Originally published on CUInsight.com
It’s a topic you’ve seen here before. Time and again. Of course, it’s still pertinent since we keep using them. Passwords are a bane of the tech world. Unless you can invent a simple way to authenticate yourself with any service, they’re going to stick around for a while.
That doesn’t mean we need to despise them, though. In the past, we have discussed the problems on both ends, from policies that lead to creating awful passwords, to people insisting on using “love”, “*dogname*”, and “!23456”.
Grab your favorite password and…throw it in the trash (sadly, even “CorrectHorseBatteryStaple“). Because we’re back.
Password Confusion
Like the question of eggs being healthy or your worst nightmare, passwords see a wide variety of advice as the years go on. Some of it is due to a long period of terrible advice (which we discussed before, and, I’ll admit, my own suggestions evolved, too).
Thankfully, this is changing…slowly. The other part is based upon processing speed increases; it’s easier than ever to parse billions of possibilities (using databases of common passwords from leaks combined with dictionary analysis). So what’s the current solution?
Password Managers
It’s lurking in plain sight, on all your devices. The best password is one you never create. Every modern platform supports strong password suggestions. Then, they save these passwords in a secured database, so you don’t have to put a note in your drawer (it’s ok, you’re not alone).
Depending on the system, there might be a master password, or, it can combine with biometrics. Make this be your big, strong password, then never use it. Rely on the fingerprint scanner, FaceID, or other verification system.
On iOS & iPadOS , all current versions have automatic strong (Apple calls them complex) password creation and storing capabilities. That means, when a site asks to create a password, your phone already filled in a really good one. Then it saves it so you never even bother thinking of something.
To log back in, your phone just asks for verification through TouchID or FaceID (depending on device). This is new; auto-fill now has security, too. Yes, you still have to create a unique username. Sorry, MarioKartKing is taken.
Apple Creates “Password Manager Resources”
This automatic password creation isn’t perfect. If you used this system for any length of time, you ran into this situation:
- Go to site to create account
- Enter username
- Fill in good password
- System gives an error
- Try again with a new random password
- Error again
Why? Your password was “too complex” for their platform. Whether using “unusual characters” (like hyphens) or simply too long, their site won’t accept it. What do you do then? If you’re like most, you just make up your own.
This one won’t be as good. Sorry, it’s just reality. So Apple is doing something about it. Their new open-source project Password Manager Resources seeks to end that scenario. How?
The project will let developers build site-specific criteria. That way, when your device creates a password, it will know the limitations of that site. So your strong password will also work.
As a new system, I look forward to it doing two things:
- Letting people mindlessly create complex passwords on any site.
- Encourage sites to adopt a better password policy.
Changing Password Regularly…Or, not?
There’s another side of this revisit: Updating your password. I know, I know, I spoke strongly against this practice in the past. My position is unchanged. If you change your password, make it for a good reason.
A brilliant website called haveIbeenpwned.com checks your e-mail address or usernames to see if they were included in any breaches. If so, it shows which and to what degree.
Then, you know it’s time to update those passwords (and anywhere else you shared those credentials). That password auto-suggest is looking mighty nice right now.
They partnered with Firefox so you can get alerts for any new breaches involving your information. With a Firefox Account, you can add as many e-mail addresses to this monitoring. Then, you can go through the list and “resolve” those you’ve already changed.
So, changing passwords regularly is unnecessary. Creating strong ones that are unique to each site is essential. Then, use a service that tells you if any sites are compromised. Simply change that password and you’re good to go!
Email Aliases Too?
An extra level of protection on top of that is creating email aliases for each of these accounts. That way, if the email is leaked, prospective hackers won’t be able to link it to other accounts.
In a sense, there’s no technical reason why we can’t have unique everything for every account nowadays. Apple’s iCloud+ has a feature to Hide My Email, automatically creating aliases for each account, along with a 2FA code.
Gmail has long supported aliases. Just use a “+” after the username part of your email (before @gmail). In this case, hackers could easily figure out your original address by doing an automated removal of the +aliaspart, but it’s something.
Use a Password Manager
Here’s the bottom line: With password managers so prevalent and easy to use, there’s no excuse to still create your own passwords. It’s putting you (and the data within) at unnecessary risk. It also saves time.
When I read of a breach on a service I use, I just go in, update that password, and get back to my life. Since it won’t be shared with any other system, I don’t care what someone does with the information.
Granted, if passwords were stored in a way someone could access them, I’d be questioning the utility of said service, given their poor security practices.
Bottom line of the bottom line: Complex, random strings of characters, stored in a quality password manager, is the best way to ensure your personal (or corporate) information remains only in the hands you want.
Resources (A non-exhaustive list of password managers)
OS Based:
- SmartLock for Passwords (Android/Chrome)
- iCloud Keychain (Apple, Chrome, Edge)
- Microsoft Edge (Windows 10/11, Android, iOS) (Full Office 365 password manager rumored)
3rd Party:
- Firefox Sync
- LastPass
- 1Password
