{"id":7376,"date":"2018-01-08T06:00:50","date_gmt":"2018-01-08T05:00:50","guid":{"rendered":"https:\/\/hansesecure.de\/2018\/01\/no-more-password-chaos\/"},"modified":"2018-01-08T06:00:50","modified_gmt":"2018-01-08T05:00:50","slug":"no-more-password-chaos","status":"publish","type":"post","link":"https:\/\/hansesecure.de\/en\/2018\/01\/no-more-password-chaos\/","title":{"rendered":"No more (password) chaos!"},"content":{"rendered":"

\"\"<\/a><\/p>\n

The tiresome topic of passwords and their management. I am always asked how to solve this problem. Therefore, I decided to write a short guide for KeePass. So here we go \ud83d\ude09<\/p>\n

#1 Installation and First Start<\/h2>\n

First, you get the corresponding software from the official manufacturer<\/a> and can choose between the portable or the persistent variant.<\/p>\n

Then the software starts and we begin to create our database:<\/p>\n

\"\"<\/a><\/p>\n

#2 Creation database<\/h2>\n

The first thing we do is set our location. Since this is where the credentials for all of our accounts are stored, we should choose this location wisely. Personally, I still store the database in a cloud application (for backup & synchronization), but here I use additional security features, which I will explain later. At first we store our ‘TestDatabase’ only locally:<\/p>\n

\"\"<\/a><\/p>\n

In the next step we need to assign a password. This should contain at least 14 characters and, if possible, should not be stored in plain text on digital systems. What, another password and also with 14 characters???<\/p>\n

    \n
  1. Yes, since the database is stored encrypted, this is the only password we need to remember.<\/li>\n
  2. 14 characters is a lot, if you want to remember a generic password. How to create and remember long passwords easily, you can read here<\/a>.<\/li>\n<\/ol>\n

    \"\"<\/a><\/p>\n

    For security-conscious users, or people who want to store the database in the cloud, I recommend the following additional option. Here, comparable to a 2-factor authentication, you can create a file which is needed in addition to the password to open the database. This means that even if your database is lost in the cloud, network drive or elsewhere and the attacker gets the associated password, the database cannot be opened without this additional file. Really cool, here we go:<\/p>\n

    \"\"<\/a><\/p>\n

    Before the file is created, a storage location must also be determined here. I would explicitly store these only locally (or on removable media) and never in the cloud!<\/p>\n

    After selecting the location, the file will be created. Here you can generate a random entropy for the key via mouse movements or keyboard input. Here you can use the maximum key length of 256 bits \ud83d\ude09<\/p>\n

    \"\"<\/a><\/p>\n

    Now we confirm a few times with “OK” and can make additional settings on our database. You can leave all the default settings here without worrying. The only option which could\/should be used is the forced password change after X days.<\/p>\n

    \"\"<\/a><\/p>\n

    #3 First steps in the new database<\/h2>\n

    First, I would suggest that you clean up (delete old entries) and set up some structure (create folders). You can do this with the help of right clicks.<\/p>\n

    \"\"<\/a><\/p>\n

    Assign the folder names and alternatively for a better overview other icons for the respective applications.<\/p>\n

    \"\"<\/a><\/p>\n

    #4 The First Entry<\/h2>\n

    Once you have created your folder structure, we can start to store the first access data. To do this, select the appropriate folder and add an entry:<\/p>\n

    \"\"<\/a><\/p>\n

    Now we can give our entry a name and store the username & password. Since you usually want to store your old passwords first, just click on the 3 dots on the right side of the window to store your password in plain text.<\/p>\n

    \"\"<\/a><\/p>\n

    However, I recommend assigning new passwords for the accounts. This is where a great feature of KeePass comes into play. The password generator!<\/p>\n

    \"\"<\/a><\/p>\n

    Next, we can influence the complexity of the password. Since we do not need to remember these passwords, I recommend using maximum complex passwords here (number of characters, characters, etc.).<\/p>\n

    \"\"<\/a><\/p>\n

    After that we confirm several times with Ok and are happy about our new entry \ud83d\ude09 Now we can create and maintain entries as we like. Great !<\/p>\n

    #5 Insert passwords automatically<\/h2>\n

    Next, I’ll show you another great feature that makes KeePass great. You can automatically enter username and password into login fields, so you can save the copy&paste step!<\/p>\n

    To do this, visit the login field of the corresponding application\/website and click in the field for the username<\/p>\n

    \"\"<\/a><\/p>\n

    Then select the KeePass window and the corresponding entry. Finally, confirm the auto-complete button. Afterwards your data will be inserted and Enter will be pressed, so that you will be logged in.<\/p>\n

    \"\"<\/a><\/p>\n

    #6 Conclusion<\/h2>\n

    I hope this short tutorial helps some of you to master the ubiquitous password chaos a bit better and to move with more security in the net. At this point I would like to additionally point out that there is an application for almost every platform that can manage KeePass databases. This way you can always have your passwords with you, even on the go (IOS\/Android etc.). Of course you could also use cloud based solutions(LastPass,<\/a> etc), but here I see at least 3 problems:<\/p>\n