Last year, following a number of online services that had password breaches, I decided to get my act together & make sure I did as much as possible to secure my passwords for all the 740+ logins I've got.
State of play beforehand
The situation I was in, certainly wasn't as bad as it could be...
- I was using the Firefox password manager to remember + secure all my passwords
- My Firefox profile is kept in an encrypted volume & Firefox required a Master Password to access password filling
- I used a website to help me generate 9 character randomised passwords
- In general I wasn't re-using passwords across sites, well certainly not with more recent ones, but I wasn't sure about some of the old sites
Tipping Point
- I noticed that LastPass was doing a good job at alerting it's users as to whether their passwords were in breached password lists
- The Firefox password manager didn't seem like the best place to store everything
- Logging into the same sites in Chrome (on the same PC) was a pain
- I wanted to share my logins with my home PC
What I changed
Before I did anything, I did a lot of research into what I should do. There are plenty of articles on sites like LifeHacker, but one of the more compelling arguments to use LastPass is it's positive evaluation on TWiT's show Security Now. So this is what I did next..
- Exported all my passwords to LastPass
- Removed all logins from the Firefox password manager
- Enabled 2-factor autentication in LastPass
- Ran LastPass's "Security Challenge" to see how bad the situation was.. wasn't as bad as it could have been!
- Installed the LastPass plugin into browsers where I wanted all my passwords accessible
- Use the LastPass secure password generator to create 12 character random passwords for all new sites
- Started using Secure Notes (in LastPass) to store some extra info I'd got written down in text files
Now that I've had LastPass running for a while, I'm really happy with it & feel like I've done everything I can to protect myself.. all my new passwords are at least 12 characters long with a complexity that will take an estimated 25 thousand years to brute force -- https://howsecureismypassword.net/ The 2-factor authentication doesn't get in the way & works well. The login filling works nicely across all my browsers. And I can even share certain logins with my wife.. if I change them, they'll sync to her account.
The standard (free) version is absolutely great, but at Christmas I subscribed to LastPass Premium which (amongst other things) lets me use it on my iPad & is integrated with TouchID that makes it super simple (yet secure) to log into sites on the tablet.
UPDATE 2017 - in November 2016, LastPass altered the features in the free plan. That free tier now has everything I need/want. If the limitations of the free plan and the cost of the premium tier were putting you off, now is a good time to take a look & get your passwords under control across all your devices.
Top Comments