The same password for everything? Better the password manager

Using the same password for everything is not an option: password leaks and cyber-attacks are commonplace, and using passwords that are too simple or the same for multiple sites exposes us to high risks. But inventing and remembering complex and secure passwords is no small feat. Password managers come to our rescue. They are software that store and remember all our passwords and help us generate new and secure ones with each new subscription. The most popular browsers (such as Chrome, Firefox and Safari) have by default a password manager capable of helping us in the arduous task of safely managing our online accounts: in addition to passwords, they can store our data to fill in the registration forms (name , surname, address, telephone number) making the various steps quick and painless. In addition, they can synchronize them on various devices, but not without some limitations. Apple’s Keychain only works on iOS, Google’s Password Manager is exclusive to Android. A little more flexibility is given by Lockwise, based on Firefox, whereby you can download a mobile app that supports both or operating systems. There are also third-party apps, which work on multiple platforms, such as Dashlane, 1Password and LastPass, free or with subscription plans. Choosing isn’t easy, and security concerns are there either way. On his blog Tavis Ormandy, who deals with systems vulnerabilities for Google, highlighted a major problem with third-party password managers. In fact, these software rely on browser extensions to auto-complete data and passwords, and these extensions can be vulnerable to attack. With the premise that “perhaps only politics and religion set the hearts on fire more than the password debate”, he analyzed the risks of third-party password managers point by point, concluding that those integrated into the browser are intrinsically more secure, in how they don’t break the sandbox security mechanism. It’s not the first time Ormandy has exposed flaws in these apps, and it happened in both 2016 with 1Password and 2017 with LastPass, which immediately ran for cover, this time Dashlane Chief Technology Officer Frederic Rivain replied. who commented “Nobody can insure zero risk, but what matters from our perspective is that we rely on industry best practices to minimize risk” and Rick van Galen, security expert at 1Password, who, more interlocutor, appreciated the intervention by Ormandy but reassured users that 1Password is aware of the challenges and problems raised and is constantly working to address them. It is true, however, that third-party password managers have a number of advantages, including greater access protection, the ability to be used on multiple platforms, and the ability to remember not only logins and passwords but a whole series of other useful data. The integrated ones, on the other hand, are more comfortable – and without extra costs – if you don’t change the ecosystem. Apple KeyChain, in particular, works smoothly across the Apple universe and uses facial recognition or multi-factor authentication systems whenever you want to use a stored password. For Google Password Manager, on the other hand, access to devices means automatically access to passwords – it is therefore essential to protect devices, obviously with a secure password, not auto-filling and remembering to log out every time.