That's basically all. You know, the only other information I have.
A few more details.
But, yeah, you could change it to 3,000, or some other big number.
A few more…. A few more details, um….
It seemed like when you initiated your vault. The, uh, password hash count.
Would defaulted to whatever less passed the company had default at the time.
And then they would raise it. Over time, usually after some sort of egg on their face event.
But they did not…. Encourage people to….
Go back and retroactively. Rate, um, raise the cash count on their vaults.
So you… people that had a really old vault. Still have the old defaults.
And I think since then, they have done some things of, hey, you have to raise your count, and they actually.
Forced some… I think I've seen…. At least one, if not two, within the last five years.
Um, but LastPass, it seems like…. When they… it was sold to LogMeIn.
They kind of rode their…. Reputation, and have had to play catch-up.
One of the things I do not…. Understand I haven't bothered to look into it.
Uh…. I'm sorry, I….
Um, I'll try to find it, maybe come back with it later.
But there is another…. Level of security.
That is….
Can you describe it, even if you can't show it?
No, it's like, uh…. It's along the lines of what you were saying, but.
It's a…. Number… it's like 5,000….
At this… initially, because I inherited my Volve from a long.
10 years ago, but you can increase the security by increasing that.
Yeah, the number of rounds of hashing that have to happen.
I don't know if it's rounds, but there was some other key….
Key and, uh…. Encryption information.
And I remember seeing it, but I don't know…. Where it was.
I thought, sure, it would be under security.
Let me check under Vault.
Man…. I don't know.
Yeah. Sorry, I thought I could point it out real quick.
But the issue was…. The number in there was, like, 5,000.
And they suggested that you increase it to $500,000. To increase….
I don't remember what the number was. But doing that would log you out of every vault.
To reset the security. And I elected not to do that yet.
All right, so we talked about 1Password. Lastpat, LastPass.
In the late teens. There were some other players….
Dash Lane…. Cloud first, business features focused on autofill, cross-platform usability.
It was a commercial product, subscription model, closed source. Primarily for the business market.
And…. The late teens.
Bitwarden actually hit the scene. Right at 10 years ago.
You can't host it yourself, or cloud-based with a bit more on the servers.
You can't… you don't need to know anything about encryption. The actual Bitwarden process is audited publicly.
One of the things they have excelled at, as far as I'm concerned.
Is creating a commercial side. That is a viable business environment that supports the open source side.
In my, uh…. Market opinion.
There are quite a few companies out there that. Can sustain the company based on commercial revenue using an open source product.
And then enhancing that with features that. The corporation might want to purchase.
Bitwarden is a real good example. Because they have a very good free version, another one of my favorites is Nagios.
They have a commercial side. If you want a fancy GUI, yes, you can pay a few bucks for it.
And use it to monitor everything in your IT environment. Or you can use the open source version, which I have for.
At least 15 years. And do everything yourself.
Um, a quick aside, we run the commercial version of Nagios.
And it really, in my opinion, is kind of a configuration wizard on top of.
The open source piece. It's managed… it's still the same open source monitoring underneath.
Yeah. Got it.
Uh, the basic tools are the same, Nagio's core. Which actually does the monitoring.
They did a major rewrite on it about. The lower 10 years ago.
And they just increased the capability dramatically in terms of multi-threading and that.
But the Agios itself. Ncpa is the current.
Remote tool, if you will. It runs on anything?
You define your… you define your checks for NCPA, and then set it up as a passive host.
Or you can SSH to a remote host and do the….
And run the checks actively via command line on SSH. You know, but those are….
As you say, the tech is the same, whether you have a fancy guru you want to pay for.
Or use the open source version. It's basically just a web page.
In any case, these modern vaults. Zero knowledge encryption.
Which is very important, because a lot of people using. Malts like Pit Warden.
They wouldn't know encryption from decryption. Nor would they care.
Nor should they have to. You know, that's totally transparent.
The biggest problem. With Evolve.
As Randy mentioned, is there's a lot of people that. Don't want to waste the brain cells trying to figure out how to use it.
Is the nicest way to use… the nicest way to say it.
Anyway, Bitwarden's UI today is…. Very polished.
It… it does everything you want to do. It's got nice buttons out there for the main functions you want.
And it is quite a bit more…. Quite a bit more… quite a bit more work went into it.
Then… or that have advanced the previous versions into something nice.
Baldwin is…. A rushed fork that talks to Bitwarden, if you like rust.
There are some others asked. Some other open source vaults out there.
Passable padlock. Less pass.
Let's talk about hardware authentication for a minute. One of the big players in the hardware authentication.
Well, first off, what is hardware authentication? Ooh, let me ask. Lee, what is hardware authentication? No, I asked the question, so am I supposed to answer?
Basically, hardware authentication is a way. Is a widget you carry with you.
Typically, a USB key, like Yubico, which is…. Almost 20 years ago.
And whenever you go to a site that is configured with your YubiKey.
You plug the YubiKey into the machine. And I've never used one. I'm assuming you push a button and it supplies that time value random.
Key to…. The remote server.
It actually generates a one-time pass… password. Based on the current time value?
And that time value is very accurate at maintaining synchronization with the server.
And it emulates a keyboard. There is no other driver needed.
Uh, it actually depends on the model and the configuration. Um, they're the more secure modes.
Actually do require drivers. It requires browsers.
To support it, and part of it is…. The YubiKey….
Shall I say, it receives a signal from the thing trying to log in to….
To prime it, and you'll actually see the light. On the YubiKey flicker, like, hey.
The site you're going to wants you to authenticate. And if you choose to authenticate, then you.
Touch the capacitive touch sensor. Um, on it, so there's no moving parts.
And it then…. Actually can send data, and it's not just a stored password.
There's actual computation. And depending on the mode, it can be one-time password.
Or it can be a challenge sent to it, it has to encrypt it with its private.
The device's private key. And send the response back, very similar to public key cryptography.
Really depends on the configuration of the device.
Okay. I always thought it as something… a hardware-based TOTP, but you're saying there's other modes… other modes that can be used for better security.
Here's a hardware-based EOTP, there's hardware-based public crypto, there's also, just remember this string, and it's like a macro key. You hit once, and it spits out the same thing every time.
I'm gonna hold it… I'm holding up mine, so just so you can see it.
Okay, cool.
Yep.
Right. In the late teens again.
There are… there was a, uh…. Launch of universal two-factor. This is something I'm not that familiar with.
A FIDO alliance? Grant, can you talk to this at all?
Um, I would…. Summarize it as it was industry standard.
Standard blood. Standardization.
Of what YubiKey. Had been doing.
There were some other players that did the same thing. Yubikey was just one of the real big ones.
And it was everybody start playing by the same rules.
You know.
Okay, okay, so the FIDO alliance was basically the hardware. Authentication with the different options you were talking about.
That's part of it, yeah. Um…. There's the FIDO Alliance was a group of vendors, and it's….
A set of standards, both hardware. And software, uh, software being kind of APIs, how to interface with things.
Um, if you think about…. In the early days of automobiles.
Uh, you had a whole bunch of different manufacturers, you wouldn't even have people driving on the same side of the road.
The FIDO alliance is, hey. We should put some standards around this, we could make sure everybody drives on the same side of the road.
Follow speed limits, things like that.
Okay, cool.
Uh, we talked about YubiKey. Multiple, multiple models, Nano 5C, 5NFC.
Bio, I'm assuming bio means the touch button is a fingerprint sensor or something, there's like a phone….
You can run on USB, NFC, fingerprint options. Solo keys, open source.
You can actually run Web Autham. Nitro Key open source hardware for one-time password, FIDO2RPGP.
Although, I have never really…. Needed a hardware key.
Because, A, none of our clients use them. But B, I'm always… if I'm sitting at the same computer.
If I'm in the office, I'm sitting at the same workstation.
If I'm logging into a server anywhere. That we manage. I can securely log into that server over SSH.
From this system. So, because I have physical access to my main workstation.
I need to authenticate nowhere else. Sure, and then the other thing is hardware authentication. It means you always have to have the key with you.
If I were to go to another machine. 100 feet away, I'd have to carry the key with me.
Had enough carrying a cell phone, but…. I'm sure there's an app you can use on the cell phone now that some of the security-conscious.
Organizations have taken care… have taken…. To, uh, their markets.
One of the best advantages. Of a hardware key.
Is fishing resistance. You… you can't give away what you can't control.
Basically, the Yubikey-style devices are black box. They have a way to communicate with the server directly. There's no human intervention.
You authorize it however you do it, either with push button or fingerprint or whatever.
And then it communicates with the server, they do the handshake.
However, is configured, one-time password. Public key encryption, whatever.
There is no secret shared between them. Which means that a man-in-the-middle attack cannot be done.
Unless you're probably the NSA. It is capable of being used offline.
But you still have to have physical access. Caution… cost and risk. There is a cost involved.
There is the risk of loss. So….
Do they sell YubaKeys in multiples? Grant? In other words, can you get 2 or 3 of the same thing?
Um, you can get the same model, I think they're all unique.
Serial numbers and internal private things. I'm not aware of any capability, like, I want 3 housekeys made for.
Myself, my wife, and my neighbor type thing. Uh, the answer is you each get your own.
Okay.
And you're… you configure your door lock to allow all three.
Okay, I get you. Oh, okay.
No, no, no, it's a realization that you just gave me with.
Do you have a question, Gary?
Just record 3 different YubiKey. Addresses rather than have 3 keys that have the same information. Okay, cool.
Um, for the Security Now listeners amongst us. You can do similar with iPhones or any.
Bio fingerprint? Thing. You have, say.
You personally program. Two or three of your fingers.
Your significant other programs, two or three of their fingers. And, uh….
Your lawyer, you have them programmed, too, type thing, so anybody you allow.
They can unlock it, have your permission. And it… it's a way to get….
Capability without…. Dealing with other problems. Or, if you're going to Disneyland.
Give them the knuckle.
I hear people know that episode, too.
Oh, yeah. Big time.
Right, enterprise integration.
Most enterprises have various levels of security. You know, starting with the basics, they try to prevent the muggles from doing stupid things, like answering phishing emails or clicking on links.
It is the… it is the amazes me…. You know, whenever I talk to a corporate client, they send me an Outlook email.
You can't even send a URL in the email. The secure… the email security takes that URL out.
Puts in some 300-character-long link. To that URL that they have quarantined.
So that somebody can look at it and make sure it's not malicious, basic.
I kind of feel like that's a marketing slash tracking. Billed as a security feature.
Um, it's kind of like a redirect. There is an opportunity. Yes, they can break it, but more importantly, they can track what you're interested in going to.
You got it.
But it's a security feature, right?
I love it. All right.
One… one we're going to hear about TOTP a lot. Time-based, one-time passwords.
Or one-time code, rather, password or password code. The authenticator….
Is… is time synced? And we'll look at some authenticator apps here in a few minutes.
Basically an authenticator, whether it's Google, Microsoft, Bitwarden, or whomever. Once that authenticator is linked to the server you're talking to.
Whenever you go to the server. And try to log in, the Authenticator app.
Once you open it, it will show you a 30-second window, typically.
Four or six-digit number. And basically, you look at that 6-digit number.
Look at the timecode. And if it's more than 20 seconds.
Because it's going to take you 5-10 seconds to type the key in, hit enter, and get a response.
You grab that number, hit the six digits, and type enter… hit enter on the server.
Screen, or you wait. Another 5 or 10 seconds for it to start over again for another 30-second window.
And then you pick that 6 as your code and enter it.
Because you only have a 30-second window, at least on the authenticators I've seen, to enter that 6-digit code.
Okay. For example, uh….
I was going to grab it, but I forgot about it, but I don't have it in front of me.
You know, for example, in Bitwarden. Verification codes, I've got two of them configured on my phone.
At this point. Authenticators are only valid… they're only in the Android or iOS apps.
They didn't give a specific reason. But I suspect it's because it requires physical validation.
In other words, you have to physically. Open the vault with.
Normally some sort of physical authentication, whether it's a fingerprint. Base picture, whatever.
And I've got, uh…. A bit warden authenticator on my….
Home. It's…. It has the number 714374 with 3 seconds left.
Being a starter over 30 seconds. With another 6-digit number, 144139.
A lot of those button-based things, you…. Usually can use them.
A few seconds. Outside of the timer, uh, because clocks….
It's difficult to keep it in sync. So, a layman's comparison is to say, we give you a 30-second window.
When in reality, they allow two codes, and they're offset. By 30 seconds. So there's a 15-second early.
The official 30-second window. And then the 15-second late.
Is the total 60 seconds to allow that code, and there's overlap by half of it with the previous code.
And the next code.
Uh, we've talked about Fido. A one… six-digit, one-time code, which you have to enter, is….
Moderately secure. For better security.
You can use a hardware key. Like a YubiKey?
Which would actually use a key pair. To encrypt data and pass it back.
Potp is more portable, you can use it for basically any device where you can configure the app.
Authenticator app. Fido hardware base is more secure, obviously.
There's a bunch of them out there, TOTP-based tools. Google was one of the early ones.
Microsoft chimed in. Bidwarden was a little bit later.
But they have it now? That bit warden app today is only an Android iOS.
There is an Authy tool. Which I've not used, Aegis.
There's a lot of them in the market today. Talked about Bitwarden being TOTB compatible.
I think we've mentioned all these. The date, Android iOS, yes, it is a standalone app, because it comes in a vault.
Totp sync. I'm not actually sure… oh, okay. I think I might have Bitwater Premium for 10 bucks a year.
I do not know what the capabilities are for the pure free version.
There is no desktop version at this point. But my argument is.
Why? Is this another app to manage, the browser plugin does everything the desktop?
Desktop would do.
Other players in the market. Pass.
Gpass was originally a Windows-based password manager. Released in 2003 by….
Dominic Reich… Reichel?
Open source, local only. Which is fine, as long as you realize that that is something you're going to have to deal with.
It does have their various plugins, there is no cloud backend.
No cloud storage. You would have to take the database with you and.
Make sure it's secure, and keep it secure. Plenty of plug-ins, though.
Syncing, you would have to accomplish yourself. Some of the plugins can be complex.
A little bit more complex, the UI is…. A little bit dated.
But that's not really a big problem, because even some of the major players like Bitwarden.
Have just gotten through with the up… have just done their major updates here in the last few years.
A newer version of KeePass, a FARC, KeyPass X, or KeyPass XC.
Their lineage-based forks, their QT apps. They are cross-platform.
Run on multiple hardware platforms. But it's still a local first.
System. The KeePass X is a little bit….
It's simpler than KeyPass, but it's more dated and less extensible.
Local storage by default, again. If you want to run it on a different app base, like Android or iOS.
You'd have to use a third time. Third-party tool like Google Drive, NextCloud, OwnCloud, etc.
Lastpass from 2008. It was one of the early cloud-based providers.
It had the cloud application first, obviously had to cache a vault in the browser.
Premium model, but it was proprietary, significant data breaches in 15 and 22.
The Vault blobs were exposed, they were encrypted but accessible. And… I'm assuming that….
The breaches involve various players. Unencrypting those blobs so they can retrieve usable information.
Now owned by GoTo, formerly LogMeIn. Defiant, go back and define what a freemium model is.
Uh, free to use, but you have to pay if you want to use more features.
Okay. I guess you could….
Call that… call Bitwarden a freemium also. Because it is free.
You can run your own vault, that's part of the…. Original architecture.
But if you want advanced features, you kick in a couple bucks.
Like the premium Bitwarden Personal is $10 a year. Enterprise version is $70 a year for 10 users.
And, you know, more users you'd, you know, add on a couple bucks past that.
One pass. 2016, the secret key, it was a secret key system, obfuscated encryption keys.
It also had a cloud breach exposable, walled blobs. And did not have very good user control.
It did have good brand and reputation, though. But it was proprietary, closed source.
They're not… is now…. Cloud first with an electron-based iPass, 1Password 8.
It does have some business-focused features. But it is subscription only.
And they recently deprecated a standalone app, so it now only runs as a plugin.
In today's marketplace. The best vaults, or best modern vaults are open source and user-friendly.
Things like bit pass, less pass, padlock.
She had bit pass, you mean Bitward. I'm sorry, Bitwarden, LessPass.
It wasn't, let's pass. I've never heard of… I've never heard of these two, but they came up in my research, so….
That I wanted to mention them. Okay. They are fully open.
Are all posted and cloud…. Cloud-based. In other words, the app keeps a copy of the vault, and it syncs with the cloud.
And they have some pretty sophisticated encryption between them. They are fully open source.
All three offer self-hosting. And… and the vaults are end-to-end encrypted.
Which means that, number one, you can't pull blobs out of the data stream.
Bitwarden Padlock. Are zero knowledge.
You don't need to know anything about them other than how to use them.
The data is encrypted before leaving a device. Both organizations.
Use public audits to verify and validate. Bit 2 is enterprise-enabled by default.
Padlock actually encrypts before sync. And LastPass is stateless, or LastPass is stateless.
For all three, the free chairs very usable. You can actually watch the development process if you want.
I'll have two-factor. Biometric support.
Bette Warden and Padlock. Each has come up, has developed and polished the user interface.
Browser extensions work well. I've been using the Bitwarden. For at least 10 years.
They're all maintaining a good public presence. And they have both….
Matured their revenue model. So, the commercial version is doing a good job of supporting the free version.
All provide open source, team-focused tools based on GPG keys. Allow self… left self-hosting for Bitwarden and Pastel.
Bid Warren, we've talked about a lot. There are multiple versions, from free to enterprise, multiple hosting options.
And there is a Rust4 client that you can use, which is lightweight.
Okay, one-time passwords, time-based one, two-factor authentications. We've looked at that.
I've shown you how it worked. Totp is the original mainstream app.
Or the mainstream TNTB app recently added Sync in 23. Originally, it was closed source.
Originally, it was focused on Azure Microsoft 365. Because Microsoft was using it for the Office 365 product.
Gotp plus backup sync is owned by Twilio, again, a commercial product.
There were… are some concerns in that environment about cloud key storage.
There is a free OTP from Red Hat. Which is a minimal implementation.
Open source, Android only, provided export-import support. One of the things I like about Bitwarden is I can export to Vault whenever I want.
And shave it in my own secure storage.
The original one-time 1TP products had replay windows. We've talked about matching time sync between.
The vault, and the client that you're using?
Uh, it's your hardware… let's see…. While we're here.
I'm jump… let's jump over to a better diagram of. Totp.
We defined it time-based two-factor authentication, generates short-lived single-use codes. It's based on a shared secret and the current time.
Five-step process. They share secret is exchanged during setup.
Device generates a code using that secret plus time. The server does the same independently.
User enters the code in the server app, and the server validates it.
And remember, as Grant was saying. That time window being 30 seconds is not always a lot of time for people to get the code entered.
So, a lot of systems will give you a leeway. On both ends of that, for example, if you're late entering the code, it'll still match the previous one.
Or if you're too quick, it'll still match the next one.
Here's how it works. This is the normal TOTP operation.
There are some different ways it can be implemented. But, for example.
To do the setup? The server generates a base 32 encoded secret, gives you a QR code.
And then you scan it in your app. No, it just occurred to me. I wonder if that's one reason why it's only available on Android and iOS.
How are you going to scan a QR code on a computer?
Yeah, on the worst day.
It's best… it's best to try to get…. The actual Base 32 encoded secret.
A lot of them will give you that, but it's at the very bottom of the screen.
Uh, webcam….
My understanding is if you put it in a…. A system like, uh, an Android phone.
And you break the phone. You know, there's no way you're gonna get that….
Secret back out. In other words, if you read it in with a QR code.
And do not write down the, uh…. 32… the base 32 secret.
Then, uh, you know. Best hope you never, uh, destroy that phone.
Well, I… go ahead.
Well, um, Steve Gibbling had a good recommendation for that, and that is take a screenshot and print that QR code.
And usually it does include the actual. Decimal value somewhere on there.
And put it in a secure physical location. Back to the… it's offline, somewhere trusted.
The people that can get to it is extremely small. And if you have that physical printout.
You can take a new phone, say, I want to add QR code, and just start going through the pages.
Saved.
Yeah, good point.
Yeah, of course, the other option is. I do enough barcode work, I keep a barcode scanner on a USB cord I can plug into my workstation.
It'll read a QR code or any other barcode.
So that's how you do the setup? There is a… the time is….
Broken into 30-second increment. So, the Epoch Times, since January 1, 1970.
Time is the floor of current time over 30, and the value changes every 30 seconds, that gives you the time step value.
There is a secret calculation, a computation. Uh, HMAC is what, Grant, do you remember?
Uh, hashed message authentication code.
Thank you, sir. Hmse RSHA-256 or 512 are also allowed, according to RFC 6238. The result is a 20-byte hash.
Using a last nibble of the HMAC to get offset. Extract 4 bytes from the hash starting at the offset, converting to a 31-bit integer.
Generates the final code. Is the binary….
Of 10 to the… those digits, usually 6 digits. Code is showing….
The user and the Authenticator app. That's how that six-digit code is generated.
And here's a real nice picture of the application. You've got a server on this side.
Authenticator on this side. Which is the app you're using on your phone.
The authenticator…. Sends a request to the server.
For the shared key of the account? Server passes it back, the app now has… the authenticator now has a shared key.
Timestamp at the beginning of the interval. Creates a cryptographic hash.
Then the one-time password. Client then sends the one-time password.
Through the service on the server. Which uses a shared key to create the hash.
And the timestamp…. To create the server, one-time password.
If they match…. It's a success. If they fail, it's… do not match, it's a fail.
Does that make sense to everybody?
As long as there's no…. No quiz.
Yes.
As long as there's what, Grant?
It's right there in black and white.
Yeah, I mean, I'll be… I'll happily send you a copy, or you can grab the….
Slide deck, when I give it to Stanton.
Yeah, I've got another black and white window open, reconfiguring a router while you're talking.
First in 10 minutes.
Can I just fail now?
Couldn't possibly get anything confused here, could we? All right, the specs for TOTP, RFC 6238.
Our 4226 for HOTP? Hash we talked about.
Sha-1, normally, or you can do 256 or 512. Time step, typically 37.
Generated code is 6 or 8 digits. Most of the ones I've seen are 6.
You can actually do it yourself if you want to create it and do it in Python.
There is a Python module called PIOTP.
Example, base 32 Secret. T-o-t-p?
You generate it with a secret that you provide. And then you print it, 6-digit code.
And I thought I had the answer on here, but I guess I don't.
You know, I thought I had…. Too small for you?
I've had so small. Yeah.
That's gonna be on the… that's gonna be on the test, right?
I'll put in chat a bit. Excuse me.
Keep back in patient chat.
Oh, good, now we'll be able to cheat.
There you go.
Alright, I dropped it in chat. I'm not sure if there's extra tests in there, text in… oh, it looks like it.
Oh, it… I fat-fingered, I dropped it in there twice. But it's in the chat.
Okay, so we're talking about one TOTP. Now, hardware two-factor, how does that work?
Obviously, or some of the nice things about hardware-based two-factor. Uh, it is challenge response. You can use different, different flavors of Handshake.
The best advantage of the hardware is…. It is extremely resistant to fishing because there is no human data entered.
During the exchange.
Some of the factors to consider in trying to make a….
Make the decisions what to use. If you have a commercial product.
Vendor lock-in is always a negative. So the question there is, are the benefits.
Are the extra features a vendor provides. Worth the issue of having a single vendor to provide it.
Now, for example, if…. You know, CentOS was a very big product.
For many, many years from Red Hat. But when IBM bought them, whew!
It went away. Vendor lock-in.
Another issue with vendors is how are you going to sync.
Across devices, is there any risk. What about interoperability?
Is it going to run on all your machines? If you integrate it.
With software from the same vendor. Is that process gonna work better?
What if you go to a different integration project where you have to use a different.
Tool like something that works on Chrome, or work on Firefox type of thing.
There are some access control issues. With cloud-based services?
A lot of them are available for Active Directory. And again, if you have a large corporate environment that can justify that investment in security.
It might be an advantage that. The company's willing, or the company would like.
All right, let's talk a minute about browser-based vaults.
Most modern browsers have a built-in password manager. I think I have seen the Firefox password manager actually.
Sync when you have a Firefox account. On a different browser?
Personally, I don't… I don't trust them, but they are there.
The trade-off. Go ahead.
One of the things I've heard about. Problems with browser-based.
Password vaults is…. Functionally vendor lock-in to that browser.
Or that browser ecosystem. Whereas third-party password vaults.
Right.
Usually have add-ins to go into browsers and work mostly consistently across.
Browser ecosystems.
Good point.
Other issue is, can you export it? Again, that export be encrypted?
Can use stored backups of your hardware token? And thanks for your suggestion of printing a QR code and putting it in your.
Personal vault with…. You're, uh….
Actual passphrase for however you accessed your. Password wall.
Final point.
Security is hard.
No kidding. Social engineering is a big issue.
Keeping the muggles from clicking on those phishing links are…. Given the… given, uh….
You know, PO numbers out, so somebody can use them for a fake invoice.
Yeah, and all kinds of… I am really glad I don't have to deal with a large corporate network.
Because if more than one client, if somebody tries to do something like that, the boss will walk up and smack them against the side of the head.
Yeah.
Hey, Lee. Uh, there's Randy. Um, on the last piece of information about, uh, importing and exporting.
From browsers, um, and no, I did not check Chrome, but I know in Firefox.
You can import and export your passwords.
Okay.
I have a similar comment. That you haven't touched on.
One of the things that has been a problem with a number of the.
Let's go with cheap. Password vaults.
And cheap, not necessarily being monetary. Um, but download a password vault, put it on your phone.
There's no guarantee that it actually is using worthwhile. Protection of any form.
Um, Steve had an episode where they talked about a few different password vaults.
And some of them were literally taking what you gave them.
And putting it in a text file and storing it straight ASCI on the phone.
No protection, period.
And that's the password manager you got from Timu from 50 Cent for 50 cents, right?
Uh, you kidding, it costs $5.
Every tariff's involved.
All right, other social engineering issues. Master passwords. At some point, you have to open your vault.
So, you need a good passphrase that you can remember. Or use physical access?
I like Bitwarden on my Android phone, all I have to do is give it a fingerprint.
I don't have to type anything. Another issue is users misconfiguring their multi-factor authentication.
Are not using it, because they can't deal with it. You know, that kind of gets back to Randy's.
Randy's question. You know, how do you convince somebody that's, you know, 60 or 65 years old.
Did they need a password manager? Mm-hmm. When they've got their piece of paper there on their armchair, with the four passwords they need. That's right.
If all you need is 4 passwords, you probably don't need a password manager.
Um, the thing that password managers bring to the table at that point is URL recognition.
It is very, very, very hard. To divulge a PayPal password.
To a PayPal spoof site. If you're using a password manager.
It correlates things with the URL you are on. Like, you have to go way out of your way.
To give your PayPal password to PayPal Bank. Type thing.
Okay? Well, uh… I log into PayPal all the time. I have to, because I use multiple PayPal accounts.
And they have gotten pretty good about. Kind of pushing you down a two-factor path.
Once you give it an email, it wants to send you a two-factor. If you want to use a password, you have to find the link all the way on the bottom and say, yes, I want to use a password.
So, you know, vendors are getting a little bit smarter about pushing people to use two-factor authentication.
So let me just add, um, this is Randy again, uh….
I just checked, uh, the, um…. Uh, the Chrome-based.
Um, system, and it does also import and export. Um, your passwords for you.
Okay.
So, you know. There's definitely been a ways back where.
That was not done, and I think they've come to realize that it's more important for the customer to be able to.
Have flexibility, then, to be…. Garnered into one's….
Situation and not be able to…. Use the information that they've….
Spent a lifetime putting together.
Yeah. Of course, there's two issues that I see with browser-based vaults.
You know, number one, how do you use it on different systems?
You know, if you're at a friend's house, you want to look up a password, how do you do that if you got a Firefox Vault or a Chrome Vault?
They have a sign-in now, syncing.
Yeah, you know, you'd have to install it on their browser, which means you're putting all your private information on that browser.
You know, and the other thing is. You know, what if….
You are in a position where. You want to look up a single item.
And I guess that's really the same problem. You need a web interface.
To allow for the situations where you're not on one of your physical machines.
And then that… but then that web interface has… has to be secure.
And Bitwarden, it's two-factor. I've got the authenticator app on my phone.
And whenever I use a…. System that has not recorded the MAC address for.
It makes me use the authenticator app. Ah, good. But any….
System I sit down at that has that Bitwarden app installed, and I have authenticated in the past.
Our grandfather. Mm-hmm. Because I've never….
You know, I installed it on this machine about 3 years ago.
When I built it, and they didn't… weren't using Authenticator app then.
So, I don't have to use it. Oh, okay. You know, once I have… once that MAC address has been seen on my.
Account, or my profile. You're clear. Sure.
And we mentioned Bitwarden and Vault Warden. For most users.
That is probably the best. Combination of features, capability, and security.
In the marketplace? If you need higher security, a YubiKey.
Sms-based two-factor is not as secure as it could be. The recommendation here is to avoid it.
Although, for a lot of applications, it's probably. The simplest thing you could… the simplest way you can get somebody to use two-factor.
Question. What is SMS-based?
Shoot. Uh, where two-factor is a text message to your phone?
Sms is a text message to your phone?
So are you better to use an email? In two-factor?
Not much better to use Authenticator.
And Apple and Google both will require an authenticator. Result, as opposed to using text-based, so….
If you get a…. Uh, so….
Question. What is an authenticator?
Uh, the authenticator app is an app that we… is the TOTP apps we've been talking about.
Time-based, one-time password. The app on your phone that generates a six-digit code.
Based on a shared key between your app and the server.
Plus the current time.
So that's something you'd find in an app store.
Uh, it… yeah, yeah. You know, Google has them built in. I'm sure Apple has one somewhere.
Okay.
Yeah, that's what I would just… that's what I was just saying, is that, uh, Apple, uh, has a built-in, and so, like, if you do something with Apple, and it will, um.
Require an authentication from your. Uh, Apple device.
And it'll come up with a, uh, a number in the middle of your screen there, basically.
And… or a notification, and then the same thing. Is very similar with Google.
His old son, and many of you have been asked. This is doing, and so, given that David is down, we figured that we'll sit down and we'll tell you everything.
You steep.
What was that?
Steve?
Yeah, that was Steve's background noise.
That he does.
He loses control sometimes.
Yeah, I think he falls asleep.
The video came on at full volume.
If you're watching other videos, please mute this call.
Yeah….
So, um, one of the things that you've mentioned about the 2FA, I think it's real important is.
And one of the things that I've noticed in when I.
When I log into, uh, government sites. Like I, uh, have with the VA.
Uh, it's through id.me, but the opportunity to either do a authentication.
Through, uh, a text message. Or through, uh, my….
Uh, YubiKey, and of course, the YubiKey shows a very strong authentication, where the other doesn't.
Um, and they're very clear about that. And it's becoming almost a standard requirement on government sites.
Uh, I don't remember the exact site, but the, uh…. Um….
The auditor, the government, uh.
They… the… one of the major sites that the government is trying to move you to on… on passwords.
The Inspector General, the government's Inspector General Office said that they had failed.
To provide for. Any kind of backup system.
And their funding. I believe that was it, yes, thanks, Bill.
Was that a login.gov?
That was pointed out on a…. Steve Gibson's Security Now episode.
About 3 weeks ago, I think.
I know that ID.me is one of the sites that they use, and um….
I was a little concerned about setting up with it to begin with when they started.
And I didn't want to do it, but it looked like….
That, you know, matter of fact, I thought it was first a….
A scam, you know, ID.me on a, uh, on a government site.
And it… it has become…. A standard part of.
Uh, of the government authentication.
But, they had not funded. Any kind of backup system.
So if they lose their system, they can't back up. And restore.
Why would we lose our system? We've got a RAID array.
Oh, shit. It's probably RAID 1.
Knowing the government. Oh, okay.
No, no, no, we're saving money. It's RAID Zero.
Taxpayer dollars, after all.
I love it. Oh, alright, there are some other security apps.
That you can get on iPhones, Android devices. Secure enclave-based keys….
I'm sure Apple supports it, Android does too, I just have never had a use for it.
Bottom line, the conclusion here…. No… there is no one-size-fits-all.
We've talked about different… many different factors. Open source, closed source, compatibility.
User issues? That senior person probably has no need for a vault.
Much less… and probably wouldn't be able to deal with it long-term anyway, because….
They were… yeah, go ahead.
I…. I would argue that anybody that is at risk.
Should be using a password vault if for nothing else. Then the protection against.
Phishing slash accidental. Exposure.
I can agree with that, but I….
Especially if you have. Um, an elderly family member or friend that you're helping take care of.
And they have delegated full control of their vault, and you can get to it.
You can help them with things by. Accessing their vault, updating their passwords.
For them, what have you.
Yep. In fact, that's one of the neat things about Bitwarden. You can….
Authenticate to any vault. From your app.
In other words, I could… I could have a vault for….
I don't understand.
Two, I could have a vault for my mom. As a separate entity.
And then I could see all 3 of them. In my app, because I've authenticated against those other two bolts.
Right.
What do you mean by authenticated against? I don't understand that.
Uh, it means I have logged into that vault, supplied the past praised freight….
Passphrase for that vault. And one way or the other, I have used an Authenticator app.
To authenticate…. Against… or authenticate to that vault.
You can have. I tell you what, give me one second here.
I think I understand that.
Uh… let me stop sharing for a second.
And put up my video. Can you read the top of that?
Verification CODIS? Coach.
Yeah, I'm trying to turn it to get the reflection off.
Verification codes, I see that.
Right. Those are the two authenticator apps I have configured in Bitwarden on my phone.
One of them, the top one is Bitwarden, and the bottom one is Flight Circle.
Okay.
Okay?
Which is how I schedule my airplane flights. And you saw those six-digit codes there, if you can read them on the….
On the right-hand side. And they change. The clock is ticking, the circle is counting down.
Yep, yep.
Okay.
So, when you create an authenticator link. I'll call it. You use the QR code for the server.
You scan it with your phone. That tells the phone.
To configure an app. For that particular server.
And then you end up with an entry in the screen here. I used to have a couple more, but I've….
Killed him here, uh, not too long ago, because we're no longer using them.
Is it the same thing… a similar thing can be done with….
Okay.
Google?
And Microsoft and any other app. Has a way for you to scan that QR code.
Thank you.
And set up…. That authenticator app.
I'm assuming the QR code. Actually takes the shared secret.
From the server, gives it to the app, and then when you use the app, it uses that shared secret to.
Mathematically combine that with a time function and create. The six-digit code that you can give back to the server.
They're clear as mud, right?
Right, well, 2 plus 4 does make 6, I think. You're starting to get there. Close enough.
Most of the time.
I think I've got enough parts here that I would understand it if I dove into, actually.
Functionally doing it. Putting it together. Yes, thank you.
Sure. All right, anybody else?
Thank you, Lee. Interesting presentation. And good discussions.
Thank you, sir. I appreciate the assist.
I didn't do anything. I heckled.
Well, you, you, uh, you rambled for a bit and provided some good information, that's….
Worth it to me.
Ah, I let you whet your whistle. Gotcha.
All right, anybody else?
Yeah, well, he didn't… Norman Miller. I need to… I need to know how to do that.
Yeah, and our…. I have to download Bitwarden.
Okay. Um…. My wife and I have computers.
I'd like for her to do it, she's always struggling with trying to do stuff.
Sure.
I've got my stuff in a spreadsheet. I copy and paste.
Yeah, definitely.
Uh, it's gotta be easier than that. And I wanted my children to be able to have access to that in case something happens to me.
In fact, I smell a bass tutorial sometime in the next month or two.
Where I will set up. Password vault, and show you how to import your spreadsheets.
Good. And I use two-factor authentication for a couple of my.
How about that?
Bank sites, so I'm… I'm familiar with that.
Sure. Yeah. Well, once you have BitWarn installed, uh, I'm gonna have to check the version.
You may have to spend 10 bucks a year to get the authenticator app, I don't know.
No, that's fine, that's… that's… that's…. That's cheap security… cheap security.
Yeah.
And it… I think you'll find that…. It will make the user experience.
Better. And this is one of the things I really like about a good password manager.
And other good security. Systems. It….
Improves security. It simplifies things, it reduces frustration.
It protects against spoofs and… or can help protect against spoofs and phishes.
All of those, it's win-win, win-win. To me.
And I tell you what, let me show you a quick demo.
Here's my Bitwarden app. One of the banks I use a lot.
I can find with 3 letters. Okay, there's 3 key clicks.
I click the launch button. It'll take me there.
I hit CTRL-Shift-L. Fill in user ID, password, enter.
Hmm.
I'm in.
But could I ask you a question that's very relevant here?
That's it. Sure.
Um…. No, no, no, no, no.
I'm not giving you the account number.
Actually, I wouldn't…. I wouldn't mind, but that's okay. That's not what I was thinking.
Damn.
Um, I think that with this presentation, this is an excellent presentation on.
The value of Bitwarden. And back in April, I went to a Lenox fair, and there was….
One of the presentations was Bitwarden. And the part… I mean.
Okay.
All the value of it, I'm convinced, okay? The hard part is the part that we want everybody to do, and that is….
To say, to start from the scratch. Download it and go through the process of installing it, and what it takes.
For someone to actually. Set it all up, and use it.
And that's the hard part, and if we had a demo on that.
I don't know about Bitwarden, and I'd love to see a demo, Lee.
I think you would be….
But I know with LastPass, what I've been exposed to for the last decade.
Um, the setup…. If you will, is….
Sign in for an account, and my wife and I have a family account, so there's….
Small monthly fee there. And then I sign it… I sign into the webpage, it says, hey, we notice you don't have the extension installed.
Would you like to install it? Yes. And I was going there, I was expecting it, so it passed… that pop-up, hey, you want to install this, passes that security check.
And then, once it's installed. I go to Gmail, and I sign in using my passwords. It says, hey.
Would you like to add these. Credentials to your password vault.
You say yes. You sign out of Gmail, you go to your bank, you sign in. Hey, would you like to add these to your vault?
You say yes, sign out of your bank, and you can either go through that process for a whole bunch.
Or, as you start doing your normal day-to-day, week-to-week, month-to-month activities.
It learns…. What you sign into. Like, every time you sign in, if you have not signed in before, it's….
Hey, do you want me to add that for you? Um, so I feel like….
The initial account…. And installing the add-in.
The first time? That's a few minutes, but it's not….
Hard. And then the adding new passwords. Going forward, that's also not.
Hard. It's new and it's different, but new and different is not bad.
And then, once you go to it later on, depending on how you set it up.
It will either automatically log in, which I hate. And I disable that.
Or, I think Lee showed he tried to log into something, and he had to click a button in the toolbar.
And it filled things in for it. So, it actually… it knows the URL you're on.
So, it won't give your PayPal. Dot com to Prince of PayPaypal.com.
It's easier, you don't have to fumble. You don't have to worry about mistyping something.
You can have more complex. Passwords, you can have longer passwords, so you're really improving your security posture there.
Um, Lee, I don't think you touched on it, but one of the things that came to light as.
Password managers, particularly browser-based. Password managers, password managers that hook into the browser became a thing.
We started seeing problems where sites. We're handling passwords badly, as in, you can only have an 8-character password, or a 16-character, or some finite password length.
And how they dealt with longer passwords, or more complex passwords, you know, those pesky punctuation symbols, or.
Why do you want mixed-case passwords? So, password vaults actually drug a lot of.
Website security. Forward in the passwords that they would support or allow.
Did anybody else see that happening? Lee?
Well, it is an issue. You know, it really pisses me off that PayPal will only allow 15-character password.
Which is… which is absolutely asinine. It is an issue.
When you create a password, when you can create a 100-character random hash.
We need to look at the fine print. And… but.
A lot of sites where I've seen a problem, they have… were good about popping up a message, password can only be 30 characters, or password can only be 50 characters.
Normally, yes.
Normally. I have had problems where they just… they silently truncated it, and then you don't know what the password is.
And they truncate it differently on the password set form versus the login form.
I've never been able to spot that. I just know that they move forward the password, so I had to reset it.
And I… I forget who it was, but years ago, I had to call or support.
And say, I can't create a password. To… well, you can only have 12 characters.
So I actually knew it. Anyway, back to the Bitwarden.
Yeah.
Option… or Bitwarden options. The free one gets you unlimited devices.
Uh, we haven't mentioned pass keys. That is something kind of new to me.
Uh, and it didn't come up when I was building the presentation.
But passkeys is basically a stored password in the vault. That the server can ask for.
Google does it, I don't know anybody else that does it.
I think Apple is starting to support it.
Yeah, I don't do apple crab, sorry. Uh, but that's basically automatic password.
If I log into Google with my main account. Bitwarden will pop up a little window. Do you… is it okay to use this passkey? And I say yes, and it's done.
You don't even have to enter a password. If you want authenticators.
Cost you 10 bucks a year. Allows you to attach files to a….
Vault entry, easy emergency access, security reports, and more. Uh, for 40 bucks a year, you can get 6 premium accounts for your family.
One of the neat things about. Premiums are….
The families are enterprise accounts, which is… I'm just looking for myself.
You create collections. Like, um….
Banks. Are….
Uh…. You know, healthcare, doctors, or whatever.
And if you… and then you don't have to look for.
A particular user, although. What I end up doing most of the time.
They always start typing. B-i-t-w in the search, there's my Bitwarden.
Entry.
You mean you're not gonna show us the password? I can't believe this.
Stan.
Got the password up there, not gonna even show us. Let's start.
Well, it is showing it, it's all stars. Right?
Yeah.
Oh, he actually showed it for about half a second. Somebody's gonna be playing with a video editor, and he's gonna be glad there's a, uh….
Or Hilton later.
I… the other comment I was gonna make is, you know, uh, I can't imagine anybody not paying $10 a year.
For such an expensive tool, but, you know…. It just seems to be so valuable, and yet $10 a year?
I don't know if anybody's budget can afford that.
Here's another question. What about, uh, fingerprint readers?
What if I die in the…. My son wants to get into my account. His fingerprint won't match.
Emergency access.
That's also where I was saying your devices probably support multiple fingers.
Put two of yours, put two of his. On your device.
Okay.
That's a little bit like your cell phones, where you can put multiple, um.
Right.
Multiple access points, you know, whether it's your fingers, or whether it's your….
Yeah.
Face, or even your partner's face, or whatever it is.
Yeah, um, it's…. Enrolling multiple people.
On your device is conceptually very similar. To putting your….
Significant other and your children as authorized users on your checking account.
With film being authorized users and full authority. If something incapacitates you.
They have already have full authority. There's no process they have to go through to be able to use.
Your device or your account. They have it. You have given it to them. There may be something they need to do in the event of your passing to change ownership.
But they already have full authority, so even that process is easier.
Enroll two of your fingers, enroll two of your significant others, enroll two of your kids.
We, you know, we also… we already have our trust in….
They're, uh…. It's taken care of in there. And we have that, uh….
Um, I… and I'm glad to hear you have that. But the thing that….
They'll be named in a trust. That means legal system has to get involved.
And go through…. Processes, which take time.
And they cannot access. Your things while that time is happening.
But if you actually. Add them as authorized users.
Yeah.
12 hours after you…. Go into the hospital, they can access things for you.
Um, if you're… they're there. At the hospital with you.
And the doctor says, hey, do you have current details on medical information?
They can open up your phone with their thumb. Go to the known place, and yeah, here's the notes from your doctor's visit 3 weeks ago.
There is no… we have to go through the process, somebody has to bless this and give it to you.
You give it to them ahead of time. Does that make sense? Does the difference make sense?
Yeah, yeah.
Very good, yeah.
Here's the thing, we… we…. One of our children we don't trust their spouse.
So, we can make them…. A co-owner.
We're concerned about the spouse.
Fair enough, and I'm sorry for the situation. I don't have a technical solution for that.
Yeah. Yeah, I know.
There's a thing… I put a link in the notes, uh, chat, over on Wikipedia.
They've got a thing called Shamir's Secret Sharing. And they….
Play games with, uh…. Little squares, I think it is.
And I think what you do, you print out. Uh, like, 3 different sheets.
And each one just looks like random squares. But if you end up stacking one on top of the other.
It will show you the… whatever…. Secret you had on her.
And I think you can do, like, 2 out of 3, or 3 out of 5, or 5 out of 7.
I forget what it is, but you can have. Different versions, or whatever.
And then you just pass each person one of those. That way, they all have to be, you know, at least….
3 out of 5 or whatever, have to be. In agreement to, uh.
To do that. But just something to think about in that respect.
That, uh, comment that Phil's talking about, I…. I brought it up on the screen right now.
Uh, he'll put it out there in chat at 7.30. Shamir is Secret Sharing.
To, uh, Phil also. Shortly before that, put out a nice little article from ex….
Xkcd on password strength. I'm gonna run through real quick the stuff that's in chat. It was some interesting stuff, I just want to make sure people know.
About it. We didn't mention it as it was happening. Uh, Stan.
Put out there, uh…. An article on Bitwarden, uh, security.
Readiness kit, uh…. And Stan also put out there.
Santa done a tutorial on, uh. Keypass XC.
Uh, it was done back in April of 23, and it, of course, is in our archives, so you can go out to the archive and pull that if you want to see.
The tutorial from April of 23. Randy.
Thank you very much, Randy. Randy did an extensive. Set of comments in here. It's basically a comparison of a lot of the popular password vaults, specifically.
One pass, last pass. Uh, KeyPass XC.
Anyway, I'm gonna…. Scroll down slowly through them, not going to read everything, but for each one of them, it gives the detailed list of the pros.
Pecans, uh…. Then starts the next one, here's one pass. Why did you make that window….
A lot wider… widen the window. It doesn't do that.
Okay. You can't make it wider like I do here?
Nope. Wow.
The entire chat thing will be available on the presentation archive in a day or two.
Yep, I'm just highlighting that it's available out there. Here's the pros and cons of last.
Pass, here's…. Uh… road….
If you save it, and you can see it in a text format, and it's easy to read, um, in that format.
And at the very end, there's a summary. And it'll be a little easier to read in the summary once you get it in the text format. So I would tell you to just save the, um.
The chat. That part right there.
Yeah, and here's the… as Randy just said, there's the quick summary table, gives, uh.
Uh, so many check marks, or so many X's for each of the products.
And then there's a, uh…. Uh… kind of a final, uh.
A best overall choices, uh, in this list turned out to be Bitward.
But, uh, you got all the details there to look through.
So, uh, as Randy said. Right now, while we're still up and running, you can, uh, simply.
Save the Snapchat for yourself. As, uh, Stan said.
This trap will be in the archive, and you can pull it down later from the archive if you want to do it that way, but whatever you find more convenient.
Ed Howland, uh. Ask the question. We haven't answered it yet.
Is OnePass X platform? It used to be Mac only.
If I….
Uh, right before that, I…. Put a thing there that Scott Graniman had done a presentation on 1Password in March of 2021.
And… I know Scott…. Does, uh….
Apple stuff, but I believe that it is cross-platform. I don't… I can't say for sure, but I believe it….
Is also. Cross-platform, so Apple and….
So you're saying, you're saying…. Mac and Windows.
Yes.
As I don't think they have a Linux. Uh, buy it.
But, you know, I… personally, I don't care, because I used to….
Pfas XC, which is cross-platform.
I just want to comment, um. And thank you for the presentation, very well done.
Um, I gotta go to my next, uh, meeting, but I enjoyed it, and again, thank you, see you at the next meeting.
Cool.
You know, I want to say thanks again. I… there's… I don't have a resistance other than I don't know how to do it.
I'm just waiting for, uh…. Instructions on how to do it.
Oh, maybe we'll have to do that next month, Gary. Sounds good. A couple things… other comments here in the chat. Uh, let's see….
Uh, that was just a…. Goodbye to somebody, you know, a little farther.
Uh, DO mentioned, uh, Cisco Dual Essentials, another cloud-based good hardware boot-up.
Uh, uh…. Gave the price, uh….
In fact, it's also free for 10 users. Uh, so, uh, thank you, Deal.
And Dio also agrees that, uh. Uh, Bitward seems the best, so….
Uh, Lee, uh, added some things in the chat there about, uh.
Uh… top… P. And, let's see….
Print it out. What is a printer? And you want to explain that?
What was that again?
You've got it. There you go.
It is source of headache that takes paper. Jams, crumples it, might print something.
Makes a mess of things, and general source of frustration, and a money suck.
Grant, uh…. Ed was being facetious.
I think it's a great, great summary. Thanks. Yes.
Because he… because he's blind.
Well, that's not it so much. I think it would be perfectly fine.
For me to print out a QR code, right? If I had a printer. Um….
I guess the bigger question is…. Uh, printers are.
Like Grant was saying. First, hard to come by these days, and B, unreliable, and a whole bunch of other things.
Well, that's why you're buying a new printer. All my printers are, like, 20 years old.
Well, around Christmas time, you go in and you buy a printer, and you print your Christmas cards, and then you take it back.
Perfect.
Because you'll just have enough ink to do the half of your cards.
Isn't that called a Walmart rental policy?
It was a thing for a while where you could, uh….
Take your laptop to, like. Um, Kinko's or someplace, and uh….
Get them, or maybe…. Have something on a USB key or something, you get them to print it for you.
At least they maintain their privacy.
Yeah.
And, uh, Lee, you can actually get a quote-unquote printer. That will print 3D text as, uh, braille.
Perfectly fine for Ed.
Well, it'd be great if I could read Burial.
Okay. Well, fine….
Steal my thunder, Ed.
Oh, by the way, uh, Grant, I just wanted to say, on behalf of us.
65-plus-year-old, uh. I resemble your disparaging comments.
Earlier….
Which one I've made multiple.
Uh, you know, he said, you know, if you've got a family member who's.
And, like, 65 or older, or something like that.
Um, and I generalized, but, um…. Who was it? Uh, either….
Krebs…. As in Krebs on security.
Or some other…. Well-known name in security.
Within the last few months. Was fished.
Yeah, that was, uh, I know who that is. That's, uh….
And he entered a….
Troy Hunt. Troy, huh?
Uh, the guy who does, uh, have I been phoned? Um, yeah, Troy Hunt, yep, and he….
Yeah. Roy Hunt.
He gave a full, detailed. Yeah, what happened with it and everything?
If you wondered why his password? He wondered why his password manager wasn't working.
That's pretty good. He was… he was out and about…. In a different country.
Yep.
And it was… what was it, like, 30 seconds after it happened, he realized, seems like.
Right. Crap, yup.
Crap. And the reset from that, the recovery, didn't it take him multiple weeks?
Mm-hmm. Yeah, and he detailed it all in his blog, yeah.
Jetlag had a play in that, too.
Right. Yeah, it happens to the best of us.
It happens.
65 or older or not.
Unrelated to, uh, the topic tonight, or whatever. I think the first comment in the chat I put in there early on.
Uh, for any of the hams in the group. It's a pretty good map, or whatever, it shows.
You pop it in there, and you either put in a zip code, or….
Or a call sign, or a grid square, and it will….
Come up on the screen and show you, uh. The locations, everything, overlaid on a Google map.
If you're 9AM, if you want to find out if there's any….
Hands in your zip code, you can put the zip code in there, and it'll pop up all the ones that….
Are living around you.
Unless it's a P.O. Box.
I'm surprised the, uh, P.O. Box is allowed.
It is totally legal, anywhere, for anything. Except for some idiots. Oh my gosh.
That was a good presentation, Lee. I got a lot out of it, a lot of stuff I didn't know.
Excellent, I'd appreciate it. Yeah, great stuff. Thank you very much, Lee.
Yeah, but that's not the password manager that's…. Ed uses, though.
What do you… what do you….
Uh, yeah, I'm thinking about it, though.
Tell them what you use, Ed.
I thought you used a different one.
Um, I have been using, for a while, I've been using.
Pass the standard UNIX password manager. That's actually on their, their, their website.
Um.
Yeah, isn't pass a glorified wrapper around. Gpg?
Yes.
Uh… yes, in the sense that it, uh. Uses GPG for encryption.
Um, but…. Uh, it's really just….
Out of a bunch of, I think, Shell and Python script or whatever.
Yeah. Yeah, I, uh, tried PASS.
Um, but his command line, that's what I like.
And I did not like it. And I actually wrote my own….
Shell script as a wrapper around. Pgp, or I'm sorry, GPG. It's….
Functionally the same, and if you. Twiddle things, you can use either command.
Right.
I think once upon a time, I heard. There was a browser add-on for at least Firefox to interface with PaaS.
That could be.
I do know that they have an add-on for. To allow you to do, uh….
Otp.
At the moment, all my two factors are, um, SMS-based. Um, it's really difficult, though, because….
Uh, you get a… you get sometimes a six-digit code, and sometimes an 8-digit code.
My bank has an 8-digit code. Um, it's all num… it's numbers and letters.
And…. The screen reader….
Oh, God.
Um, it's, like, doesn't know what that is. Sometimes it tries to.
Pronounce it. Sometimes it, like. You know, gives you the actual letters, but it gives you….
Gives it to you so fast. That it's really difficult to, uh….
You know, use that 30-second window to…. I have to kind of memorize it.
And it's really hard for me to memorize 8 characters. I can do 6 pretty easily.
A third. One of the things they recommended from the.
Blind school was, well, use a. Digital voice recorder.
And then, um… but I tried doing that. Problem with that is that.
Hitting the, um…. Playback and pause and….
Play button again. You know, like, say, 3 digits and then 3 digits in, and 2 digits, right?
Um, still took more time. And the window allowed.
So, it's just a real problem. It's made… we live in a world that's made for sighted people.
I have two things. First, a request for comments. And, uh, then a quick statement of opinion.
Uh, the request for comments is, uh, for any of. Those of you who, uh… it's either your first time at a meeting tonight.
One of our meetings, or if you haven't been to one of our meetings in quite some time.
Yeah, please, uh, put into the chat, or just open your microphone and tell us.
What motivated you to come tonight? I mean, did you…. Fall in love with the topic, is that why you want it to come? Just a good night for you, or….
You just heard about this one. Uh, but yeah, we're curious as to what brought you here tonight, so think about that for a couple seconds.
While you listen to my opinion. I'm…. Thoroughly disappointed in tonight's presentation, because.
I mean, the big question wasn't answered. The big question in my mind is.
Yellow posting notes, or do I just take a piece of 8.5x11 notebook paper, rip it out of the notebook, and paste it down the right-hand side.
Of the screen. I mean, that's the basic question we had to answer tonight, and I didn't hear that discussion.
Uh, that's real simple, Gary. Uh, it depends on the number of passwords you want to store.
And the size font you want to store them in.
There you go. Okay, uh….
Any, uh, any new or not long-seen users want to answer my question as to what brought you here tonight? But, uh….
Is still thinking about that. You can keep thinking. Uh, any other questions, comments?
Remember those movies where the. You know, they're like, they go to, oh.
Are we ready to shut down?
How do we break into this guy's computer, or whatever? Hey, let's look at the bottom of the keyboard.
And it's like, okay, if it's on the bottom of the keyboard.
And… how do you get it? Back, you know, do you have to write it down, and then.
Turn the keyboard back over, and then type it in. I didn't understand that in the movie.
I used to work, uh, help desk at the Army Records Center back in, uh.
1980s, and uh…. I couldn't tell you how many times I actually did that, turn the keyboard over to find a little sticky there.
I had a password, because we… help desk was always been required to… so-and-so's been sick for 3 weeks, so he can't get into his stuff, you know?
It was quite common.
I think they, uh, after, like, many, many decades, they…. Uh, um, brute force….
Ken Thompson's original Unix password, right? And it was some kind of chess move, I think.
Like, you know, Queen Bishop to E4 or something.
Wasn't that a thing they did. When people were getting ready to leave, and I halfway suspect.
That he changed his password to something like you're saying, a chess move.
That was a joke. On the person that eventually cracked it.
That's about a good possibility, I don't know. Uh, just remember that.
Don't know.
Are we ready to shut the recording down?
I think so. When you're booking, Gert, any other final comments for the night?
Last chance… 3, 2, 1…. Okay, bookend. Uh, this has been the St. Louis Linux User Group, St. Louis Lug.
Today's date was Thursday, uh, July the 17th. 2025. Uh, this is our regular night for this meeting, and uh….
Tonight's presentation was on, uh, password vaults and authentication tools. Our speaker was to be Lamert.
Thank you all