Got a Password Manager? Good, But You're Using It Wrong

Working from home opens up security risks you just don't face in the office. When IT staff isn't available, these simple tips will help protect your company's data, as well as your own.

- NEIL J. RUBENKING

The modern online world requires ordinary folks to create and remember dozens or even hundreds of passwords, so the aid of a password manager is essential. Storing all your existing passwords safely means you won't forget them. But if you stop there, you're missing the point. Now that you don't have to rely on your own memory, you can and should change all your weak passwords to strong, unique ones. And of course, the master password that unlocks this trove must be something nobody could guess. Are you using your password manager correctly?

Stuart Schechter, lecturer and course lead for UC Berkeley's Usable Privacy and Security track, worries that you're not so much so that he encouraged his graduate students to find out just what you're doing with your password manager. At the 2021 virtual RSA security conference, Schechter and grad student David Ng revealed their findings. Yes, the study is from last year, but the problem remains unchanged.

THE PASSWORD IS DEAD-LONG LIVE THE PASSWORD

Schechter introduced himself as that guy who was wearing an N95 mask at the 2020 RSA Conference, an oddball among a sea of naked faces. He noted this wasn't because of prescience about the coronavirus pandemic but rather an aversion to making optimistic assumptions in the absence of data. Likewise, without any data, he can't assume that consumers are using password managers as they should.