Passwords and Secrets - Best Practices Guide

Creating and Managing Passwords and Secrets

What is a secret? A secret is any value that is meant to be secured and not seen by others. Passwords are an example of a secret, but so are API Keys, Private Encryption keys, and other items such as Database connection strings.

Let’s Talk Password Managers

Remembering passwords can be pretty difficult, especially considering my Password Manager has over 120 entries. It’s not realistic to expect myself or anyone to remember that many unique passwords. You are using unique passwords right? I find it’s much easier to remember one really complex password :). There is a wide range of options on the market but not all of them were created equally. For example, LastPass has had multiple cybersecurity incidents since 2020 losing customer data stored in unencrypted text fields. Password Managers built into Chrome, Edge, Firefox, Safari, and well any web browser can be easily and silently exfiltrated with javascript.

Bitwarden - Cloud-based with multi-platform support. Can be self-hosted and currently no known vulnerabilities.

ProtonPass - Cloud-based with multi-platform support. Open source code base. Currently no known vulnerabilities.

1password - Cloud-based with multi-platform support. Currently no known vulnerabilities.

KeepassXC - Local application. Open source. Windows, MacOS, Linux support.

Keepass - Local application. Open source. Windows support only. No native MFA support.

Recommended Practices

1. Secure your Password Manager with 2x individual Yubikeys.
2. Secure one of the Yubikeys in a safe or offsite.
3. Add all known online identities and accounts into the Password Manager.
4. Use the Password Manager to create strong passphrases for all online identities and accounts.
5. Enable Multi-Factor Authentication on all accounts.
6. Use the TOTP Authenticator inside your Password Manager.
7. Add TOTP Secret Key into the Notes section of the entry as a fail safe in your Password Manager.
8. Add Backup or Recovery codes into the Notes section of the entry in your Password Manager.
9. Rotate Passwords & Secrets yearly.

AllRoadsLead2Denver2024$ is a better password than 9%P@*Jd1acft. Its easier to read and type!

Avoids common patterns, dictionary words, and predictable substitutions.

Password is a bad password, but so is P@ssw0rd because it is a common substitution. Making it suseptible to guessing, brute-force, and dictionary attacks.

Ensure all accounts have a uniqiue password.

Avoid Cellular-based Multi-Factor Authentication! They are succeptible to spoofing.

References

NIST Special Publication 800-63C – Digital Identity Guidelines

have i been pwned? - Check if your email has been exposed in an online data breach.

• 2024 10
• 2023 2
• 2022 1