Protecting against a password manager breach: part 2

A recipe for keeping your online accounts safe

In part 1 of Protecting against a password manager breach, in light of LastPass’ recent back-to-back security incidents (i.e. one long drawn out incident), I provided an overview of how password managers could be successfully breached and what users of password managers can do to protect themselves against such a breach. In this context, a successful password manager breach means decrypted data from a password manager is obtained by a malicious actor.

Let’s dive a bit deeper into how best to combine and use these ingredients for hardening your online accounts in the event your password manager (or really any of your passwords in general) gets breached.

Photo by ilgmyzin on Unsplash

Harden your password manager and online accounts 

Here’s a summarized checklist of steps you can start taking to harden your password manager and online accounts. I’ve also ported this over to GitHub in an actual checklist format and also to encourage folks to submit pull requests for additional ideas or edits. 

NOTE: As mentioned in part 1, for the sake of simplicity and security, this guide assumes you’re only using Apple devices. I'm also assuming you’re using 1Password, BitWarden, Authy, and 2 YubiKeys.

Securely setup 1Password

Setup 1Password for creating and storing passwords and password equivalents, such as security question answers. Especially in light of LastPass’ latest incident update, 1Password’s Secret Key feature, which is built-in at the moment of account creation, guarantees universal protection against offline brute force attacks.

• Use a unique passphrase for logging into 1Password

• Setup MFA with YubiKeys only

• Store your 1Password passphrase in a secure place (fireproof safe = better security, Apple Keychain = better usability)

  • Your 1Password Secret Key can be stored in the same place since it's designed to be an entropy-boosting addition to your password

Harden foundational accounts

These are accounts that, if compromised, could be used to reset account passwords or access Passkeys.

• Ensure email account has a strong password and MFA setup with YubiKeys

  • Use Gmail (Google’s security is top notch). If you're extra paranoid, use Protonmail

• Ensure Apple ID has strong password and MFA setup with YubiKeys

Protect against SMS MFA code theft

Some of your accounts may still only support SMS MFA codes (and any form of MFA is better than no MFA). Similarly, some sites and apps, such as Authy, use mobile phone numbers for account creation. Hardening your mobile phone number and account is essential in these contexts.

• Create a strong password for your mobile carrier online account

• Setup MFA on your mobile carrier online account

• Setup a mobile carrier PIN to protect against SIM hijacking (Verizon, T-Mobile, AT&T, Sprint, Cricket)

• Setup Google Voice number to be used for SMS MFA (you can disassociate it from your mobile phone number later on for added security)

  • Ensure Google Account has strong password and YubiKey-only MFA enabled

Securely setup Authy

Use Authy whenever time-based one-time passcode (TOTP aka “Google Authenticator”) MFA is the most secure option available. If you’re extra paranoid and are willing to make some usability sacrifices, try storing your MFA codes in a YubiKey and use Yubico Authenticator to access them.

• Setup Authy using your Google Voice number

• Enable Authy Backups and create/store a randomly generated Backup Password with 1Password

• Disable Authy Multi-Device access and only re-enable when you're setting up Authy on another device

  • If you are able to, install Authy on at least two devices so you don't have to go through a painful account recovery process if your only Authy-installed device breaks, is lost, etc.

  • If you’re extra paranoid and are willing to make some usability sacrifices, try storing your MFA codes in a YubiKey and use Yubico Authenticator to access them

Securely setup BitWarden

Setup BitWarden for storing TOTP MFA recovery codes and MFA recovery code equivalents such as seed keys.

• Setup a BitWarden account using an email address from a different provider

  • E.g. if you used Gmail for your 1Password account and other accounts, use Protonmail for your BitWarden account

• Use a unique passphrase for logging into BitWarden

  • Store your BitWarden passphrase in a secure place (fireproof safe = better security, Apple Keychain = better usability) but not in your 1Password vault

• If you're already paying for BitWarden, setup MFA with YubiKeys only. Otherwise, setup TOTP MFA codes using Authy

Enable MFA everywhere you can

Don’t delay, enable MFA today! This is essential for protecting your accounts in the event their passwords are compromised.

• Use 1Password Watchtower to identify accounts that support MFA and ensure MFA is setup on all of  them

• Explore 2fa.directory to identify additional accounts that support MFA and ensure MFA is setup on all of them

Change compromised and vulnerable passwords

• Use 1Password Watchtower to identify passwords of yours that have been caught up in past data breaches

• Change each compromised or vulnerable password

Change weak and reused passwords

• Use 1Password Watchtower to identify weak and reused passwords of yours

• Change each weak or reused password

• Replace passwords with Passkeys (WebAuthN) where possible 

Detect account compromises as they happen

• Setup email rules for new device login, suspicious login, password reset, and MFA change notifications

  

  Examples of email notifications about logins from new devices, changes to MFA, etc.

• Start treating rogue SMS MFA codes and push notification MFA prompts with suspicion, changing passwords when benign cause of rogue codes/prompts can't be identified 

  • Especially if you receive a message from someone who claims to need your MFA codes or for you to approve push notifications. If this happens, change passwords and report to your account provider ASAP

That’s it for now. When all is said and done, this is what your password manager and online account security “architecture” will look like:

High-level overview of a hardened password manager and online account setup

Stay tuned for part 3 of this series where I’ll cover how password manager developers can secure their software development lifecycle (SDLC) and cloud infrastructure to protect their customers.