How do you keep safe?

[Rebel_L]

With the recent public database hackings I have been putting some thought lately into how to properly manage all my logins and passwords online, and have come to the conclusion that I need to change my ways. I am however now sure what sort of level of paranoia I should be exhibiting but I do know that what I currently do is definitively not enough.

Now I always figure that I am less prone to sign up for things online than most people but just thinking about all the accounts I do have (emails, message boards, games, shopping, banking) I still come up with at least 16 that I have used in the last year, and if one was counting all the accounts Ive had online it would double or more. The first thing that comes to mind after coming up with that number is that there is now way I am capable of remembering 16 unique logins, never mind 16 strong unique passwords.

Currently I run with only a few different logins and couple of passwords split up amongst the different categories, these of course I dont ever change so I can still log into and old dormant account later because the password can only have been one of a few things. This sort of strategy seems like it is waiting to bite me in the ass at some point but it is likely a byproduct of being online long enough ago that I was more worried about someone physically stealing a list of passwords than hacking my computer.... well and some laziness too. I do my best not to store things like credit card info with accounts and such, but even that dosnt always seem possible.

So while that is a fair bit rambling I really do need to find a proper approach to managing identities online. Now a spreadsheet seems like a nice way to keep track of logins and passwords, but do I need to take the threat of my personal machine being hacked serious enough that I dare not keep a copy of it on a machine that is online? How important are unique logins to go with the unique and strong passwords? Is using the Save login/password function of browsers a blessing or a curse? On the one hand they are saved on your system which seems to make them a target for a hacker (although I assume they are encrypted enough for this to not be a problem... but then assuming is bad right) and of course on the off chance your PC is actually stolen they are ready for thief to use. On the other hand if you have a keylogger slipped into your system the risk of loosing an account is much higher if you are typing them in every time you use them. How important is changing your password on a regular basis really? Should you do it for accounts that have been dormant for years but you cant delete?


Now Im not even sure if I have covered everything important, but really what Im looking for a is a practical way to deal with the issue that dosnt turn into a full time job while giving me a good measure of protection. So what do you do keep your logins/passwords safe?

 

[Chiefcrowe]

have you considered a password management program like keepass?

I store mine encrypted but i may move to a program. I don't save any critical ones in my browser either.

I know a friend who uses password dragon and puts the file on dropbox so he can access it from multiple computers.

 

[FishAk]

I use a two pronged approach. Both PasswordSafe and LastPass, which are free. PasswordSafe has the advantage of not requiring any type of internet connection. LastPass has the advantage of convenience for the internet. I use PWS to record all my passwords except two. One to access PWS, and one to get into an encrypted backup copy of PWS which I keep in a few places online in case of an emergency. These are the only two password I need to remember. I open PasswordSafe to retrieve my LastPass password and log into LastPass. Using this method, only a keylogger that can record the contents of the clipboard, can return the LastPass password to an adversary. When PWS is closed to the tray, the clipboard is dumped. LastPass is very convenient for online accounts- decidedly more than PWS, but I like the fact that with PasswordSafe, I can keep a record that doesn't interact with the internet. I understand that you can access your LastPass “Vault” locally without internet access, but I have some passwords that I'm not comfortable putting on the “Cloud” without using a hidden TrueCrypt container.

 

[Chiefcrowe]

I like your thinking! i should look into doing something like this!

I use a two pronged approach. Both PasswordSafe and LastPass, which are free. PasswordSafe has the advantage of not requiring any type of internet connection. LastPass has the advantage of convenience for the internet. I use PWS to record all my passwords except two. One to access PWS, and one to get into an encrypted backup copy of PWS which I keep in a few places online in case of an emergency. These are the only two password I need to remember. I open PasswordSafe to retrieve my LastPass password and log into LastPass. Using this method, only a keylogger that can record the contents of the clipboard, can return the LastPass password to an adversary. When PWS is closed to the tray, the clipboard is dumped. LastPass is very convenient for online accounts- decidedly more than PWS, but I like the fact that with PasswordSafe, I can keep a record that doesn't interact with the internet. I understand that you can access your LastPass “Vault” locally without internet access, but I have some passwords that I'm not comfortable putting on the “Cloud” without using a hidden TrueCrypt container.

 

[Modelworks]

The first thing I do is make sure all passwords are as long as the site will accept for things like banking. If the site will take a 255 digit password, then I generate one that long. The next thing I do is never login to banking anywhere but my own computers. I don't use public internet for those.

I use lastpass and keepass for storing the passwords but I use a fingerprint scanner for the login . I bought a laptop that had one on it and decided to make use of it. For the desktop , scanners have gotten really cheap and the benefit is you never have to remember a master password again. You can put in all your fingers fingerprint and use any one of them in case you get cut or something and mess up one print. Their are scanners on ebay for under $15 that just plug in the usb port. Connect to a site and you just swipe your finger to gain access.

Sensitive emails I do not keep on sites like gmail. I use a paid email server , you can get them for under $12 a year, and then I download everything from that server daily and keep it local . Sites that are free pay for that by reading your emails and targeting ads .

 

[Firetower]

Modelworks, who do you use for the email service?

 

[KeithP]

PasswordSafe has the advantage of not requiring any type of internet connection. LastPass has the advantage of convenience for the internet.

LastPass has an offline mode, from their support site..

When you login to the Internet Explorer, Firefox, Google Chrome, Safari, or Opera plug-in, LastPass downloads and stores your encrypted data. If we're offline you're still able to login in offline mode, but you'll be unable to add or change sites while LastPass is off the air.

I would think the way to go would be LastPass with a Yubikey. http://www.youtube.com/watch?v=tYF3YZsEOG8 (which is what I am thinking about doing)

-KeithP

 

[Chiefcrowe]

thanks. that yubikey sounds really nice. i like how that works.
what happens though if you happen to lose it or it is stolen?

 

[Firetower]

The one thing with LastPass is that your email account you use in conjunction with the LastPass service is you need to remember your complex password for the email.

If you lost your yubi key what happens when you enter your passwored in lastpass it asks for your yubi key. There is a link if you lost it it would take you to a recovery page and it sends you a code or link to your email address. Which would then disable the yubi key requirement for you to login.

 

[KeithP]

thanks. that yubikey sounds really nice. i like how that works.
what happens though if you happen to lose it or it is stolen?

That is one of things I have been researching before I switch over to Lastpass from 1Password. The simplest solution seems to be ordering a backup Yubikey. Lastpass allows up to 5 Yubikeys to be associated with a single account. You can have your primary yubikey and a backup key stored/hidden in a secure location. If the main key becomes unavailable for any reason, bust out your back up key, sign in and remove the lost/damaged key from the account.

-KeithP

 

[Chiefcrowe]

ah, there we go. that seems like a good solution to me! thanks.

so then, if you happen to lose both keys that you have you can still order another one right?

 

[Firetower]

Yes

 

[Dravic]

passwordsafe on bitlocker passworded thumb drive

surf with noscript enabled

very little (wife uses facebook, not me) facebook/myspace/twitter etc.. (security professional and don't like the exposure)

smoothwall firewall with egress (outbound) blocking, its amazing how much crap woud like to phone home but doesnt require it for functionality.

I dont use public internet computers, or wifi hotspots

 

[KeithP]

There is a podcast called "Security Now", they had an episode where they talk with the founder/CEO of Yubico, the company that makes the Yubikey. They also did an episode on Lastpass. They might be worth a listen.

http://www.twit.tv/sn143
http://twit.tv/sn256

-KeithP

 

[Cr0nJ0b]

passwordsafe on bitlocker passworded thumb drive

surf with noscript enabled

very little (wife uses facebook, not me) facebook/myspace/twitter etc.. (security professional and don't like the exposure)

smoothwall firewall with egress (outbound) blocking, its amazing how much crap woud like to phone home but doesnt require it for functionality.

I dont use public internet computers, or wifi hotspots

what do you use for egress?

 

[Rebel_L]

I just wanted to thank you all for the replies, there is lots of good ideas here and I am going to put some of them into practice.

 

[Dravic]

what do you use for egress?

smoothwall express 3 will do egress.

 

[LiuKangBakinPie]

If you want to see if you mail was part of it and if you should change your password go here
https://shouldichangemypassword.com/
Just enter your email adress and it will tell you if its compromised

If your looking for some background info on the mentioned go here
http://blogs.forbes.com/parmyolson/2...-e-mail-vault/

 

[smakme7757]

I've been using Lastpass + Yubikey for a while now, it's a fantastic combination. I have a different passwords at each and every site i visit. I also backup my Lastpass database every week to an Ironkey for safe keeping. It's also worth noting that you can exclude machines from Yubikey verification if you are sure those machines are safe (i have excluded my home desktop for example).

I actually have 5 Yubikeys to use in conjunction with my encrypted hard drives. My laptop has full drive encryption as i travel A LOT! I would hate for a pedophile or theif to get hold of naked photos of my baby girl!!!!!

You can never be too careful these days, but a great start is getting a password manager and creating new and unique password for each and every site you visit.

It's also important to note that security doesn't have to be time consuming. Sit down and decide what you need to protect. Then go through your options and find the optimal way to organise your life securely online.