• Search for:
    4Mar, 2023
    Password manager security: Which is the right option for me?

    The first guide of our two-part series helps consumers choose the best way to manage their login credentials

    While we continue to wait for the long-awaited password-less future to arrive, individuals and enterprises are still stuck with the problem of how to manage their countless, proliferating login credentials.

    Whether they allow browsers to save passwords, rely on Apple’s Keychain or another operating system utility, or trust a dedicated app, most people and organizations now use some form of password management utility.

    A password manager creates an encrypted vault that securely stores credentials. These are protected by a master password.

    Most consumer-focused apps can also create unique, random passwords and support safe credential sharing between friends and family members.

    Some also contain extra perks such as detecting reused passwords and monitoring your accounts for possible data breaches.

    Given the differences in functionality and pricing tiers, The Daily Swig is offering a comparative, two-part guide to some of the most popular password management utilities available for consumers and businesses.

    This article, part one of our series, looks at consumer password manager options, while part two will showcase some of the best choices for enterprises. Stay tuned for the forthcoming second guide.

    1Password

    1Password offers an easy sign-up process and printable digital key for recovering your account in case you forget your master password.

    The application has apps for macOS, Windows, Linux, Android, and iOS as well as a Chrome extension that enables a user to auto-fill login information on websites and store new credentials in their vault.

    The tool allows you to create multiple vaults to organize your data for various purposes (personal, work, etc). In addition to login information, you can use 1Password to store credit card information, API tokens, crypto wallet recovery seeds, and other sensitive documents or data.

    The password manager also allows you share to passwords with other users. You can tweak the sharing feature by setting expiry dates, maximum number of views, and specific email addresses that can access a password.

    1Password’s Watchtower feature monitors your account for reused passwords, vulnerable passwords, and potentially compromised accounts.

    The application also has a Travel Mode for special circumstances where your devices might fall into unwanted hands. Vaults that you mark as not safe for travel will disappear from your devices when you turn on Travel Mode and reappear when you turn the feature and re-connecvt to the internet.

    The password manager offers no free-of-charge plan and instead offers personal ($2.99 per month) and family ($4.99 per month) subscriptions. With the family subscription, you get five premium accounts and the ability to create shared vaults that you can use together.

    Bitwarden

    Bitwarden offers a full range of standard features including the ability to import data from other password managers, creating multiple vaults, sharing passwords with other users, and syncing vaults across multiple devices. It has apps for all major operating systems, extensions for nine different browsers, and a command-line interface for writing scripts.

    One feature that sets Bitwarden apart is its strong free-tier option, which provides features that most users typically need. The premium subscription ($10 per year) also adds security reports, stronger 2FA (two-factor authentication) options, 1GB of encrypted storage, a OTP (one-time password) generator, and emergency access to your vault by other (nominated) Bitwarden users.

    Bitwarden also has a family plan ($40 per year) with six accounts, shared password collections, and shared encrypted storage.

    Bitwarden is an open source program, which means you can host it on your own servers if company or industry regulations prevent you from storing your credentials in the public cloud. However, to get the full range of features, you’ll need to purchase a premium license.

    Dashlane

    Dashlane is another online password manager that provides basic features to store and secure your passwords, including creating vaults, generating passwords, filling online forms, and importing data from other managers.

    The tool provides a very limited free plan that only works on one device. The advanced tier ($2.75 per month) removes the device limit and adds a service that monitors the dark web for breached passwords and compromised accounts.

    The premium plan ($4.99 per month) adds VPN support, and the family plan ($7.49 per month) provides 10 premium accounts plus a dashboard to manage accounts and shared resources.

    Unlike other password managers, Dashlane doesn’t have a desktop application – PC users must do everything through the web portal and browser extensions. But it does have mobile apps for Android and iOS.

    Dashlane allows you to share passwords with other Dashlane users and set limits to what kind of access they will have to your credentials.

    Dashlane’s emergency access feature also allows you to specify a contact who can assume ownership of your account in case you lose access, and you can specify a waiting period to accept or reject the user’s request to access your vault.

    KeePass

    For users who don’t trust online services with their passwords – a legitimate concern after the LastPass debacle – KeePass is a convenient alternative.

    KeePass is a standalone application that provides many of the functions you would expect from a professional password manager, but with some notable exceptions. Absent features include the ability to auto-capture new passwords, syncing across multiple devices, password sharing, and scanning the web for breached accounts.

    KeePass also fails to offer a web interface, browser extensions, or support for multiple platforms. The package comes as a Windows application, although being an open-source project means developers have ported it to other platforms. You’ll find links to these software packages on the KeePass website.

    In KeePass, you can create password databases to store passwords, notes, and documents. These password databases can be copied to other devices, but you’ll have to sync them manually.

    KeePass lacks support for many types of data, such as credit card info and API tokens, by default, but you can customize the utility to support different data types. Instead of autofill, KeePass has an auto-type feature that emulates typing your credentials on the keyboard, a feature than can require a bit of getting used to.

    While this is not the most convenient password manager, it is a decent option for advanced users who want full control of their data and the ability to tinker with the software.

    Operating system password managers

    Alternatively, you can use a tool that comes bundled with your operating system. Most popular among them is Apple’s Keychain, which encrypts and stores your passwords in a secure vault on your device.

    The main advantage of Keychain is its deep integration with the Apple ecosystem. It automatically detects and fills passwords for websites, applications, WiFi networks, and more. It can also be synced to your iCloud account and made available across all your Apple devices, including Mac, iPhone, iPad, and Apple Watch.

    So Keychain is convenient if you only use Apple devices. But if you have other operating systems in the mix (Android, Windows, Linux), then you’ll need a separate password manager. You also won’t be able to use it if you want to log into one of your accounts from a friend’s device or a public computer.

    Resource : https://portswigger.net/daily-swig/password-manager-security-which-is-the-right-option-for-me

    6Dec, 2022
    How Windows 11’s Enhanced Phishing Protection guards your password

    One of the easier ways to steal a user’s credentials is through a convincing fake login page or application. An unwitting user can quickly give an attacker the crucial “in” to an organization’s systems with the everyday act of entering their password in the wrong place.

    Often a phishing attempt shows up in the form of an email that looks dangerously close to the real thing and directs a user to a fake login page. The truly convincing phishing attempts mimic the logos, verbiage, and layout down to the pixel.

    Often, the only giveaway is the URL, but there are ways to obfuscate and hide this as well.

    Protecting Users with Enhanced Phishing Protection in Windows 11

    To help combat the constant risk of password theft, Microsoft added phishing protection in Windows 11 Version 22H2.

    When enabled, Enhanced Phishing Protection is offered through Microsoft Defender SmartScreen. But what does this actually offer for users?

    Enhanced Phishing Protection inspects the URLs and any running processes to evaluate whether the site or application appears to possibly host malicious content or is insecure.

    If so, SmartScreen leverages telemetry data from a multitude of Microsoft security products to notify the user and block the offending site or application.

    As this integration is deeply integrated into Windows through operating system-level integration with Microsoft Defender, a deeper inspection of processes and URLs is available than many competing products offer. In addition, Enhanced Phishing Protection is offered as a baked-into Windows 11 capability without needing an additional install or license.

    If Enhanced Phishing Protection detects a user entered their Windows password into a website or an application, an alert and prompt are shown warning the user to change their password.

    If the password is simply entered into an application like notepad, the protection recommends that the user delete their password from that file.

    Windows 11 warning when you enter your password in Notepad

    This proactive approach helps keep users safe and doesn’t allow a potential attacker to take advantage of their newfound credentials.

    Real-World Consequences of Phishing Attacks

    Phishing campaigns are becoming all too easy for threat actors to create.

    A Phishing-as-a-Service (PhaaS) platform named Caffeine offers open registration and focuses on Microsoft 365 logins but with a subscription model and anti-detection and anti-analysis protections.

    The speed at which a new threat actor can attempt a realistic phishing attempt on a victim is becoming difficult to contend with.

    A real-world example of this is American Airlines. They found that an employee’s Microsoft 365 account was hacked. From this vantage point, multiple employee accounts were accessed and leveraged to send even more phishing emails from within the organization.

    In filings, the data breach appeared to affect over 1,700 employees and customers. American Airlines now has to offer compensation and protection against future threats. Not to mention the time investment it will take to secure and handle the damage done by the phishing attack.

    What to Consider While Configuring Enhanced Phishing Protection

    As with most solutions, there are several caveats. This integration only works with non-Windows Hello logins. If you do not use a password to sign into your computer, then the Enhanced Protection is unavailable.

    In addition, the browser-level integration only works with Chromium-based browsers at this time, which leaves Firefox out of the equation and Opera. As Microsoft Edge is Chromium-based, this makes sense for Microsoft but may not fit every organization’s requirements.

    For system administrators, the Enhanced Phishing Protection is configurable via Group Policy which makes organization-wide rollouts easier.

    These include settings such as whether to enable the feature, whether or not to notify a user of a malicious website, whether a password has been reused, or if an unsafe application has been detected.

    For those using Microsoft Endpoint Manager, add Enhanced Phishing Protection to your users with a profile and the relevant settings. Adding to that, those organizations using Microsoft 365 Defender view alerts in the Defender for Endpoint portal.

    The Other Side of the Coin: Specops Password Policy

    Microsoft’s Enhanced Phishing Protection is only part of the equation; keeping track of passwords and blocking weak ones is the other side of actively protecting users and your organization.

    With Specops Password Policy, you gain a constantly updated breached/stolen password list and powerful and customizable password policies.

    Phishing attacks resulting in lost passwords make quick work of infiltrating an organization. But, an organization with Enhanced Phishing Protection paired with Specops Password Policy and Breached Password List functionality ensures that your users stay safe.

    By scanning your accounts against a constantly updated list of over 3 billion+ breached passwords, when a stolen password is added to the list, you can take fast action and remove the potential vulnerability from your environment.

    With the Specops Authentication Client, upon password changes, instantly inform your users as to why their password won’t work, even more so if the password has been stolen through a sophisticated phishing scam.

    Specops Passwords offers much more than breached password protections; a slew of features exist to secure accounts and protect users from costly mistakes. Make sure that your users are using secure passwords by auditing existing accounts and providing invaluable feedback to make sure that your users know exactly what is expected.

    A few of the valuable features Specops Password Policy has:

    • Use custom dictionary lists to add words common to your organization.
    • Block user names, display names, specific words, consecutive characters, incremental passwords, and the reuse of a part of the current password.
    • Take advantage of granular GPO-driven targeting for any organizational unit (OU), computer, user, or group population.
    • Use Regular Expressions to customize requirements further.
    • Use helpful end-user client messaging at failed password changes.

    Combine Microsoft’s Enhanced Phishing Protection and Specops Password Policy to protect both your users and your environment. You can test out Specops Password Policy in your Active Directory for free, here.

    Resource : https://www.bleepingcomputer.com/news/microsoft/how-windows-11s-enhanced-phishing-protection-guards-your-password/