Password managers

A while ago we discussed password managers at a meeting. I got a sense that most people liked the idea, a few people had some specific issues, and in general people wanted some direction. It's taken me quite a while to return to the subject, but here it is. If you don't read the rest of this, please at least note that I strongly encourage them and that we're considering requiring them for all our sysadmins next semester.

Password manager basics:

1. On your password manager application of choice, create an account with a very strong password or (preferably) pass phrase
2. Store all your other passwords in that account
3. Start replacing bad passwords with strong passwords that you don�t need to remember.

It can autofill in your browser using a browser extension, and you can copy-paste to applications on mobile devices. There's a million details, but that's the principle.

Some specific options for password manager applications (there are many others):

• KeePass: most popular open-source password manager; versions exist for all OS families
• LastPass: the most popular password manager, and the one I personally use - cross-platform, syncs between devices, easy to learn, you can subscribe for sharing tools but the basic functions are free
• 1Password: a subscription-only service, people who use it seem to like it a lot; see a local alum's writeup from 2013: https://chrishardie.com/2013/01/1password-password-management-review/
• others are free to send along recommendations

If you want to read more:

• Here's a rundown on password managers and their importance. From a security standpoint, which we as sysadmins care the most about, a password manager lets us avoid most instances of weak passwords, duplication, etc. From the perspective of a user, I enjoy not having to manage my own passwords (I only remember 5 or so, out of over a hundred, and I don't have to make up long strings of characters or rules to make them).
• Here's a comment by the author of the piece acknowledging and addressing the problem that password managers create a single-point-of-failure. TL;DR most every security measure has tradeoffs, you can address some of them with two-factor authentication (another important subject!), and no piece of technology will solve ALL security problems.
• I picked the Verge article essentially at random - you can search the Internet for similar pieces from your choice of tech sources, security blogs, etc.

These will be mandatory.