Robert Siciliano, McAfee's identity-theft expert, explains how password managers work and why you should use one. He covers the risks, encryption, and the danger of reusing weak passwords across sites.
Chapters
Alright Gene, thank you. Every week we hear about new security breaches that could put our personal information at risk, right? Last week the web link shortening tool Bitly urged users to reset their passwords. So have you changed your passwords yet? Most of us probably still have some work to do. We bring in McAfee identity theft expert Robert Siciliano from our Beacon Hill studio this morning. Thanks for joining us, Robert.
Good morning.
I hear passwords and I can't even begin to count how many I have. How many logins and passwords do most people have?
So most people have anywhere between 15 and 25. I have 60 650.
What?
Yeah.
How do you keep them all straight?
So I know probably 6 or 8 of my passwords for my most critical accounts. Those are, you know, your email, maybe your social, your banking, and so forth, Apple ID and such. And so I know those by heart. The rest of them, I have no idea what they are because I use a password manager.
Okay, you do use those?
Yes.
Because I've heard of these and they make me nervous. Do you recommend those to other people?
A password manager is absolutely essential in today's, you know, web-driven society. Without them, people will devolve to poor password management. They'll use the same password for every site. They'll use simple, easy-to-remember passwords. So, but with a password manager, you can have longer, more complex passwords for more sites, and it manages, and it actually will plug in the password for you, making it so much easier as well.
Wait, so yeah, tell— I'm not familiar with this. So how exactly does that work? Is this something you can find online?
Okay, so there are a number of password managers out there available. Just do a quick search on password manager and you'll find all your options. McAfee has one in their LiveSafe product. You download it, you install it, and it ends up in— as a toolbar in your browser, whether it's Internet Explorer, Chrome, or Firefox. And that toolbar, basically you log into it every time you want to enter a password, and essentially it will add all your passwords with one password just for the password manager.
Another password?
Well, yeah, but it's an easy password, you know, a strong one for the password manager, and it works across all your browsers, across all your devices. It stores them locally and in the cloud.
Is there any risk of that being hacked and then somebody having access to all of your passwords?
Well, there's always a risk of your password manager or all of your sites being hacked, for that matter. But as long as you engage in antivirus, anti-spyware, anti-phishing, a firewall, strong passwords, use phrases for passwords like ILOVEDOGS with uppercase and lowercase. That way you can easily remember it, easily store it, and the password manager is also encrypted as well.
Yeah, I want to talk a little bit about the actual passwords, the ones that you do have to choose and the ones you're not keeping in the manager, because apparently research shows 90% of passwords are vulnerable to hacking. The most common password being 123456 and the second most common password being password. Really, people, is that true?
Yeah, that's, that's just foolish and irresponsible and gets people hacked, and you lose money and you lose time and sleep. So if you use relatively complex passwords, like I said, "I love dogs," "I love big cats," whatever the case is, and then you change, you know, "I love big cats bank," "I love big cats Facebook," and so forth, and you don't tell people those passwords, those complex phrases, relatively complex with uppercase and lowercase, are much more secure than, say, "princess1." Right, right. This way, you know, and different ones for each site, this way they can't easily be cracked. What's called a dictionary attack attack. They use the dictionary and words from the dictionary to crack your passwords.
Is it ever a good idea to sort of skip technology in terms of keeping track of your passwords and just write them down somewhere and keep them in your room?
Yeah, well, like on a little yellow sticky note on the side of the monitor is not a good idea, right? So I use a password manager and an encrypted Excel file that I also, you know, back up online, and I print it out and put it in a safe.
Okay, that's good information. I'm learning a lot this morning. Robert Siciliano joining us from our Beacon Hill studio. Thank you so much.
