Beginner's Guide: Everything About Password Managers

The password manager stores all your passwords and automatically fills them in when they are required by a program or service.

In this article we will analyze what a password manager is, how many types there are, whether you can trust them, what features they should have, what other alternatives you have, what suits you personally. First of all, let's see what features you have in managing your passwords.

Remembering passwords is a headache. Because the use of electronic devices is now widespread, the novice user has to manage at least 20 passwords. For example, he has to remember passwords for 2 emails, 2 for banks, 3 for facebook – twitter – instagram, 1 for Windows, 1 for the router, 3-4 for WiFi, 2 for his mobile phone, etc.

The most advanced one might reach 50, at most 100. A power user struggles with 100-300 passwords and an IT person can easily handle 1000. Our article today is for beginners, and maybe even advanced users. Everyone else knows what to do and the analyses that will be done have nothing to do with you.

For all these passwords, the user should be able to recover them easily, quickly and securely (remember this triptych). How? Let's see

Ways to store passwords – Alternative solutions
A. Using simple passwords
The solution is very simple. You can use the password 123456 everywhere. Okay, we know you’re laughing. But don’t think that the password “p@ssw0rd” or “panatha13” is better than “123456”. Even the variations of a slightly stronger password, like “d1m1tris1970” or “diMitRiSI97O” do you think are better than 123456?

With modern machines and huge databases with codes of all kinds, the above codes are ridiculous to say the least. It's as if they don't exist. But they have one good thing. If the medium you store them on breaks, you'll be able to guess them!!!.

Let's rate solution A from 0 to 10 (with 10 being excellent). Ease = 10, Speed ​​= 10, Security = 0.

B. Local storage in a file
The old classic notebook!!!. Okay, it may not be a notebook, but it is a txt file made with Windows Notepad. We do not rule out, however, that 60+ year old users have an A4 sticky note next to their computer with all their passwords written down.

As a solution, it is good, as long as you have made sure that your passwords are difficult to detect, such as “@D1mi7r15!!Ol@_Ta_l3ftA”, and that you have made sure to backup them to a separate disk. In fact, if you give the txt file an irrelevant name, e.g. “Mauro-provato.txt” and put it under an irrelevant folder, e.g. “c:\dimitris\logotexnia”, it is very difficult for anyone who manages to gain access to your computer to guess what this file might be hiding.

Even if you are hacked with a malicious program, it will search specific places for passwords and for specific programs, for example, it will check if you have a password manager installed, etc.

You can even encrypt it. And the same goes for its backup. Every time you want a password, you have to open it and copy-paste the password you want.

If we were to try to rate solution B, it would get: Convenience = 4, Speed ​​= 8, Security = 10.

C. Local password manager
Download and install a password manager program, preferably open source, and put all your passwords there. This way, every time you want to use a password to log in, the password manager will take over and deliver it without any delay.

The passwords become particularly difficult, on the level of “3#@fd454)23dADFF%^&TRfgh!g2” and can be as long as you want. For greater convenience, these programs also offer you a password generator, so you don't have to sit and type.

However, you will have a “small” problem if you want to use these codes on your smartphone or your second computer or in general on another separate computer. You simply will not remember the codes.

Also, on your main computer, all passwords are encrypted. However, you have entrusted your passwords to a third-party program, which, among other things, is a target for hackers.

Especially if you like to browse porn sites, click on emails that promise you free coupons at that supermarket, or download movies from the dark web, then you're in for a treat.

Rating: Ease = 7, Speed ​​= 10, Security = 8

D. Cloud password manager
The same solution as C, except that the passwords are stored in the cloud. If you don't understand the term cloud, we're saying that they are stored on a server, far away from you, possibly outside your country.

This way you gain the advantage of being able to connect from any device, retrieve and use your passwords even if you are on vacation in Gavdos. Communication with the cloud is usually well encrypted end-to-end and you have nothing to fear about it.

On the other hand, the password manager manufacturer could be hacked (yes, it has been done) and expose millions of passwords to unscrupulous criminals.

Rating: Ease = 10, Speed ​​= 10, Security = 7

What is a password manager?
Password managers are applications that store your passwords in a secure vault, which you can unlock with a single master password and, optionally, an additional two-factor authentication method for added security.

Password managers allow you to use strong, unique passwords everywhere. This is usually not possible for most people. No one can remember passwords like Ew^ei3-uaF$7TaW.vuJ_w!!, while password managers can generate and remember such passwords.

They can communicate with other programs, usually browsers, and retrieve existing passwords from them. They warn you if a password is common in two places and prompt you to change a password after a certain period of time.

They have backup capabilities, can sort your passwords, interact with browsers and thus ensure that they automatically complete the password fields in each of your requests, and finally store your passwords with encryption.

How many types of password managers are there?
There are basically two types. Those that store your passwords locally on your device and do not require an internet connection (offline) and those that store them in the cloud (online).

Offline password managers only take care of the computer they are installed on. They have no communication with your other machines, you can't automatically have your passwords on your mobile phone, and since they are extremely strong, their format is difficult to understand, and long.

When offline, you should always make sure you have a backup, because if your disk breaks or your laptop is stolen, it will be difficult to recover them.

Online ones are easy to manage, they do exactly the same things as offline ones, but in addition they can be accessed from all over the world and from any machine you want. You don't need to have a backup because they usually keep them, although it would be good to always have one. It's better to not have a donkey than a donkey, they say in our village.

In fact, you are already using an online password manager and don't know it. Those of you who have installed Chrome, have saved even one password in it and have logged into Google via Chrome, then your password has been uploaded to Google's cloud and is accessible from any machine, as long as you go here: https://passwords.google.com and log in to your account, to see them.

Can you trust them?
Since you're sharing your life with others, you'll need to show some trust in password management companies. Sure, companies promise to keep your passwords safe, but there's always the possibility that hackers will break into your account and steal your passwords (it has happened). Companies take great care in their security, but what if they turn out to be bad?

Sure, there's a risk. You should trust your password manager just like you would any other app you use. The same goes for any app on your computer or most browser extensions. They could spy on you, and steal your passwords, credit card numbers, and a whole bunch of other things.

With the logic that you are using trusted applications, use trusted password managers as well. It is probably more dangerous to install random browser extensions, many of which gain full access to what is happening in your browser, or to not use any at all and work with 123456.

What features should they have?
There are many interesting features in all of these programs, which make them stand out from each other in terms of both convenience and security. However, you can clearly assume that a password manager should run some minimum features.

We have more or less mentioned the necessary features of a password manager for it to be considered good. However, in summary we will say:

• Be known in the market and have continuous updates and a good track record
• Be able to receive existing codes from your browsers and be compatible with the ones you use
• Have the ability to backup in various formats
• Have two-factor authentication for the master password
• Have a code generator, check for the uniqueness of stored codes
• Be able to inform you about how strong your passwords are.
• Encrypt your passwords with at least AES-256
• It can be automatically shut down after a certain time and not remain open if you forget it
• Be able to accept passwords from other password managers

What's right for you?
And we've come to the crucial question. Too much information, too much science, you're confused and can't decide what you really need.

The answer will come through the extraction method, if you ask the question correctly: What are your needs? If we take some user cases that you are probably in and see what their needs are and what they need to do.

Case A: Beginner user, occasional on the internet, with 20 codes.

You are a user with a few passwords that are usually on Facebook, Twitter, a bank, 1-2 forums, 2-3 online stores and an email. Do you think if someone malicious gains access to one of them or even all of them, will there be a problem? What if someone hacks your Facebook and while you are Olympiacos, they write under your name “^%#%* the legend and Piraeus”?

And what happened? You'll request a password change from Facebook, you'll prove that you're yourself, and when you regain access to your profile, you'll delete his messages and laugh with your friends about this whole story.

Did they steal your bank password? Well, by the time you realize it and call the bank, the criminals will get in, see how much money you have, what transactions you have made, but they won't be able to make any transactions. All banks (with the exception of PayPal) have integrated two-factor authentication for all transactions. To make a transaction, thieves must have either your mobile phone unlocked or the coordinated random code generator (a small machine, like a coin) at the same time.

They can only make transactions with the State without requiring a second code (and not with all banks) and at most pay your tax.

You don't really need the best security in the world. Since the more security you increase, the less convenience and speed you get, the more likely you are to struggle with your online life. It's like trying to kill a mosquito with a cannon.

The solution of an online password manager with the features we mentioned above, fits your situation. It is much better to invest in convenience and speed, especially now that everything on the internet is new to you. And of course, stop using the password 123456.

Case B: Advanced User with 50 Passwords
You are the user with some years of experience on the internet. You have passwords for 2-3 emails, for various sites, you may have a Facebook account with 2000 friends, or even manage a blog.

First, consider whether you are a target. If you think you are or could be targeted, then invest in security. If you think, “They won’t bother with me,” then look at your convenience.

We're not talking about if you're obsessive-compulsive and think the world will end if your Gmail account is hacked or your non-public Facebook photos are seen. There, nothing happens, and so you can at least sleep peacefully, choose the safest option available.

In a normal psychological state of a user, this user should ask themselves which passwords have some monetary value, emotional value or responsibility to third parties. For example, a 2000 friend Facebook account can become profitable, your friend whose blog you manage may be misunderstood and not justify a violation due to your own fault, a cloud space with your children's photos stored may not provide you with a backup if it is violated.

In this user case, prefer a mixed solution, such as an online password manager for those passwords you don't care about and a txt file for the 5-6 important passwords. But make sure to give them strong and long names that you will be able to remember. An example of such a password is “ArnAki-A5pro-kAi-pAxi!!”.

Case C: Power Users
In reality, these users know what they need. They are aware of what they have in their hands and how they should manage it. This article is not addressed to them, but we want to share with you some of our old articles that may concern them.

Password manager local or in the cloud?
Vulnerabilities in password managers can be exploited by hackers
Are you safe with password managers on Android?
Password Managers – Crash Test: The most popular tools on the market!

Application Suggestions
We do not wish to advertise any product, especially if it is paid. We will only talk about free and open source programs that in our opinion are worth your look.

So check out programs like Keepass, KeepassX, TeamPass.

We have mentioned Keepass in particular quite a bit in our previous articles.

Welcome to the wonderful world of the internet.