A simple tip on choosing and maintaining strong passwords

What is a strong password?

It is pretty obvious isn't it? I mean answer to this question is everywhere;

• Dont use dictionary words
• Maintain a good password length, some say 8 characters is okay, others say 25. To stay on safe side, I think suggesting 21(25 + 8 / 2 = 20.5, rounded as 21) as an average should be okay.
• Dont use same password in 2 or more websites
• No personal words that can be easily guessed
• Nothing that makes it easily guessable basically
• Change is pretty frequenly
• Dont write it anywhere in plain text

But we are humans, not computers

Can we make password management easier following all the above advices while also making it easy on our human mind? The answer is, we can. Well, we already have many password managers in town. We just need to use them.

Whats a Password manager?

Glad you asked. Password manager is a software or service that allows you to securely store your passwords in them. It encrypts your password database in a way only you can access them. Many of them also come with handy feature that will generate passwords for you so that you dont need to worry about coming up with secure password in different websites. Some of them are free while there are others that are paid with more enhanced features such as auto syncing with your different devices. Some of the most popular password managers from the top of my head are;

Dashlane

1password

Bitwarden

Lastpass

And many more

Note that many of the password managers listed above are free at first with minimum features but also provide premium features. 

Pass is a completely free and opensource password manger that was previously designed for UNIX system though today, there are many ports available for other operating systems too. It follows the UNIX philosophy well and works completely offline. It also allows importing passwords from some other password managers. It is frankly pretty good however has less userbase than Keepass. 

Keepass is completely free and opensource password manager software. It works completely offline and all of its features are free. While the premium ones above are pretty good, I am not so much of a fan of proprietary software. Which means I favor Keepass over others. Here are the reasons why I use keepass;

• It does not require relying on the Internet, you can use it anywhere and for any purpose.


• It provides a portable Windows version that does not need to be installed in a computer.


• It has been audited by EU-FOSSA.


• You dont need to trust the word of anyone as your passwords are encrypted and stored in your device itself.


• It is one of the oldest and still in heavy development.


• It supports autotyping passwords though not every platform is supported.


• You can upload its encrypted database file to any cloud service provider and email yourself its link or use it completely offline at your choice.


• You can attach secret notes(.txt or any other file format) to enteries with passwords and save it with your database. It is encrypted as well with your master password and some file formats can be directly opened from within Keepass itself.


• Its features can be extended through the use of Keepass plugins though they are mostly by third parties.


• Though initially built only for Windows, there are many Unofficial Keepass ports and you can find one that works in your platform easily(even obscure ones).

Though there are some things to consider before using Keepass.

• It does not support online integration by default though the portable database file can be uploaded to any cloud service provider of choice or be used locally within one's computer.


• There is no way to recover master password if its lost or forgotten. Same is true for many other password managers out there. Its done so that there is absolutely no way of getting into your passwords without the master password.


• There is no support for Yubikey in the official Keepass release though there are unofficial versions of Keepass that support it, namely KeepassXC or one needs to install plugins in the Official Keepass version to have this feature. Same is true for TOTP(one that allows generating authentication codes).


• It's UI may look pretty outdated in the official release but it is still under maintainence as of me writing this. Or there are other unofficial ports of Keepass that has good UI with other features out of the box.
  

Choosing a good enough master password for the password manager

With password manager, you will only need to remember a single password. But it better be a good one as it holds all of your other passwords. Here are some of my tips on having a good enough password as a master password;

Combining your multiple old passwords

If you have changed your password more than once previously, and if you believe those passwords were fairly secure and weren't compromised, the best idea would be to combine them to make even stronger password. That way its not only easy to remember, its only pretty strong. Just dont use weak password if used before.

Creating a password from scratch

Come up with a sentence, any sentence that may seem obscure. For an example, our sample sentence is Though she be but little, she is fierce. A Shakespeare quote

ThOuGh ShE bE bUt LiTtLe, ShE iS fIeRcE
[Flip case in alternate characters]

ThOuGh32ShE32bE32bUt32LiTtLe,32ShE32iS32fIeRcE
[The decimal ASCII value of 'Space' is 32]

For many, it already looks like a secure password. But it can still be improved greatly. Well, coincidently, the decimal ASCII value of 64(32x2) corresponds to '@'. which means, we can replace 32 with '@/2' like,

ThOuGh@/2ShE@/2bE@/2bUt@/2LiTtLe,@/2ShE@/2iS@/2fIeRcE

You get the point here, its all about just making it harder to guess, nothing more. So, from here, you can replace 'a' with '@', 'O' with '0', 'S' with '5' and so on. Actually, some people like to replace the upper case i(I) with lower case L(l) which looks exactly the same to the naked eye depending on the font being used. You can take this to the extreme. Just make sure it will be easy to remember to you. But I will conclude it here.

Password Salting

Password salting is when you insert random characters or group of characters in random places. It should be different for everyone. Lets take an example where we insert '_&' after every 3 characters in our example password we used earlier.

ThO_&uGh_&@/2_&ShE_&@/2_&bE@_&/2b_&Ut@_&/2L_&iTt_&Le,_&@/2_&ShE_&@/2_&iS@_&/2f_&IeR_&cE_&

We only have 2 characters left at the end so we will put it just after 2 characters.

To be clear, the way you choose the position and characters to be inserted should be your own decision. Password salting is more like a recommendation than being mandatory.

How do I personally do it?

I use Keepass password manager. Keepass generates a database file offline with .kdb or .kdbx depending on whether its Keepass 1.x or 2.x. I then upload that file manually to my dropbox and/or google drive along with portable windows exe and compatible app in case I need to use it on other's computer and email myself as well as my trusted friends and family members the link to that file if I loose it. I use an external mini SD card that I took out from an old camera and always carry it around with me in my wallet. Its small and will easily fit anywhere. I prefer this over flash drives as it has write protect switch which will come handy especially when I suspect the computer I am trying contains malware. I will also keep a separate copy in an external flash drive or an external harddrive that is generally unplugged from the computer. I also have backup codes and other notes, including important files added to my keepass database which is encrypted along with everything else. I change my password every month atleast, and when I change one, I change all of them. Thanks to Keepass and the awesome community that powers it, I can sleep peacefully knowing that some other hackers cant just get access to my password database file, let alone crack it.

Taking things one step further

Keepass or any other password manager saves all of your passwords in one place protected by a master password. Which means, if your master password as well as the database file gets to the wrong hand, you are doomed. For this, some people have come up with rather interesting solution.

The solution is to use a new password that you remember and append to the password generated by the password manager. Lets say your second password is theghostwire322 and the one generated by your password manager for a particular website is r3 P:^0T.}q`$#]4 then you may actually use the password r3 P:^0T.}q`$#]4 theghostwire322 in your every password in the password manager which makes it so even if your master password and the password database is ever compromised, your passwords are still safe, assuming of course your appended password is only in your memory. It greatly improves privacy, however, if you believe your password manager database file is safe, you may choose this as optional. However, this is generally recommended if you use an online password manager as they sometimes tend to get hacked.

Please treat above examples as merely an idea. Above example passwords are weak passwords just for conveying the concepts. Dont use any of the above password. In real world, make sure your password is as secure as possible.