• Search for:
    4Mar, 2023
    Password manager security: Which is the right option for me?

    The first guide of our two-part series helps consumers choose the best way to manage their login credentials

    While we continue to wait for the long-awaited password-less future to arrive, individuals and enterprises are still stuck with the problem of how to manage their countless, proliferating login credentials.

    Whether they allow browsers to save passwords, rely on Apple’s Keychain or another operating system utility, or trust a dedicated app, most people and organizations now use some form of password management utility.

    A password manager creates an encrypted vault that securely stores credentials. These are protected by a master password.

    Most consumer-focused apps can also create unique, random passwords and support safe credential sharing between friends and family members.

    Some also contain extra perks such as detecting reused passwords and monitoring your accounts for possible data breaches.

    Given the differences in functionality and pricing tiers, The Daily Swig is offering a comparative, two-part guide to some of the most popular password management utilities available for consumers and businesses.

    This article, part one of our series, looks at consumer password manager options, while part two will showcase some of the best choices for enterprises. Stay tuned for the forthcoming second guide.

    1Password

    1Password offers an easy sign-up process and printable digital key for recovering your account in case you forget your master password.

    The application has apps for macOS, Windows, Linux, Android, and iOS as well as a Chrome extension that enables a user to auto-fill login information on websites and store new credentials in their vault.

    The tool allows you to create multiple vaults to organize your data for various purposes (personal, work, etc). In addition to login information, you can use 1Password to store credit card information, API tokens, crypto wallet recovery seeds, and other sensitive documents or data.

    The password manager also allows you share to passwords with other users. You can tweak the sharing feature by setting expiry dates, maximum number of views, and specific email addresses that can access a password.

    1Password’s Watchtower feature monitors your account for reused passwords, vulnerable passwords, and potentially compromised accounts.

    The application also has a Travel Mode for special circumstances where your devices might fall into unwanted hands. Vaults that you mark as not safe for travel will disappear from your devices when you turn on Travel Mode and reappear when you turn the feature and re-connecvt to the internet.

    The password manager offers no free-of-charge plan and instead offers personal ($2.99 per month) and family ($4.99 per month) subscriptions. With the family subscription, you get five premium accounts and the ability to create shared vaults that you can use together.

    Bitwarden

    Bitwarden offers a full range of standard features including the ability to import data from other password managers, creating multiple vaults, sharing passwords with other users, and syncing vaults across multiple devices. It has apps for all major operating systems, extensions for nine different browsers, and a command-line interface for writing scripts.

    One feature that sets Bitwarden apart is its strong free-tier option, which provides features that most users typically need. The premium subscription ($10 per year) also adds security reports, stronger 2FA (two-factor authentication) options, 1GB of encrypted storage, a OTP (one-time password) generator, and emergency access to your vault by other (nominated) Bitwarden users.

    Bitwarden also has a family plan ($40 per year) with six accounts, shared password collections, and shared encrypted storage.

    Bitwarden is an open source program, which means you can host it on your own servers if company or industry regulations prevent you from storing your credentials in the public cloud. However, to get the full range of features, you’ll need to purchase a premium license.

    Dashlane

    Dashlane is another online password manager that provides basic features to store and secure your passwords, including creating vaults, generating passwords, filling online forms, and importing data from other managers.

    The tool provides a very limited free plan that only works on one device. The advanced tier ($2.75 per month) removes the device limit and adds a service that monitors the dark web for breached passwords and compromised accounts.

    The premium plan ($4.99 per month) adds VPN support, and the family plan ($7.49 per month) provides 10 premium accounts plus a dashboard to manage accounts and shared resources.

    Unlike other password managers, Dashlane doesn’t have a desktop application – PC users must do everything through the web portal and browser extensions. But it does have mobile apps for Android and iOS.

    Dashlane allows you to share passwords with other Dashlane users and set limits to what kind of access they will have to your credentials.

    Dashlane’s emergency access feature also allows you to specify a contact who can assume ownership of your account in case you lose access, and you can specify a waiting period to accept or reject the user’s request to access your vault.

    KeePass

    For users who don’t trust online services with their passwords – a legitimate concern after the LastPass debacle – KeePass is a convenient alternative.

    KeePass is a standalone application that provides many of the functions you would expect from a professional password manager, but with some notable exceptions. Absent features include the ability to auto-capture new passwords, syncing across multiple devices, password sharing, and scanning the web for breached accounts.

    KeePass also fails to offer a web interface, browser extensions, or support for multiple platforms. The package comes as a Windows application, although being an open-source project means developers have ported it to other platforms. You’ll find links to these software packages on the KeePass website.

    In KeePass, you can create password databases to store passwords, notes, and documents. These password databases can be copied to other devices, but you’ll have to sync them manually.

    KeePass lacks support for many types of data, such as credit card info and API tokens, by default, but you can customize the utility to support different data types. Instead of autofill, KeePass has an auto-type feature that emulates typing your credentials on the keyboard, a feature than can require a bit of getting used to.

    While this is not the most convenient password manager, it is a decent option for advanced users who want full control of their data and the ability to tinker with the software.

    Operating system password managers

    Alternatively, you can use a tool that comes bundled with your operating system. Most popular among them is Apple’s Keychain, which encrypts and stores your passwords in a secure vault on your device.

    The main advantage of Keychain is its deep integration with the Apple ecosystem. It automatically detects and fills passwords for websites, applications, WiFi networks, and more. It can also be synced to your iCloud account and made available across all your Apple devices, including Mac, iPhone, iPad, and Apple Watch.

    So Keychain is convenient if you only use Apple devices. But if you have other operating systems in the mix (Android, Windows, Linux), then you’ll need a separate password manager. You also won’t be able to use it if you want to log into one of your accounts from a friend’s device or a public computer.

    Resource : https://portswigger.net/daily-swig/password-manager-security-which-is-the-right-option-for-me

    17Jan, 2023
    A Secure User Authentication Method – Planning is More Important than Ever

    When considering authentication providers, many organizations consider the ease of configuration, ubiquity of usage, and technical stability. Organizations cannot always be judged on those metrics alone. There is an increasing need to evaluate company ownership, policies and the stability, or instability, that it brings.

    How Leadership Change Affects Stability

    In recent months, a salient example is that of Twitter. The Twitter platform has been around since 2006 and is used by millions worldwide. With many users and a seemingly robust authentication system, organizations used Twitter as a primary or secondary authentication service.

    Inconsistent leadership and policies mean the stability of a platform is subject to change, which is especially true with Twitter as of late. The ownership change to Elon Musk precipitated widespread changes to staffing and policies. Due to those changes, a large portion of staff was let go, but this included many individuals responsible for the technical stability of the platform.

    This culminated in an outage of Twitter’s SMS two-factor authentication. With delayed or non-existent texts, many users could not log in to Twitter. This affected systems that relied on Twitter as their primary and secondary authentication provider.

    Not limited to authentication issues, with the changes come a renewed concern over the safety and privacy of user data. Twitter has been under an FTC consent decree from past problems surrounding user data, and a good portion of the staff responsible for compliance has been let go. Even if the authentication provider stays up, it may leave an organization in an uncomfortable position regarding the state of their stored on Twitter’s servers.

    Strategies for Authentication Service Stability

    Using a platform’s well-established and robust authentication service can save organizations time and money over implementing their own. Cutting out third-party platforms is typically not feasible or even recommended. Instead, proactive planning is essential if an organization needs to maintain stability and security with its authentication platforms.

    It’s crucial to ask and answer the following questions when considering how your organization’s authentication service would handle potential disruptions in authentication providers.

    • Does the organization’s authentication service support multiple identity providers?
    • If a provider is unavailable, is there a backup provider, and how quickly can providers be switched?
    • What is the disruption to users? Will they be logged out of current sessions, or will it be seamless and take effect on the next login?
    • If MFA is configured, what are the available options? Are there multiple methods to verify the user, and if one is removed, does that degrade authentication services?

    If an organization chose Twitter as a source of two-factor authentication, it might find that recent events indicate a necessary change. If so, the switch could be made easier if multiple MFA platforms were already available and configured.

    If an organization can choose the active authentication system based on current needs, then even the problems shown with a major platform such as Twitter would be mitigated, and the organization’s users would see little change.

    Offering Multiple MFA Options

    To understand how this works in practice, one can look to Microsoft. With Azure, once MFA is configured, you can offer several options or limit the available verification methods. Instead of an SMS, you could receive a phone call or use a hardware token. If you offer all 3, you won’t be locked out of your account if a specific service is unavailable.

    Nearly identical is Google Workspace, where you can offer one or more authentication options. If you enable more than one, you will not lose the ability to authenticate your users in the event of a service failure. Both Microsoft and Google could be more flexible. Neither offers the full range of options to integrate with services like Twitter.

    An example of a system that offers a myriad of options is Okta. By enabling Social Logins, you can allow users to log in via popular services such as Facebook or Twitter. But it’s recommended that you back that social login with an MFA configuration that could include such options as SMS, authenticator applications, or a hardware device such as a Yubikey.

    Mitigating Authentication Instability with Specops uReset

    An organization may find itself uncomfortable with changes to its authentication provider. If so, implementing a product, such as Specops uReset, takes the reliance on a problematic authentication platform off the table, at least for password resets.

    The flexibility to choose from multiple weighted authentication providers makes a problematic provider easy to remove while leaving the ability for users and service desk workers to reset a password. Change the weighting to offset the loss of the previously used provider, and your users can quickly get back to work!

    Since multiple providers are in use, you can have end-users utilize a combination of trusted identification services to perform self-service password resets without worrying about losing access to a previously critical authentication service.

    Resource : https://thehackernews.com/2023/01/a-secure-user-authentication-method.html