Managing Your Passwords (and Making Them More Secure) with Lastpass

Here at ProfHacker, we recommend a lot of web applications: WordPress, Prezi, Diigo, Reframe It, SideWiki, Dropbox, Evernote, and Mendeley are only a few we’ve covered. Experimenting with so many web services, however, means that we accumulate usernames and passwords for all the services we try—not to mention all the usernames and passwords most folks collect for email, online banking, campus CMSes, &c. What’s more, secure passwords are difficult to remember; they include a mixture of letters, numbers, and different cases, and they shouldn’t include real words or meaningful sequences of numbers (things bad folks could easily deduce). How then can we keep so many usernames and passwords straight while staying as secure as possible on the web?

One temptation is to simply use the same username and password for everything. This practice is dangerous, however, for the same reason it’s convenient. If someone finds out that one username/password combination, then they’ll have access to all of your accounts. Another option is to keep hundreds of sticky notes on your monitor and/or desk. The less said about this option the better. A better solution is the password manager, which Amy wrote about this past January. A password manager is a program that stores your usernames and passwords, allowing you to access them using one master password. Popular password managers include 1Password for OS X and KeePass for Windows. These programs detect when you’re visting a website for which they have a saved password, and then allow you to paste the correct username and password into that site using only your master password. Using such a program, you can create unique, secure passwords for every account you own, while only memorizing one secure key.

Ever since this glowing review in Lifehacker, I’ve been using Lastpass to manage my passwords. Lifehacker’s review goes into great detail about how to use the service, so I won’t belabor that here. Lastpass also provides a series of screencasts that walk users through all the service’s features. Here is their basic introduction:

Instead of detailing how Lastpass works, then, I’ll briefly explain why I prefer Lastpass over other password management solutions.

I like many of Lastpass’ features. I like its secure password generator. I like the way it detects and fills in forms based on the profiles I’ve created. I like the way it can automatically log me in to my most frequented sites. Lastpass is most compelling to me, however, because it’s universal. This is also Lifehacker’s first reason for using the service, and it’s a good one. Lastpass isn’t a program that you install to a particular computer. It’s a web service that you access through browser extensions. Lastpass offers extensions for all the major browsers—Firefox, Safari, Chrome, even Internet Explorer—so users can access their passwords, generate secure new passwords, fill forms, &c. from whatever computer they happen to be using (even if those computers run different operating systems) and whatever browser they happen to be running on that computer.

For example: I just got a new computer from my school. Two of the first things I did were install Chrome, my current favorite browser, and then install the Lastpass Chrome extension. Once it installed, I clicked its icon, signed into Lastpass using my master password, and my login information was immediately available for all of my saved sites. Lastpass can even help on computers that I don’t own. I can access my password vault through Lastpass’ website (though users should be careful about doing this on public computers in labs, libraries, and so forth). Once a password is saved or changed in Lastpass on one of my computers, that information is available from all of my computers, and I save time looking it up.

If you haven’t explored a password manager yet, I encourage you to do so. They make it much easier to secure your online life, and then to manage that security. For professors and teachers interested in using and experimenting with technology, that flexible security is invaluable. The basic version of Lastpass is free, but you can pay $1/month for the service’s premium features, which include mobile clients for all the major smartphones, an ad-free interface, and a few other perks.

A caveat: a password manager is only secure if you regularly change its master password—preferably every few weeks. Otherwise using the password manager becomes nearly as risky as using the same username/password combination for every site—if someone finds your master password then he or she will have access to all of your other sites’ information. Changing and remembering one master password is still more convenient for me than remembering 20 username/password combinations, and so I update my LastPass key frequently. If you take anything away from this article, though, let it be this: we could all stand to beef up our online security.

[Creative Commons licensed photo by Flickr user darwinbell.]