{"id":4921,"date":"2020-06-30T11:00:00","date_gmt":"2020-06-30T08:00:00","guid":{"rendered":"https:\/\/blog.eset.ee\/?p=4921"},"modified":"2020-06-30T14:49:48","modified_gmt":"2020-06-30T11:49:48","slug":"what-is-a-password-manager-and-why-is-it-useful","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2020\/06\/30\/what-is-a-password-manager-and-why-is-it-useful\/","title":{"rendered":"What is a password manager and why is it useful?"},"content":{"rendered":"\n

Recently we commemorated World Password Day with an article that dealt with five common mistakes to avoid<\/a> when it comes to passwords. And although password protection can be considered a cornerstone of our digital existence, we rarely give it deep thought. Nothing drives that point home more than the annually compiled lists of the most-used password<\/a>s, which have ranked 12345 <\/em>and password <\/em>among the most-common choices year after year.<\/p>\n\n\n\n

Our preference for flimsy passwords can be partly attributed to our use of a gazillion different services, which \u2013 unless you connect everything to your Google or Facebook account \u2013 often implies creating a new account. On the other hand, if you do have multiple complex passwords, they may prove difficult to remember. So, you opt to recycle the same simple password<\/a>, since you\u2019re thinking: where is the harm? Well, if a hacker breaks a recycled password, then your accounts may become an all-you-can-eat breakfast buffet for the attackers.<\/p>\n\n\n\n

This is what a password manager \u2013 an application specifically designed to store your login details in an encrypted vault and to generate complex passwords for you \u2013 can help you avoid. By making it supremely easy to create, save and autofill a unique and strong password for each of your online accounts, this \u2018digital safe\u2019 can be an effective solution to your conundrum. All you<\/em> need to remember is a single password called \u2018master password\u2019 .<\/p>\n\n\n\n

Types of password managers<\/h2>\n\n\n\n

Most popular password vaults function as cloud applications that can be accessed through a browser. Regardless of your password manager of choice, you\u2019ll have to create one strong master password that will protect all your stored credentials used to access the different services you use; so be very careful about your choice. In the case of a cloud-based manager, this is part of creating an account.<\/p>\n\n\n\n

The manager will then take it from here. You can add all your existing accounts to it and when you sign up for new services, you can either use your own passphrases<\/a> or it will use a built-in generator to create randomized, long, and secure passwords. Once you want to sign into any of the services that you use, the password manager automatically fills in your credentials and you\u2019re all set.<\/p>\n\n\n\n

If you have an issue with trusting cloud-based applications with your passwords, you can opt for a locally hosted vault, which will store everything on your device. In fact, you can choose from a number of open-source options, which provide a lot of the functionality of their cloud competitors, albeit often in a more modest design package. But what these apps may lack in aesthetics, they make up for in features.<\/p>\n\n\n\n

Another option that you can go for besides cloud-based and open-source solutions are the managers that are included in reputable endpoint security suites and represent a suitable option to help you manage and secure your login credentials.<\/p>\n\n\n\n

The pros and cons of using a password manager<\/h2>\n\n\n\n

There are various types of password managers to choose from, with cloud-based options being among the most popular. The added benefit of them using the cloud is having access to your passwords from anywhere. Most of the popular brands (1Password, Dashlane, LastPass, etc.) offer apps for your smartphone, so if you use multiple devices (which most of us do), then cloud-based services will sync all your passwords across all devices. Some even have desktop options and browser plug-ins, so they have all of the bases covered.<\/p>\n\n\n\n

When it comes to subscriptions, the basic set of options is offered for free. If you find those lacking, you can always pay for one of the more premium tiers, which usually include more settings and added security features.<\/p>\n\n\n\n

As convenient as all of this sounds, it comes with one caveat. You\u2019re putting all your eggs in one basket, as it were; and some online password managers have faced their share of problems in the past. A few months ago  for example, researchers found security flaws in a number of popular password managers<\/a>: some Android versions of their apps were found to be susceptible to phishing attacks, while others allowed endless attempts at entering the master PIN.<\/p>\n\n\n\n

It is important to keep in mind that since your data is stored on a server, in case of a breach or a successful hack, cybercriminals can download the information in bulk and your account may end up in that data trove. Should this happen, you are dependent on the operators of your chosen service having properly implemented strong encryption and<\/em> on the strength of your master password; keep in mind that it guards the gate to most of your digital life.<\/p>\n\n\n\n

RELATED READING: How to spot if your password was stolen in a security breach<\/a><\/em><\/p>\n\n\n\n

As with any service, do your due diligence and read through the cybersecurity blogs and reviews from reputable independent testing organizations to see if the password manager of your choice has had any reported vulnerabilities recently. You should also thoroughly read through and understand and act upon all the security measures that the service has put in place to secure your passwords and accounts.<\/p>\n\n\n\n

When it comes to the locally installed open-source applications, some are able to generate passwords that cater to the specific requirements a site has for their creation. KeePass, for example, also has the nifty option of running straight from a USB. With open-source applications such as KeePass, you can also search for professional security audits of the core encryption and security function code.<\/p>\n\n\n\n

Some things that might seem like drawbacks in password managers that store everything locally may actually add security. Since the codes are stored on a specific device, you may not have the option to sync them across all your other devices, but for a cybercriminal to gain access to them, they would have to target you specifically; this makes their job all the more difficult to perform. One of the ways they can access your passwords is by compromising your device by installing a keystroke logger. That makes the case for password managers included in endpoint security solutions, which are specifically designed to protect you from such threats.<\/p>\n\n\n\n

On the other hand, you have to keep in mind that if you lose the device or it malfunctions, you may lose access to all your passwords that were stored on it. So, always keep a backup at hand, you never know when you\u2019ll need it. That applies to locally installed open-source solutions as well; losing a device should be less of a problem with a cloud-based solution, since you can still access your passwords from another device.<\/p>\n\n\n\n

Final thoughts<\/h2>\n\n\n\n

Although most of us have similar needs when it comes to managing our digital lives, there may be minute differences in our preferences. So, you need to be aware of which option suits your requirements the best. There are at least a few questions you should answer for yourself when choosing a password manager:<\/p>\n\n\n\n