Password Managers. Victor (Vic) Daniel. Handout Page 1/38

Transcription

1 Victor (Vic) Daniel Handout Page 1/38

2 Authorization vs Authentication Authorization refers to rules that determine who is allowed to do what. Authentication is the process of determining that somebody really is who she/he claims to be. We will not concern ourselves with Authorization only Authentication. Handout Page 2/38

3 Authentication Factors consist of Knowledge factors - Something you know (e.g. a password, pass phrase, PIN, address, User ID). Ownership factors - Something you have (e.g. wrist band, ID card, security token, cell phone with built-in hardware token, software token, or cell phone holding a software token). Inherence factors - Something you are (e.g. fingerprint, retinal pattern, signature, face, voice, or other biometric identifier). These three Factors constitute Multi-Factor Authentication. Handout Page 3/38

4 If we use any two (2) of these Factors it is called Two-Factor Authentication or 2FA. LinkedIn, Google, Apple, Twitter, Microsoft, Dropbox, Tumblr, etc. offer 2FA.You don t currently have to use it. From the definitions above, we can see that an Address/UserID and Password/Passphrase is really Single- Factor Authentication or 1FA. Password Managers, by and large, use 1FA. This doesn't, however, mean that they're insecure or vulnerable. Handout Page 4/38

5 What are Password Managers? They are classes of software which allow us to save and retrieve all of our passwords that we ve previously stored. Handout Page 5/38

6 What do they do? Password Managers They not only allow us to save and retrieve our passwords but they also manage associated Userids, Addresses, URLs (Uniform Resource Locators) such as and other pieces of information that we may consider important. Handout Page 6/38

7 Why do we need them? Well the alternatives might be to: Memorize the passwords at all those sites with which we do business. Use the same password at all sites. Use weak passwords (e.g. Mother's Maiden Name). Write them down on pieces of paper. Write them to a file on our desktop and/or mobiles. Handout Page 7/38

8 Or we could use a password manager! This password manager software is generally a standalone application on your desktop computer or mobile device (notebook, tablet, phone, etc.). Handout Page 8/38

9 How can they simplify our lives? Imagine having to remember just a single password (passphrase)! Imagine never having to ask family or friends to help us to recall passwords! Handout Page 9/38

10 How many useful ones exist out there? There are many such software offerings of which I ve listed: 1. 1Password ( 2. Dashlane ( 3. Encryptr ( 4. KeePass ( 5. Keeper ( 6. Keychain ( 7. LastPass ( 8. Mitro ( Handout Page 10/38

11 9. msecure ( 10. oneid ( In reality, only about three (3) of them are in wide consumer use. They are, in no significant order: 1. KeePass 2. LastPass 3. Password Safe For ipod, ipad, iphone and Mac users: o AppAdvice ( or just google password manager iphone ipad mac Handout Page 11/38

12 Which one will we be looking at? We ll be looking at KeePass in some detail. KeePass stores URL s, Userids/ Addresses, Passwords and free-form notes of our choosing. It has the ability to start our default browser (if it hasn t already been started). It then supplies the URL of our chosen site to the browser And then offers the sign-on prompt screen the correct Userid/ Address and Password. Handout Page 12/38

13 Benefits? Password Managers We need know nothing other than how to select the correct password manager entry (e.g. BNS, TD, BestBuy, Canadian Tire, Toys r Us or whatever)! We can also store as Notes; The date on which the account was created. A list of potential Security Questions and their associated answer(s). The telephone number(s) we registered with the company, at which we might be contacted in the event that we need to be reached. Handout Page 13/38

14 The product serial number(s) and model(s) of item(s) purchased from the site. The paranoid amongst us can even store the gist of web chats (chat transcripts) so that we can authoritatively argue with corporate monkeys! Handout Page 14/38

15 Can Heaven be any better?! Needless to say, the Master Password/Passphrase for your password manager should be: o A phrase not just a series of jumbled characters. As an example; I m entitled to my 3 entitlements! Remember, case is significant. Make the phrase one you can easily remember. o Written down and placed in your Safety Deposit box and away from your jewelry (too obvious)!!! Handout Page 15/38

16 How to obtain KeePass 1. Start a browser on your Windows computer. Life s easier that way. In the browser s Address Bar simply type keepass (without the quotation marks). And then press Enter. Figure 1 2. This will present something like the below Handout Page 16/38

17 Click on Downloads Figure 2 Handout Page 17/38

18 Figure 3 3. Now you ll want the Installer version so click on the Download Now image under Professional Edition (Figure 3) Handout Page 18/38

19 4. This will start the Download process. Click on Save File (Figure 4) and when prompted, Save it to your Desktop (Figure 5) or wherever you ll be able to find it later. Figure 4 Handout Page 19/38

20 Figure 5 Handout Page 20/38

21 You will now have to double left-click on the filename you just saved in order to start the installation process. Figure 6 5. Follow the instructions and prompts presented. Handout Page 21/38

22 Figure 7 This opens up the Select Setup Language dialogue offering English as the language for installation. Handout Page 22/38

23 Figure 8 Click OK. Handout Page 23/38

24 Click Next Figure 9 Handout Page 24/38

25 Figure 10 Accept the agreement and click Next. Handout Page 25/38

26 Figure 11a And again, click Next Handout Page 26/38

27 Figure 11b And click Next again Handout Page 27/38

28 Figure 12 Ensure that you check Create a desktop icon and again click Next Handout Page 28/38

29 Figure 13 Now click on Install. As shown in Figure 14, un-check Launch KeePass and click on Finish to complete the installation. Handout Page 29/38

30 Figure 14 Creating a KeePass database. Now double-click on the KeePass Setup desktop icon to launch/start KeePass. Handout Page 30/38

31 You ll now create your password database by clicking on the New icon (Figure 15). This will present you with the Save dialogue (Figure 16). Once you have selected a save location, click Save to bring up the Create Composite Master Key dialogue (17). Handout Page 31/38

32 Figure 15 Handout Page 32/38

33 Figure 16 Handout Page 33/38

34 You re now at the Create Composite Master Key dialogue (Figure 17). Read the explanations carefully and then choose the option to create a Master Password. Please, please use a passphrase. Handout Page 34/38

35 Figure 17 Handout Page 35/38

36 Figure 18 Handout Page 36/38

37 Click OK to dismiss the Create New Database Step 2 dialogue (Figure 18). You re now ready to create your own entries (samples are already provided for you) as indicated in Figure 19. We ll cover this in the Demo session. For now, click on the close X or use the File>Exit menu item to close and exit KeePass. Handout Page 37/38

38 Figure 19 Handout Page 38/38