Password Management Software: KeePassX

For the progressing student of cyber-jutsu, it will be evident that the number of usernames and passwords one needs to manage can become extreme.  From a white-belt level we learn that human nature must be observed if we are to win in cyberspace.  Human nature, in this case, is the simple fact that most people will take the path of least resistance.  If something is difficult to do - then they will not do it.  If it is easier to do the wrong thing, then most people will do that thing - even to their own detriment.  So our goal in this is simple:  make it easy to do the right thing.

Social networking sites, Blogging sites e-Bay, PayPal, pandora (music site), other web sites and just about any system you need to log into, all require usernames and passwords to access.  The common, but unsophisticated and unacceptable solution many people who have not been initiated into the ways of cyber-jutsu adopt is, to re-use the same password for every site they log into.

The practicing cyber-jutsu student will quickly see the problem with this.  If the password for any one of these sites is compromised or somehow revealed to a malicious person - then all of the accounts with the same password are thus compromised.  The result can be described as a cyber-tsunami.

While the reality is that there is "no silver bullet"; and, we must be perpetual students and develop on-going processes to maintain our cyber-security, we can talk here about one part of the overall process.  Let us look at the pros and cons to employing a software tool category known as password managers.  In particular, I'll talk about a free tool called KeePassX.

KeePassX is a cross-platform password management program.  It is available for Windows, Mac OS X, and our favorite operating system, Linux.  OK.  So, what does it actually do?

The program creates an encrypted database (256 bit key based on either the AES or Twofish algorithms) to store your usernames, passwords, links, and additional related information.  What that means practically, is that even if someone were to get ahold of your database file, they would have a hard time cracking it to get your information.  Additionally, KeePassX gives you what we call a "two-factor" authentication option to access your stored information.

Two-factor authentication, in this case, can be thought of as factor 1. something you know, and optionally factor 2. something you have.  And, in this case, the "something you have" is any file you would like to use.  You identify a computer file that needs to be present to log into the password database.  If this sounds too technical for you - trust me - it takes more brain power to understand the philosophies behind its operation than it does to use the very intuitive user interface.

To use the "second factor", one need only click the "Key File" check-box, and then the "Browse..." button to select the file you want to use.  I recommend using a file on removable media, such as a usb drive.  In this way, whenever you want to log into this program, you have to supply the file that is on the removable media.  This makes your password management database very secure.

Once you are logged in, you can create groups to help classify the different sites or systems you need to log into.  Then you create the accounts within those groups.  When you want to log into a site, you select it in the main window, then click on the "user" button along the top (which looks like an icon of a person).  This copies the username into your clipboard, so you can paste it into the login box on the website (ctrl-v on Windows and cmd-v on Mac OS X).  Then you do the same thing to enter your password.  Click on the password button at the top of the screen (which looks like an icon of a key) and then paste it into the password field on the website.

On Linux systems, you can automate the whole process such that you can select the site you want to log into, double-click it, and your default web-browser will automatically launch and the username and password will automatically populate the fields and log you in.  This takes a bit of configuration, and may be considered a brown-belt level task.

Alas, we are trying to make this an easy process - and so far - it just seems to be more work.  So where do we get our win?

The major win is found in this applications ability to generate random and complex passwords for you.  These passwords that are generated will never need to be remembered, and never need to be typed out.  The only password you will ever need to remember is the password you need to get into KeePassX, when you first launch it (as described above).

You can adjust your settings within the Password Generator window to meet your desired complexity and the capabilities of the site you are using.  You may be surprised to find some of the sites you use will not allow special characters in the password.  Similarly, many sites have unsatisfactory length restrictions.  As a general rule, more complex and longer passwords are the way to go.

The program collects "entropy" based upon your random key-strokes and mouse movements, to ensure that the password that is generated is truly random.

The "New Password" field (see image below) will populate with a complex password after enough entropy has been gathered.  This is a fast process.

And there is your benefit.  That long and ugly password is not crackable in any reasonable amount of time, given current technology.  If you are securing your bank accounts - then a good policy will be to change that password on a regular basis.  As long as you change the password more frequently than the amount of time it would take to crack the password, your account will not be cracked.  The exact frequency will be an increasing quality as technology continues to increase computing power.  At this time, changing your password in this manner once per month should be more than sufficient.

Changing a password that you don't need to remember in your brain should be less of a chore than coming up with new passwords you have to recall from memory every month.

You should also recognize that so many people use a word or a name for their password (often simply appending or prepending a number) that the majority of attackers use "dictionaries" to attack accounts.  You might note that the password listed above, will NEVER be found in a dictionary.  This is important.  It means that an attacker has to "brute force" your password one character at a time.  This is a very time-intensive process, which requires many many computing cycles.

You may note that in the image above, I have NOT selected the option to ensure that the generator includes characters from every group.  Forcing the program to include characters from every group actually reduces the overall randomness of your password.  If an attacker doesn't know exactly what your password is composed of - nor exactly how many characters your password it - this makes the job of cracking the password even harder.

You should use this program, or one like it, for as long as you have to use passwords.  Ultimately, passwords may be replaced by other means such as biometric devices (e.g. fingerprint readers, iris readers, etc.)

Using a program like this means you have to keep your KeePassX database safe and secure.  You can actually keep the entire database on a usb key.  If someone gets your database, and guesses your password, and figures out what file you are using as the second authentication factor - then you still lose.  So, care must be taken.  But - like your house keys, or your car keys - having a small device to keep safe seems to be something we are capable of doing.  Long, complex passwords, on the other hand - are simply better off being managed by a computer program.

How do you come up with a good password for the database itself?  I always suggest that folks use the first letter of each word in a long phrase they can recall easily.  The typical example is the phrase, "four score and seven years ago..."  which would or could yield the password:  4#&7ya

In my humble opinion, that password is too short - but it is good as an example to teach how to come up with a complex password.  Another good thing to do is to come up with a positive affirmation as the phrase for your password.  In this way, you achieve true cyber-jutsu.

"Dissatisfaction with life arises from desiring to have what cannot be had, and desiring to avoid what cannot be avoided." - The Buddha

"dwLafd2hwcbh,&d2awcba."-TB

If you are a brainiac  - perhaps you could take a phrase like that and use the second letter in each word - or the last letter of each word.  I think you get the idea now.  Your goal should be to come up with a password for your KeePassX login that is more than 8 characters in length, and uses upper and lower case letters, numbers, and at least one special character.

Password Security: White Belt Education

Identification, Authentication, and Authorization are important words to consider when contemplating cyber-jutsu.

While one of the least secure methods of authentication available today, passwords are nearly ubiquitous on information systems as a means to verify the identity of an authorized user.

Words have meaning. You will find your cyber-jutsu training most illuminating if you keep a dictionary and thesaurus handy. I have physical versions of these books, as well as computerized and on-line versions. To get you started, you can investigate Merriam-Webster online. Here is a good tip: you can easily remember "m-w" for Merriam-Webster. You can reach their site by typing in m-w.com for the address. I find this faster than navigating through bookmarks.

The human brain is better than a bookmark list, but, using both is best.

What is your identity? Who are you? For the skilled cyber-jutsu practitioner, hiding ones identity may be important. For the white-belt, being able to understand "identity" is most important.

Leaving behind the philosophical question of who you are, let us consider who you are to a computer system. To a computer system, you are, in most cases, a "user". The computer system maintains a unique "user name" for each person wanting access. Some computer systems allow a special user named "guest" to log in, but we are considering only your unique identity here.

Since computer systems have become wide-spread in our lives, a new problem of identity has arisen. Many of us have too many identities to easily remember. There have been and will continue to be interesting proposals for the solution to this problem. Some current technologies include: Single Sign On (SSO), and OpenID.

Regardless of the technologies we use to help ease the problem of recalling multiple identities (i.e. user names) and authentication mechanisms (i.e. passwords), if the system uses a password to validate your identity, you need to choose and recall a lengthy and complex password.

This can be difficult if you want it to be. I, however, choose to make it a fun and/or meaningful process. The choice to suffer or rejoice is yours alone. I will share with you one method to create a password that I find rewarding.

Before I go into my technique, let us discuss what we mean by a secure password. A secure password is one that is changed before an attacker can "crack" it (i.e. reveal, or guess it). Because of the progress of technology, that time grows shorter every year. Therefore, we could say that the time of the user generated password grows short. Some replacements for the password, or enhancements to the password include bio-metrics (i.e. a human number) and tokens (i.e. something you have, like a physical key or card). If you hear someone say two-factor authentication, they are referring to two mechanisms working in concert to verify your identity. We can think about a password as "something you know". We can think about bio-metrics as "something you are". Lastly, we consider a token "something you have". By mixing and matching these "factors", we can create secure authentication.

An example of a bio-metric authentication device would be a finger-print scanner/reader. Other bio-metric authentication devices in use today include iris scanners as well as the more intrusive retinal scanners. Future bio-metric authentication devices may include genetic material "finger-printing". Such devices could work off of dead skin cells, hair, mouth-swabs or blood. A device that could quickly determine the identity of a person based upon a unique number generated by their unique DNA would be the ultimate authentication mechanism. It could also be thought of as "the number of the beast" from Revelations. For better or worse, we will most likely see such a device in our time.

A good example of a token, or "something you have" would be the device you can get from PayPal to enable two-factor authentication to their site. Remember that two-factor authentication uses two of the above factors we described. In this case, PayPal uses something you know, a password, and something you have, their token. The PayPal token can be kept on your key-ring and provides a new six digit number every minute. When I log into my PayPal account, I first enter my username, or identity. I then enter a password as the first factor that they will consider towards verification of my identity. After successfully entering my password, I am then prompted to press a small button on my token. When I press the button I am given a six digit number to enter into the website. Because they know the serial number of the token they sent me, they know what that number is going to be. They validate that the number I enter is correct, and then authorize me to use their website and conduct my online financial affairs.

Now let us consider the password generation technique. Sit quietly for a moment. Sit with your back straight. Relax your muscles, but maintain proper posture. Take a deep breath. Let your belly expand as you breathe in, rather than your chest. Take another deep belly breath. As you exhale, feel the pressures of the day leaving your body like morning mist melting off a mountain lake. Take another deep breath and feel the essential joy filling your body. As your belly fills with your breath, feel the life energy filling every molecule of your body. It is a renewing energy. Each deep breath pulls in new energy and each deep exhale releases those things you do not need in your life. Breath deep again. Allow your mind to drift toward a happy time in your youth. Capture that moment with words. Bring those words back with you as you continue to breathe. Breath deep and reflect on the phrase you have brought back with you. Breath deep and feel the healing, cleansing breath become a part of you. Come back to the present time, and create your password.

I did this exercise, just now, with you (I hope). This is what I brought back this time. Because I'm sharing it with you, I can't use it as a password. I'll find more though, don't worry.

The phrase I brought back was:

"We battled for hours with water-pistols. We painted the walls like two children."

I can use some of this or all of this. I can use whole words if the system I'm creating the password for doesn't limit the length, or I can use just the first letter of each word. If you are a brain, perhaps you can quickly recall the last letter of each word, or the second letter of each word. Let us start by using the first letter of each word.

• wbfhwwpwptwltc

This is certainly unique, but let us consider for a moment our attacker. Without going into the details of how passwords are cracked (we can do that another time), let me say that we want to make the password more "complex". By complex I mean that we want to create a password that isn't all lower-case letters. In fact, we could like it to be upper-case, and lower-case, and use also numbers and/or special characters. We also want the length to vary, but never be less than eight characters. Having all passwords exactly eight characters long gives the attacker something standardized that he can use against us.

Here are some alternatives that I feel would make a good password:

• Wb4hwW-P.
• wB4hw/w-p.
• Wbfhw/w-p!
• wPtwl2c.
• Wb4hw/w-p. Wptwl2children.

Some password security analysts will say that you should never have any word that can be found in any dictionary as any part of the password. If you follow that advice, then the last password given above would not be a valid choice. But let us look at what is good in these passwords. I am using upper and lower case letters in all of them. In the second example, I have chosen not to use an upper case letter to start the password, because I don't want to be predictable. In this second case, I chose to emphasize the "Battle" that took place. In this example I also chose to use the "/" special character that is often seen in text regarding the word "with". In the third example, I chose to replace the period with an exclamation point. In most of the examples I chose to replace the word "for" with the number "4". Some people will sometimes replace the letter "A" with the number "4", or the letter "B" with the number "8", and the letter "O" with the number "0" (zero). The only rule here - is that you need to remember what it is you are going to do. Don't over-complicate this process. Keep it fun. If it gets boring, then maybe you can add something more to it.

Try a simple phrase, and stick to the basics I've outlined, and your passwords will be much more secure until you change them. I recommend changing all of your passwords at least once per month. Choose a time of the month that will be the same every month. Then sit down, relax, and breath! :)

Sensei Metajunkie

PS -

here are a few examples that are BAD CHOICES and should NOT be used:

• painted this is a dictionary word
• Painted this is still a dictionary word
• p41nt3d
  even though the last one doesn't look like it on the surface, there are dictionaries for cracking passwords that replace the common numbers for letters - don't use this type of obfuscation for a dictionary word-based password.

Changing Passwords - Yes, you must

This morning I read a disturbing post by a security professional, who suggested that we don't need to change our passwords for 25 years.

His or her suggestion was based upon a belief that an attacker will not take any significant amount of time to crack your password. This simply isn't the case.

The whole notion of cryptography is based around trying to keep a secret. The practice of cryptography understands, however, that the secret can only be kept for so long. This is why we "change keys". While a password isn't directly cryptography, it does try to keep a secret. Also, sometimes an attacker will be trying to break cryptography in order to get at your password.

A good example is the Windows login password. Your password is never actually sent across the wire. In its place is a "hash" of your password. The hash is composed using a cryptographic function. Because Windows doesn't ever "change the keys", it is possible for an attacker to use tools to generate what are called "rainbow tables". A rainbow table is a pre-generated table of every possible hash that could result, given a certain set of parameters.

The parameters in question are the character set and length. For example, I could create a rainbow table set which would pre-generate the hashes for every password you could create that was up to 8 characters, and included upper and lower case letters, numbers, and special characters such as a dollar sign, period, or asterisk. It takes a long time to generate a rainbow table, but once it is completed, matching the pre-generated hash with the windows password hash that was sent across the wire can take micro-seconds to mere minutes.

The longer and more complex the password you are trying to crack (perhaps "match" would be a better word here), the longer it will take you to create your rainbow tables. Also, the larger the set of pre-generated hashes, the longer it will take the computer to search through them all to match your password.

Certainly, the longer and more complex a password is, the longer any brute-force method of cracking that password will take.

Since we can now see that there will be times when the amount of time you give an attacker to crack a password, before you change that password can be critical to security - let us all change our passwords today.

If you have any questions, please let me know. This is the place to do it - go on ... post a comment. :)

Sensei Metajunkie