is 'decipherable.' KeePass (depending on which version you use) allows you to export as customized .html file. Yes, I would have to 'reconstruct' the database. However it is salvageable. You should be backing up your database in different formats for logistical reasons every time you backup the file. The 321 rule of backing up still applies. Three different copies. Two different media formats. In this case types equals file types. KeePass allows you to 'print' your password database file. Microsoft for example allows you to print to .pdf format and .xps format. You can also save screen captures of your database if you want to take the time to do it. - Not to mention the numerous applications that allow you to export, print to, etc. You should be saving the last few versions of keypass on a disk somewhere. So if you 'need' to port the data. You would still be able read it. It is all about redundancy.

[@lockergr]

I don't really understand this. Where would you put this vault like on your MacBook, or external hard drive? And how do you secure it there? Trying to learn, but I am new to all this.

[@elukok]

Very simple way how to vastly reduce possibility of damages when your main password leaks - when creating password for some site, let the password manager generate a strong password, save that to the password manager, but than add some static part at the end of the generated password that will be saved to the actual site but not to the password manager. The part you added will be the same for all of your saved passwords and you will have to remember it. This way, even if your password DB leaks somehow, the passwords themselves wont work and it still keeps most of the convenience of password manager.

[@txcpnae]

elukok thats very clever!!

[@aitchpea6011]

That's a fantastic suggestion. I'm definitely going to start doing that.

[@MrSykezbro]

Whenever I see the computerphile video finally has Mike back in, I'm always instantly clicking

[@chicoktc]

You could have just said "I'm a simple man. I see Mike, I click".

[@MrSykezbro]

@@chicoktc I'm a man of taste, I form my own answers ;)

[@bluekeybo]

KeePass would be the best option here. It was audited by the EUFOSSA project. No Cloud to worry about, all local. You can save it anywhere, including the cloud if you wish. If you really still want a cloud based manager for convenience, Bitwarden is the way to go. Thanks for the video!

[@jessem4087]

I like to use keepass with syncthing to keep everything up to date, but you could use other foss tools like rsync or nexcloud

[@Guyflyer12]

You say there are three methods of keeping passwords, writing down, same password, or password manager. The best solution is to create a very simply formula that you can easily remember that creates unique passwords for each website. Off the top of my head, some base password that is easy to remember + some easily repeatable function (rule) that spits out a few characters to add to the base password. A hacker would have to have 2 hacked passwords + do specific code cracking to figure out your function

[@lockergr]

Brock Elmore This is actually a smart idea.

[@IIvian]

Will there be a followup episode on how the 'master password recovery' procedure works in those kind of solutions?

[@JNCressey]

*T-Mobile Austria has left the chat

[@zrobotics]

It depends. For instance, I use KeePass. If I forget my database password, I'm 100% SOL, whereas LastPass does offer recovery. I would argue that this is a security weakness, since then there are options for malicious actors to access the password DB more easily. So while I do maintain a cloud-storage backup of my password DB, it is protected by multiple passwords- the unique password to access the cloud service, and the unique password to unencrypt the password database. While a breach may be possible, it is still more secure than having a recovery alternative. And the likelihood of me forgetting the KeePass password is nonexistent, since aside from my phone unlock password it is the most frequently used password, and if I forget something I'm typing several times per day I likely have larger problems.

[@Furiends]

With google your devices are part of a sync to where they all store your data. In what way they are encrypted in storage I don't know but it is NOT based on your master password. Thus resetting the master is just a matter of creating a new cloud sync with the existing data on the device.

[@shaun_rambaran]

@@zrobotics Hi, zrobotics. I'm a new KeePass user. Where or how have you been backing up your KeePass database and private key? Do you trust backing them up to a web server or cloud storage, or have you been keeping them on offline harddrives?

[@Outfrost]

I'll just say that I will never trust my passwords, password vaults or personal data with any company, individual or scheme that offers something along the lines of "master password recovery". If anything even remotely close to that is possible, it is, in security terms, a situation equivalent to storing all of your passwords in cleartext on a single server accessed by arbitrary people.

[@aidancoutts2341]

Your email is used to reset so much stuff. If any of your passwords are unique and secure, it should be that one

[@gloverelaxis]

I've been through a few password managers (LastPass, 1Password, KeePass, and even storing a text file in a TrueCrypt/VeraCrypt mounted container) and found KeeWeb to be the best balance of security and useability.

[@TON-vz3pe]

I have a some methods. I already do this so it's pretty safe. Method1: Map all the English alphabets to some unicode characters that which you can remember. Basically you invent your own cipher. Then create some app/program in c++, rust which can convert any english txt file to the unicode mapping txt file. Print it on some card and keep it in your purse. Same can be written on paper. Only you can understand it. Method2: Put all your secret stuff in a file. Encrypt it using some program or your own custom program. Keep the program binary in private github repo. Deny all outbound connections in your machine. Keep the encrypted txt file anywhere you like, can be gmail. It's takes some effort to protect valuable things. Don't go for easy options.

[@matthewbarnes375]

Being a software developer, I really like Pass. It's open source and leverages GPG and Git -- two things I use every day anyway -- instead of reinventing the wheel.

[@saschamayer4050]

KeePass?

[@matthewbarnes375]

No, passwordstore.org

[@bonniemunene5163]

A password manager sits above all browsers that you may have stored different passwords for you. It's also sits above all devices that you may have for example between Operating systems, PC and mobile devices.

[@JER0EN]

You can use KeePass with the IOProtocolExt extension to sync it via WebDAV with various cloud providers. It even provides synchronizing if the KeePass database was updated on the server I have it set up so whenever I open KeePass it prompts me for my password which is stored remotely on my Nextcloud server. It retrieves this password database via WebDAV. And each KeePass installation has a separate key in Nextcloud so it can download the file. The password database file is also locally stored using Nextcloud client, but it is safer and faster and safer to write to the database via WebDAV.

[@AndrewFRC135]

Thats the beauty of Keepass. You own it completely and use it however suits your use case. I have my devices (laptops and smart phone) sync the keepass vault via a backup copy on my home DNS server over sftp, but only from within my LAN. My devices don't sync when I'm not home, but it means my database never leaves any of my hardware.

[@nberedim]

+1 for KeePass mention

[@lualgomo3920]

Another option is using a long structured password with small variations. That way they are all different yet easy to remember. Example: Service: KZbin ---Add 1 letter---> Zpvuvcf Base password: Something_With_"$%&!"_and_"134679" Then you merge them: Something_With_"Zpvuvcf",_"$%&!"_and_"134679" So there, you have a somewhat secure password and easy to remember. You can make it longer, shorter, with more simbols or mess it a bit up. Also, as the letters seem random, you don't need to worry (too much) about someone getting the plain-text password in a data leak. Most likely no one will understand what "Zpvuvcf" means.

[@Dusk-MTG]

Password1: 10 IQ using a password manager: 100 IQ 1drowssaP: 1000 IQ

[@ConstantlyDamaged]

Okay. But if KeePass decide that the project is too much and server costs are too high, and shut down, I can keep using their program AND I can get all my passwords back. A cloud service? Isn't free and is a weak link in the chain. If you want to use KeePass across devices, employing a well-configured gdrive and Google's Backup and Sync (or another cloud service), will ensure all your devices keep their key vaults up to date.

[@pm79080]

LastPass is service as a software substitute.

[@JNCressey]

If you're using google drive, what's wrong with just using google's password manager?

[@BigRizza1]

Keepassxc file inside encrypted file container + mega.nz cloud is a great option. The keepass file is encrypted, the file container can be encrypted with multiple layers using different methods, the cloud account is encrypted, and also free.

[@ashishpatel350]

@@JNCressey it's Google. Most people don't trust Google or Facebook.

[@baumkuchen6543]

@@ashishpatel350 With keepass you can encrypt your DB with combination of password + keyfile. Sync your DB via google drive and keep your keyfile out of it. I think even google would have problem cracking your DB without keyfile.

[@NuggetsNews]

We recently did a video on the risk of generating your own private keys. Thought you guys might find that topic interesting to cover in future!

[@DanielLiljeberg]

I use a password manager. But I also use/have used another system that have made me have unique, complex passwords for every service, that I remember and dont write down. I simply come up with a default complex password. Then I incorporate the service in question in some decided manner. One example could be the domain name perhaps with alternating small and big letters and some letters exchanged to numbers. Now when you reach a site you will know your unique password for that site simply by knowing the sites domain name and your own personal rules for your password.

[@sylvansorrow]

Always enjoy these videos. But can you talk more about account recovery keys? Or master decryption keys and how they work. A lot of these services have methods to recover your account incase you lose your master password with master keys, how do those work?

[@balping]

I use KeepassXC and it's quite convenient. It can perform autotype, that's all I need. The database file itself is synchronised between my devices using owncloud.

[@sledgex9]

FYI: You could use "syncthing" instead of "owncloud" and drop the php/javascript dependencies. It should run leaner on the machines.

[@balping]

Thanks for your recommendation, this project looks quite decent. I use owncloud for calendar and contacts as well, so I'll probably stick with that, but thanks anyway.

[@NoseyNick]

Yeah I heard something like "You can use KeePass at the loss of some convenience" but I didn't understand what the loss of convenience was? AutoType based on window title works great and is SURELY safer than trusting my browser / plugins to not have any security holes?

[@OceanBagel]

If you're worried about a password manager breach, just encrypt all your passwords by hand before storing them in the password manager. Sure, it's more work than just keeping all your passwords in a handwritten book, but you also get to show off how cool you are to your friends.

[@shreepads]

"encrypt by hand" - surely you're joking

[@jamesedwards3923]

I can not tell if you are joking or not! What, that does not make sense on many levels. In case someone is seriously considering writing down their passwords in a book. 1) First off, one of the important reasons everybody recommends a password manager. Is because the software can create a completely randomized password. Encrypting by hand involves your human brain. Which for this tasks is way more inefficient. 2) Books are not bad things. I cringe to this day when I see somebody throw away a book. The problem is storage, security and convince. Software is superior.

[@OceanBagel]

@@jamesedwards3923 Yeah it's a joke lol. The actual secure way would be to take the generated passwords and write them in a book. You'd still have to keep the book secure, but that's usually not a problem.

[@Nibsipipsi]

@@OceanBagel you'd think so, but somebody stealing your password book from your home is more likely that somebody breaching a password manager.

[@nouman_baloch]

Please take about the graphical passwords vs textual passwords which one is more secure and power full..... THanks wonderful job.....Keep going.....

[@johnfrancisdoe1563]

SharpScripter The only "graphical passwords" I have heard of are basically disguised onscreen 9 or 12 key keyboards with limitations in what numbers you can enter. So really weak passwords for people who don't read so well.

[@jamesedwards3923]

Graphical Passwords?

[@LtColDavenport]

So what password manager does he use? That would be interesting!

[@lathans1]

@Computerfile: I feel that trusting larger password managers with sky storage is not about trusting the company to do the right thing. It is more about betting on who will be winning the fight when they make themselves a target, since many people will have a huge interest in gaining access to such information. They could become compromised by hackers employed by criminals, governments, or other people in power. Even while the cryptography is strong and sensible, other stuff could still happen, like modifications to the client software which would act as a trojan and not only protect the passwords as regular, but also supply them to a third party. But you are right. For everyday Joe the benefits of a non-effort password manager outweighs the small risk of putting all eggs in the same basket when the security is so strong.

[@jamesedwards3923]

If you do not trust cloud password managers. Other options then encrypt those files. Again, there are so many options, free, paid, or open source.

[@Outfrost]

As a modern, cross-platform, drop-in replacement for KeePass, I'd recommend KeePassXC.

[@vinnytheglock]

Mike Pound is the best. Love this guy.

[@NA-lp2re]

Choose a password manager that supports security keys like Yubikey. That way an attacker not only has to guess your master password, they also need your physical key to authenticate.

[@idjles]

Keepass + Dropbox = done. Mobile access, family sharing - all easy and automatic.

[@kmcat]

linked with a Yubikey neo for that OTP and keyfile.

[@jamesedwards3923]

@@kmcat You may like Password Safe.

[@rayweaver2069]

Was really happy to see a video about password managers featuring Mike Pound. 😃👌

[@ChiefyManDudeDog]

I'd be interested in his thoughts on web browser password managers. Are they similar to LastPass in terms of security?

[@flateartherpaintball5214]

They are definitely stored in plain text for Chrome and Firefox on Win7 and 10, at least. If you right click a password box, inspect element, and change this field: type="password" to be type="text", you will see your plain text password. Which is why I don't let browsers save my passwords.

[@michaelpound9891]

Browsers will encrypt passwords on disk. I dont have a huge problem with them, but I just find syncing between devices easier without tying to a browser. Or maybe if I get a new device. I personally would also rather avoid Google having my passwords, simply because it also gives Google a list of sites I think are important. Just one more thing it learns about me!

[@Vode_ika]

@@flateartherpaintball5214 I just tried this on the latest version of Google Chrome on Win 10. All I got was a blank box (I even tried copying it in case it was unreadable and all I copied was some spaces), to make the password visible I had to click the button for it, and then use my full windows login to confirm I wanted a password to be visible.

[@dykam]

@@flateartherpaintball5214 How the browser shows it in a form has nothing to do with how the browser stores it on disk. If it wouldn't do what you described, you could literally not use it, as it needs to in the end send it as plaintext to the server.

[@totlyepic]

The built-in managers in browsers are just like any other local password manager he talked about. It's stored locally on-disk, encrypted.

[@Aerroon]

I think KeePass is the best solution. You have control of the vault yourself and you can have two different keys for the vault - you can have a keyfile and a master password that are both required to open the vault. This means that you could sync the vault through online services, but only move keyfiles through offline methods. Also, another thing you can do is have different vaults for different levels of passwords. For example, you could have a vault that only stores your unimportant forum logins and what not and then have a separate vault that includes more important information.

[@aduh95]

Or you could use Bitwarden and be your own cloud

[@ChenfengBao]

Offline solution is just too inconvenient for the average users.

[@jamesedwards3923]

I have no argument, thank you sir. :) .

[@aitchpea6011]

I have two passwords written down in a notebook, hand-encrypted (weakly, I admit, but I have to decrypt it entirely in my head when I forget one or the other of the passwords). One is for my keepass database, the other is for the cloud storage service (no I'm not telling you which one) I use for the sole purpose of backing up that database and transferring it between devices. There's a lot of other files on that cloud storage account, but they're all random data with similar filenames to the actual database. You know, for extra obfuscation.

[@jamesedwards3923]

I have a better idea. Use that code you wrote down as the second authentication. What do I mean? Do not commit your cloud storage to your head. It is a bad idea, because your cloud storage password can be 'compromised' any number of ways. Your keepass password, committed to memory is a lot harder. Put your keypass file in another file encrypted. Congratulates you created at least three factors of authentication. One is your external encryption password. Then you have your kepass password. You also have a keyfile. You are welcome by the way.

[@Chaos666Theory]

*Master Password* is a great password manager for those who are extra paranoid. It's free as in freedom software (so not _just_ simply open source), and it will work even if all your devices simultaneously combust or something. It _generates_ passwords based upon your master password and name. This means it's not stored on some cloud service where the NSA has full access to it, and it's not even really stored locally.

[@KanalMcLP]

But if i remember correctly then you can't change a password, only all at once?

[@Chaos666Theory]

@@KanalMcLP Nope. You can just increment a number associated with that site/user and you'll get a new password. To change your master password however would probably require all passwords to change.

[@recklessroges]

Isn't keepass better written with way more functionality?

[@fastundercoverkitgoogle7381]

Everyone is mentioning keypass as their offline password manager of choice, but I personally am happy with (gnu) pass. I like the convenience of my gpg key being my master key and syncing across devices using git.

[@jamesedwards3923]

You can just sync the file with any number of cloud storage services. Across many devices. That is why many of us use keepass.

[@jamesedwards3923]

KEEPASS. Yes, if you are foing open source. It is one of three.

[@somebrid2147]

Camera-man, get a tripod my man. Your hand must hurt af

[@TheNordicVoyager]

It all fell apart when a company names Flightsim Labs (FS Labs), a producer of overpriced flight simulator addons, smuggeled a PW sniffer into their installer. This installer demanded admin rights and was somehow able to read the Chrome passwords and possibly others, too. All of this was to combat software piracy, of course. Something this very company had done, too, btw. So the customer buys a 140 Euro software, grants admin rights because otherwise his expensive and as per EULA not refundable software won't install, and without the customers knowledge the passwords would be uploaded to the companies server. Unencrypted, if that still matters. Of course they got away with it.

[@unocualqu1era]

Oh yeah I know these guys, they've been polling their users for over a year asking them if they want an updated version of the Concorde for P3D v4/v5.... the update costs as much as a new product, even though it's just the same plane made for a slightly newer version of the simulator. So far, no updated version of the plane has been made, likely because there wasn't enough people throwing money at their screen when reading that. I didn't know that they did this, but they seemed like scumbags to me just because of making customers pay full price for updates, as if it wasn't expensive enough

[@aislingoda6026]

i've always said to people, never store passwords in browser. i'm surprised anyone still does

[@grn1]

How did they get away with it? Stealing passwords is highly illegal no matter how you spin it. Even if they didn't use the passwords if they've clearly compromised the safety of their customers that's a huge lawsuit right there.

[@ElkoGuitarist]

I wish this guy is a lecturer in my university. Dude is a genius.

[@TheMCmace]

I love this man and i love how ambitious he is about IT things

[@NatasDuVall]

KeePassXC > KeePass. Natively multiplatform and compatible with KeePass databases.

[@pkobalt]

I run XC on Mac, Desktop Linux and Android, but I use plain keepass on win. I think the native .NET plays better with win.

[@portman8909]

Remember one good one for your main email and have password manager for other sites. If you lose the password manager, you can easily just reset the password with your email.

[@TheJackiMonster]

You can probably write a simple password manager on your own as a shell script. It's basicly just a hashtable (service as key and password as value) which can be encrypted or decrypted using GPG. If you want access to it from different devices, you can put the encrypted file in your nextcloud. There is no need for a specific service which stores passwords only. Fun fact: If we could authenticate via a GPG-key in our TLS traffic, we would not even need so many passwords in the first place.

[@TON-vz3pe]

Yeah. Password manager seems like a fools game.

[@prosonman]

All these Password Managers were far to complex for most of my family who didn't understand many of the features and just wanted something they could use easily. My Password Book for IOS devices was ideal and did not require any third party registration.

[@jamesedwards3923]

No disrespect at all. I am a blunt person. Again no disrespect intended. The flaw with using built in browers password managers. Is that if the account is compromised. The passwords are compromised. That is not the same if your use a program like keepass or password safe. Even if you choose to use a 'retail' password manager. That is at least a seperate account. On a seperate service. Also based on my personal experience, reading, observations. Your statement suggest that their passwords to their IOS accounts are garbage. Unless their elderly. Have memory issues. Or the like. I would never recommend it to anybody. I have known, conversed, or read about people. Whom have had their password managers hacked. Most of the time. It was due to poor 'basic' security measures. On top of that. Garbage passwords. One thing to get hacked. However I am tired people telling me. They were hacked, but the adversary did not have to put any real time or effort into it.

[@fxopaws]

really like the continuous paper for illustration. used it 30 years ago to print t-accounts. btw great series

[@ljoonal8275]

I've found syncthing to be a reasonably good way to keep my keepass database on multiple clients.

[@UntouchedWagons]

I use a self-hosted Bitbucket container on my file server. If I need a password on my phone, I can VPN into my home network and get whatever I need. A few extra steps but it's not too bad. I used KeePassXC (I think that's what it's called) for a while but I wanted something multiple devices could potentially access at the same time.

[@jamesedwards3923]

??? That would mean you are sharing the data. It would be efficient to store backups of the keypass file on your own server. Then if you needed to retrieve it, then just do it. Also if you needed to backup the file. It is done.

[@NourSelim0]

I use HMAC to deterministically generate my passwords (master + domain) every time I need them, but then I use LastPass on my phone for a few passwords for fingerprint auto-fill convinience.

[@Theoddert]

Ah but you see. I will type "password" in backwards. Nobody has thought of that yet; fullproof

[@MirkWoot]

Second factor + master password!. I think that should had been mentioned. Tho still pretty bad if someone gets on your computer.

[@bobbarker7820]

I use Veracrypt to create an encrypted file which I then store on the cloud. I feel much more comfortable knowing that I've encrypted it using 3 different algorithms.

[@bobbarker7820]

​@I And why's that? It doesn't stop brute-forcing, but it does mean that if one algorithm is broken it's still secure.

[@bobbarker7820]

​@I And yet should the time come where one of these algorithms is broken, I'll be grateful I've encrypted it 3 times over. My volume is more than fast enough. I'm only rocking .txt files and pictures in it. It's not like I'm running a server or something.

[@jamesedwards3923]

Hmm, I would like to read the audits that disclose this. Most people are not going to have their VeraCrypt encryption open all the time.

[@jamesedwards3923]

@I A better option is using separate encrypted files. 1) Keypass file. 2) Then put it in veracrypt file. 3) Then put the file in a .7zip or zip file. Three layers. Three passwords. Multiple iterations.

[@jamesedwards3923]

@@bobbarker7820 Correct.

[@AleGrigis]

Mike: not "correct horse battery staple" Me: ...damn XKCD: Told ya..!

[@Jackleber]

Love the nod

[@quicktastic]

All the encryption stuff is great for computers storing information, but a person still needs to remember the plain text password required to unlock it all. For that, people write it down on a sticky note and hang it somewhere around their computer so they don't forget it.

[@BattousaiHBr]

assuming it's in your house and really no one has access to it besides you, it's not such a terrible idea. in that scenario the biggest worry would be losing whatever paper you have the password written in.

[@pward17]

This weekend i started a pw manager and bought a server to host a git repo. Im using pass for linux. I thought i was being re-marketed and then saw the date on the vid. It works too. pass git push/pull and boom.

[@bruderdasisteinschwerermangel]

KeePass + SyncThing is the golden combination tbh

[@concretetoy54]

for me, the question is: how do pass managers fill the fields on the sites? JS injection, native copy/paste methods, simulating keystrokes? I don't understand that

[@s8w5]

Keepass simulates keystrokes, which has the advantage that it doesn't matter whether you are logging into a web service or using some proprietary software, such as a gaming client. AFAIK the other ones are completely different, but I haven't used them myself. At least their websites are only ever talking about filling in web forms.

[@IceMetalPunk]

Around 1:35, you missed an option, Mike: use a mental algorithm to create your passwords, so that every password is different, but you don't have to remember them all because you can re-create them on demand :) That's what I do. Every password I ever use is different, but I don't remember most of them; I just remember how to form them and do that when needed.

[@LiezerZero]

I use keepass2 and make backups (4 different local locations on flash drives with obscure filename) EVERY TIME I edit it.

[@baldeepbirak]

Great insight. Password managers stop repeat passwords and show you when you add a weak password.

[@jonahbranch5625]

Y'all should do a video on the OPAQUE password authentication protocol!

[@h.i.1359]

I'm surprised that nothing was said about Argon2. Also, KeePass has some protective mechanisms against keyloggers: Secure Desktop, Two-Channel Auto-Type Obfuscation.

[@KanalMcLP]

Yeah, but they only work for bad Keyloggers and are easyly breakable.

[@jamesedwards3923]

I have not read enough on Argon2, but from what little I have read. It is reasonably secure.

[@jamesedwards3923]

The problem I have with Argon2 is simple. Some ports of KeePass do not support it. Which is annoying. However, it is an open source project. So I do not complain. I am just making the statement.

[@Mikesco3]

BitWarden is for me one of the best password managers out there current available

[@alexbrown4046]

A video on how masked passwords work would be awesome!

[@peschebichsu]

Is the automatic login from google chrome or samsung phones also some sort of password manager or do they use different (less secure?!) methods and are not advisable?

[@karapapaxatzidimitrakopoulos]

how does spiderman know so much about passwords ?

[@ByGraceThroughFaith777]

In simple terms, it is safe to use a manager... Thanks!

[@briandsouza7854]

But how does the server know that the authentication key is correct? Since it is hashed so many times. Also the authentication key must change on every login if I'm not wrong then how does it verify if it's the correct authentication key? The password manager I'm talking about is Bitwarden.

[@michaelhammer5616]

Super awesome! I love password topics covered by your channel. Please more. Thanks!! Also: A recommendation which password manager Dr. Pound is using would be great!

[@itskdog]

Michael Hammer That would probably be a security flaw in and of itself. You probably don’t want the whole world knowing which service you use, as they may start trying the “forgot password” tool and possibly get in.

[@Zwork101]

You forgot the fourth option. Create a password dependent on the website, for example "Google's background is white" might be a google password, and you can use that pattern with multiple sites. Rinse and repeat each site's password is different and you can remember all your passwords.

[@Zwork101]

@@DanStoneUK Maybe so but if someone has a keylogger on you and you use a password manager you're also in trouble. It doesn't stop manual attacks, but it stops quick scans hackers might do over leaked password lists.

[@DrRChandra]

Use Google Drive as the master place for the vault, have Drive access software on all the platforms where I need to get at the vault (such as google-drive-ocamlfuse), and KeePass. That IS the thing, as you mention...with KP, it's up to you to handle distribution across platforms, but you're in charge. In a sense, why would you have to authenticate to get your vault? You shouldn't care who gets your vault, otherwise it's kind of pointless putting it in the cloud. But it is *somewhat* less secure, because if you have it you can run brute force decryption attempts at full speed, versus only getting the vault if you posssess the secret necessary to obtain it. That would make it that much harder to decrypt.

[@TS6815]

How would you feel about a user utilizing a local password management program and merely saving the file on a dropbox, Google drive or similar? sort of a deflection of the concern of a big target on the back of Dashlane et al. at the expense of a little less intrinsic security

[@fuseteam]

My biggest concern is saving all those passwords behind a single password On the other hand ssh keys are easy to use and more secure than any password (hint: it public-private key authentication) It makes me wonder if we can utilize qrcode to do public-private key authentication instead of passwords Like say the website displays a qr code of your public key, you scan it with your authenticator device. the app does the public-private key authentication and generates OTP code which you then input to finalize the authentication

[@jamesedwards3923]

Use a software application like keepass or password safe. You can use software keys or FIDO keys depending on your choice.

[@fuseteam]

@@jamesedwards3923 those are still "password managers" that are protected by a single password no?

[@jamesedwards3923]

@@fuseteam Not in this context. You are adding another factor to the encryption. You need 'both' the password and the key or keys. The key is part of the encryption. Another example is peazip. It allows for keyfile enabled as another factor.

[@fuseteam]

@@jamesedwards3923 hmm

[@lucacommonjay7894]

But would you need a password manager when you have Correct Horse Battery Staple for all your accounts?

[@joakimk9394]

I was hoping to see you do this topic, thank you :)

[@JNCressey]

Does the Google account password vault work in a similar way? You would need to do that hashing hundred of times before logging in to any of its services to ensure Google doesn't know your master password, if it did work that way, wouldn't you?

[@Furiends]

Yes in regards to passwords and other synced browser data. Although data is decrypted on the stored and stored as is. This also allows for easy master password recovery for example since any synced device has all your data and just creates a new cloud sync when its reset.

[@Akkordinator]

IIRC passwords in chrome are encrypted with the windows password you use. Not recommended at all, those passwords can be extracted very easily (on your local machine; don't know what happens when it's sent to google)! Firefox (again iirc) by default doesn't encrypt at all, until you set a master password in the browser, which is not even suggested by the browser when you try to store a password. Definitely use a real manager, if you want security. There are enough options that are as comfortable and way more secure then any integrated option in FF or Chrome. Also please correct me if I'm wrong, it's been a while since I looked that up.

[@aaronnautel3776]

@Computerphile Based on your professional opinion, which password manager is best? Free or paid doesn't matter.

[@hawks5196]

what about Bitwarden, self hosted on a remote server, locked behind google oauth to access the web GUI and locked to a single user/password with 2-factor authentication. would that be secure enough?

[@jamesedwards3923]

If you can afford to do it, then go ahead.

[@zentrader1073]

You can make it even more secure by creating your own encryption inside your password manager: First choose a decent sized book you own, this information always stays in your head. Next choose 3 numbers and assign them functions, so for instance the first number could relate to a page No. in the book. The next could relate to the line number on the page, the last the word number within the line. Then you take that word and translate it into Mandarin (pinyin) using Google translate and voila, your password. The only way anyone could ever guess what the numbers related to, was if you told them your method, and/or they were from the Culture and could use a Mind to extract the information directly from your brain. I know I'm paranoid, but am I paranoid enough?

[@qwerty687687]

It's easier to brute-force a word in mandarin than to brute-force a random string of 50 upper and lower case characters, numbers and special symbols created by your password manager.

[@jamesedwards3923]

@@qwerty687687 Correct.

[@shreepads]

2:18 "use it for everything or don't bother using it at all" is pretty silly advice. Also KeePass 2 is great!!

[@jamesedwards3923]

Make sure you have made at least one donation.

[@kevin._.27]

What would happen if Lastpass went out of bushiness? Would they email your passwords to your email that needs the password? Send a letter?

[@defaultmesh]

*Top 10 Questions Science Still Can’t Explain*

[@Frugl1]

You'd have been a smart person and enable offline access in lastpass, so that your vault is also stored locally for access without a cloud connection.

[@p_serdiuk]

You will be able to download your database as an archive. Same way you'd migrate across services. Companies don't go out of business in an instant.

[@mart3323]

Usually in situations like these companies give a warning months, if not years, in advance But supposing that you completely miss the warnings (or they, for some reason, shut down without one) - lastpass keeps a local cached copy to enable you to use it while offline, so you'll still be able to access and export your passwords, they just won't sync to other devices anymore I imagine any other password manager would do the same, given how inconvenient an 'always online' requirement would be for the user

[@harshithbolar9528]

They would ask you to change your passwords

[@TednTin]

Keepass FTW I use Keepass with 2 step password, one is my password and other is a local key file and keepass add-ons allows for browser autologin and also cloud storage.

[@petehiggins33]

Most of my important password protected online services require me to enter a small subset of the characters, often using pull-down menus. How do password managers cope with that? If I have say a 20 character password am I going to have to count to the 7th, 12th and 19th characters of a displayed password in order to enter them?

[@Mezxxii]

On 1Password, if my private key is used to decrypt my Vault Key, is it also signed by 1Password’s Public Key?

[@tnield9727]

So should the hash of the master password happen on the client side before going to the server?

[@fiddle_n]

The master password will need to be hashed client-side, and then something will need to be sent to the server. In some cases, it is the hash; in other cases the hash may be used to generate further secrets that are sent instead, e.g. the hash could be used to encrypt a private key, and the encrypted private key is sent instead.

[@pakxo.]

I started using an online password manager after this video. Honestly, first I thought using an offline based one could be safer yet they're so annoying and tidues

[@cet6507]

For almost all users there's no real security bonus to keeping it offline, the people that really need it need to be trained how to use it right or it can be worse for them. As long as it's implemented like correctly like this video describes, don't put your passwords in excel and post to github /troll :)

[@jamesedwards3923]

That is the point. You are trying to break a behavior that is going to put you into a weaker position. Research and read the data on how passwords are commonly broken. Generally once hashes are extracted from a database. They are broken with dictionary attacks. Then brute force. Brute force often works on weaker encryption. Dictionary attacks work typically on common password patters. A program that uses both and has the power to do it reasonably fast is the danger you want to avoid. You can search KZbin, .7z files as well as .zip file hashes can be extracted. What you care about is somebody taking that hash. Which is the mushed and mixed up version of your password. Then running the aforementioned and finding match.

[@NPat1411]

@@jamesedwards3923 That's why you have a strong master password for your password manager and have it create strong, unique passwords for all your sites. 1Password has the advantage of having built-in 2FA by generating a Secret Key that only the user has access to.

[@woblewoble]

Even if someone gets into your password manager account, 2FA would prevent them from accessing your more sensitive accounts. In that way it acts as a sort of first-responder to potential breaches, letting you know if it's been compromised if someone tries to access your more secure accounts, though I dunno how much that really works.