Chances are, if you’ve used a computer you’ve used a password. Passwords are the ubiquitous way in which we’ve controlled access to files on a computer since the very dawn of personal computing. In this blog post, I aim to walk you through the basics and then move on to some advanced topics.

The Basics.

At the simplest level a password is a secret that you memorize and provide to a computer program when you want access to something. The program checks the password you provided against a password that it has remembered and decides to grant you access or not. In the early days, this just involved comparing the password string you typed against a string stored in a file as plaintext on your computer. But as things have gotten sophisticated, the programs use advanced mathematics to do the same thing in various ways. There are several articles online that can go into the details and I invite you to read some of them I’ve referenced below:

• Password Security A Case History
• Where did passwords come from

Why passwords are important.

Let’s think about how passwords affect us in the modern world. We’ve come a long way since the days when passwords were stored as plaintext on a computer and used primarily to guard access to a mainframe computer on a college campus for students and faculty. Today passwords guard our email accounts, social media and even banking, insurance and healthcare accounts. So it’s not a stretch to say that passwords are important, and passwords can be hacked!

Simple steps for password hygiene.

If you take nothing else away from this blog post, I want you to internalize the 3 sections that follow:

You must use more than one password.

Using a single password for all the sites you login to is probably the worst security posture you can have. Like I said before, passwords can be guessed or found out and in the case that happens, you want your exposure to be minimized. Using different passwords on every site that you use increases your odds that if a single password is compromised only one of your accounts is affected!

You must use a password manager.

We sign up and use hundreds of things online, and memorizing hundreds of passwords is inefficient, so you should be using a password manager. A password manager is nothing but a program that simply stores all your passwords in one place. There are several convenient options for this and you should read popular sites like wired to select one. For the most part, it doesn’t matter which one you select, however there are some caveats which I will get into below.

The second factor.

A password is something you’ve memorized (or you stored in your password manager) and you present to an app or service when you log-in. And like we discussed, even if you try your best to protect it, it can get hacked. So modern apps and services give you the option to use “a second factor” or “2FA” authentication.

2FA is nothing but ‘something you have’. So by combining your password (something you know) and a token (something you have) you reduce the risk that an attacker can compromise your account. The something you have is usually your phone. So you can choose from a few different options:

1. An authenticator app on your phone that produces a unique 6-digit number every 30 seconds that the website will ask you for after you’ve entered your password.
2. An SMS that the service will send to your phone number after you’ve entered your password.
3. A security key verification where you plug-in a USB key (usually a Yubikey) on your computer and touch it to verify that you have possession of this key.

A note on Passkeys.

Passkeys are often discussed alongside passwords, but I think that approach makes it confusing. Passkeys are not passwords, they are a completely different approach to computer security that uses public-key cryptography on your device, and we will talk about them in a separate blog post. For now, you just need to know they exist and that they have nothing to do with typical password based authentication.

Don’t put all your eggs in one basket.

When deciding where you save all your passwords, you should think about ‘vendor lock-in’. If you put your passwords in Lastpass, what happens if they go out of business? Or if you store your passwords on the Chrome browser from Google, and you get locked out of your account for some random reason? This is one of the caveats I mentioned earlier about using a password manager.

So whichever password manager you go with, make sure that you create secure copies of your passwords somewhere safe like a USB drive and do this periodically so that the drive stays updated. (This is not as hard as you think, we don’t change our passwords sometimes for years, so creating a backup even once a year is pretty good!) If you’re doing this in addition to using a password manager and using 2FA you’ve already taken care of 99% of what you need to be doing!

Deeper waters.

From here on this blog-post goes into some deeper waters. If you’re a casual computer user I invite you to read this but don’t be overwhelmed. I will be posting more articles in the future that dive into the details and specifics of some of the things discussed below and you can follow along.

Freedom & Software Autonomy

In my previous post, I discussed how using applications with GUIs (Graphical User Interfaces) is really a crutch. These allow developers to hide a tremendous amount about ‘how’ the program works and present you with a sleek interface that lets you just ‘get on with it’. This is great product design. (You can simply look at Apple’s quarterly earnings to understand how well this works!) However, relying on these tools greatly reduces your digital sovereignty and personal security.

To truly use a computer ‘freely’ you must use Linux. And to understand what ‘freedom’ means read What is free software. There are 4 basic freedoms:

• The freedom to use the program however you like.
• The freedom to study how the program works.
• The freedom to redistribute and make copies of a program to help your neighbor.
• The freedom to improve the program and release your improvements to the public so that everyone benefits.

Once you understand this principle, you will realize the importance of choosing free and open-source tools to do as much of your computing as possible. Using anything that’s owned by someone else and rented to you, can be taken away. Just read this article from 2009 about how Amazon pulled back some books from their kindle library to understand how this works.

We use and rely on a great number of proprietary services these days, such as Amazon, Google, Apple or the software from your bank or healthcare provider. So it’s important to realize that you need to set boundaries and protect what you provide these companies and what you should keep secure for yourself.

The Unix Way: gpg & pass

So on that note, I want to talk about gpg and pass. These are the most basic terminal based applications that you can use to manage your passwords. gpg stands for GNU Privacy Guard and it’s a simple program that lets you generate secure encryption keys. These keys can live on your computer or be transferred to a USB drive or Yubikey that you can then carry around with you. The key can be used to encrypt almost anything. We’ll dive into this in more detail in a future post.

pass is the standard unix password manager and also available on linux. It follows the simple Unix Philosophy and allows you to store your passwords on your computer and encrypt them using a gpg key that you generated with the gpg tool I mentioned before.

This combination is by-far the most secure and easy way to manage your passwords once you become comfortable using terminal based tools. These are ‘free’ tools. Copies are available abundantly and from many sources and you can even compile them yourself! The friction to using them, has several workarounds. But like all good things that last for a long time, you will need to invest some of your time to getting to understand them better.

AI: Your Local Terminal Tutor

Surprisingly, AI can be your best friend to learn these tools faster than ever before. I mentioned in my previous post that I strongly recommend AI to help you with your journey. The correct way to do this, while respecting the principles of computing freedom, is to use a free model such as Gemma or Llama on a platform like Ollama. This gives you a great local AI chatbot that runs safely on your computer and you can ask it questions about most common linux commands and it should be able to answer them well. For example, try “Explain how gpg works” as your first prompt, then follow up with any questions you have. Soon you will start to understand the key ideas and become confident about using these tools from the terminal yourself!

Conclusion.

Remember, the real world is outside and around you. Your interactions with computers must be specific and task-focused. Computers can occasionally become an escape and offer infinite entertainment, but like all dreams you must eventually wake up. I hope that this brief guide on using passwords and keeping better password hygiene will help you set up your digital life to be more secure and let you walk away and live in the real world resting assured that you’ve handled your passwords in the most secure way that you can!