Choosing and using password managers

Module 2: Passwords and logging in · Reading time: 9 minutes

Learning objective: After this lesson you can choose and set up a password manager, protect the master password and share passwords safely within a team.

Key terms: password manager, master password, vault, end-to-end encryption, shared vault, emergency access, browser password manager

What a password manager does

In lesson 2.1 you saw that every account needs its own long, random password. Nobody remembers eighty of them. A password manager is software that does this for you. It:

• creates a strong, random password for every service;
• stores all passwords encrypted in a vault;
• fills them in on the right website, and only there;
• often warns you about weak, duplicate or leaked passwords;
• with many products, can also store codes for two-factor authentication and save passkeys (lessons 2.3 and 2.4).

You only need to remember one thing yourself: the master password that opens the vault. The National Cyber Security Centre (NCSC) recommends a password manager as a standard foundation, even for small organisations, with clear agreements on which manager you use and for which accounts it's mandatory.

Types of password managers

There isn't one best type. The NCSC distinguishes between the manager built into the browser, the standalone app, and online (cloud) versus offline (local). In practice you'll come across these forms:

Well known examples of standalone managers are Bitwarden, 1Password, KeePassXC and Proton Pass, alongside the managers built into browsers and operating systems. This isn't a recommendation: choose based on the questions below.

Questions to ask when choosing

• Does it work on all your devices and browsers, including your colleagues'?
• Can you share vaults with permissions per folder, and remove someone from a vault again?
• Is the vault end-to-end encrypted, and what is and isn't encrypted (for example, website addresses)?
• Can you secure the vault with two-factor authentication or a passkey?
• Is there emergency access or a recovery arrangement, and exactly how does it work?
• Can you export your data if you want to switch?
• With free versions: what's the business model?

End-to-end encryption: what if the provider gets hacked?

With a good cloud manager, your vault is encrypted on your device with a key derived from your master password. The provider only gets the encrypted package. This is called end-to-end encryption (sometimes "zero knowledge"). The provider can't read your passwords, and so can't reset your master password for you either.

If the provider is hacked, an attacker can steal the encrypted vaults. They can then try to crack them offline, as in lesson 2.1. At that point, your master password is your only protection. That's why:

• The master password is long and unique: a passphrase of at least five, preferably six random words.
• You use it nowhere else.
• After a breach at the provider, you change both your master password and the passwords of your most important accounts. After all, the old, stolen vault is encrypted with the old master password.

Two-factor authentication on the vault helps against someone who has your master password and wants to log in via the website. It doesn't help against cracking a stolen vault file. The NCSC says so too: 2FA on the manager is not a reason for a weak master password.

Protecting the master password

Forgetting the master password is often final with a good manager: the provider can't recover it. So arrange this in advance:

• Write the master password down on paper and keep it at home in a safe place. The NCSC considers this fine, as long as you don't write down what it's for.
• Create the recovery kit or emergency code your manager offers, print it and keep it with the paper.
• Only type the master password into the manager's own app or extension, never on a website that asks for it.
• Turn on automatic locking after a few minutes of inactivity.

Why autofill helps against phishing

A password manager links every password to the website's address. On https://mijnbank.example it fills in your password. On a lookalike such as https://rnijnbank.example (rn instead of m) or https://mijnbank-veilig.example it does nothing, because those addresses aren't linked to the item.

A human often doesn't see the difference between rn and m. The manager compares characters and doesn't get tired or rushed. That's real security, but only if you let it do its job:

Does your manager suddenly fill in nothing on a site where it always used to? Don't work around it by copying the password by hand. First look very carefully at the address. This is exactly the moment the manager is warning you.

Sometimes there's a good reason it doesn't fill in: a service that has moved to a new address. Check that through another route, for example by typing the address you already knew yourself.

Sharing within a team

At a small business there are always accounts you use together: the webshop at webwinkelplatform.example, the account at koeriersdienst.example, the business's social media. It's best if everyone has their own account (module 7). If that's not possible, use a shared vault:

• Create vaults or folders by topic ("Webshop", "Finance", "Social media") and only give access to those who need it.
• Never share via email, chat or a spreadsheet. Whoever has access to the shared vault sees the password there.
• Is someone leaving? Remove them from the vault and change the passwords they could see. Removing them from the vault alone isn't enough: they may have copied or saved them.
• Arrange emergency access: what happens if you, the owner, are ill or unavailable? Many managers have a feature where a trusted person gets access after a waiting period. Or you keep the recovery details in a sealed envelope with a second person.

In practice: switching in one afternoon

1. Choose a manager and install it on your computer and phone, with the browser extension.
2. Create a master password (passphrase), write it down, keep the recovery kit.
3. Turn on two-factor authentication on the vault.
4. Import passwords your browser had already saved. An export is often an unencrypted file: delete it immediately after importing, including from the recycle bin.
5. Start with your most important accounts and give each a new, random password: your mailbox (info@example.com), your hosting and domain registration, your bank and your accounting (for example at boekhoudpakket.example).
6. Update the rest as you log in anyway. The warnings about duplicate passwords will help you.

Do you use a service in the WebOké environment, such as a mailbox or Nextcloud, with apps on your phone? For these you sometimes create a separate app password (see Knowledge Base 436). Keep that in the manager too, with the right item. With other providers, it works in a similar way.

Summary

• A password manager creates, stores and fills in unique passwords; you only need to remember the master password.
• Types: built into a browser or system, standalone app with cloud, local, open source or self hosted. Choose based on devices, sharing, encryption and recovery.
• With end-to-end encryption, your master password is the last line of defence if the provider is hacked.
• If the manager doesn't fill in, look at the address instead of copying.
• Share via a shared vault and change passwords when someone leaves.

Quiz

Exercise

Exercise D2.2: Setting up your password manager. Choose a password manager, create a master password and a recovery kit, turn on two-factor authentication on the vault and give your five most important accounts a new, unique password. Tick off the checklist and answer the reflection questions. You don't enter a password anywhere.

Further reading

The steps in the WebOké articles apply to the WebOké environment; with other providers it works in a similar way.

• DirectAdmin guide 3.7: Secure passwords and what to do if a password is leaked
• Create app password (needed to connect with apps and devices)
• Nextcloud manual 3.5: App passwords: when and how to use them
• NCSC, How do I choose a password manager?: https://www.ncsc.nl/multifactor-authenticatie/hoe-kies-ik-een-wachtwoordmanager
• NCSC, Four steps to make your passwords safer: https://www.ncsc.nl/multifactor-authenticatie/vier-stappen-om-je-wachtwoorden-veiliger-te-maken