Hands-on: install and set up a password manager
In the previous session we established why a memorable password is already too weak, and then we checked Kelly's password against a breach list and found it sitting in public view. That was enjoyable for me and less so for Kelly.
Today we stop debating and implement. Bring the device you actually use to log into things — phone or laptop. We will not adjourn until yours is working.
Step 1: Select one
Several capable password managers exist. I won't name a specific vendor and declare it the correct one, because that ranking shifts every year and I don't want this lesson to be obsolete in six months. The criteria I want you to apply:
- It runs on both your phone and your computer, and synchronizes between them.
- It offers a free tier or a low-cost plan. You do not need the premium version to begin.
- It has an established track record and reasonable reviews. Disregard anything that appeared in an advertisement five minutes ago.
If you're uncertain, ask me during practice time and I'll point out a couple of options on the screen at the front. I do use one myself, but I would rather you choose on those three criteria than on my saying a name aloud.
Step 2: Create your account
You'll choose a single master password. This is the only password you must remember from this point forward, so make it a genuine one: long. A short sentence works better than a word with a number appended. Four random words strung together is genuinely strong and you can actually retain it.
Write this one down on paper, once, and store the paper somewhere secure. Not on a sticky note on the monitor — a drawer, a safe, somewhere neither your children nor your cleaner will encounter it.
Step 3: Install it on every device
Install it on your phone. Install the browser extension on your computer. This is the step people skip, and then they wonder why it isn't helping them. If it exists only on your phone, you'll end up typing passwords into your laptop by hand anyway, which defeats the purpose.
I'll move row to row here. If your installation stalls, signal me. Don't simply sit and scroll your phone waiting for it to resolve itself. I will notice, and I will come ask you about it directly.
Step 4: Import or add your existing passwords
Most of these tools can extract passwords directly from your browser if you've been allowing Chrome or Safari to save them — which many of you have been doing without realizing it. That's a reasonable starting point, but it also means you're importing all of your weak, reused passwords into one location. That is acceptable for today. We correct that over time, not in a single sitting. Nobody is changing forty passwords in one class period.
Select the two or three accounts that matter most — your email and your bank — and let's generate new, strong passwords for those today, right now, in this room.
Step 5: Let the extension do the work going forward
Once it's installed, when you log into a site, it will offer to save the password. Accept. When you create a new account somewhere, it will offer to generate a random password. Accept that as well. You don't need to see it, memorize it, or record it anywhere. That is precisely the point.
This is where I'll mention Laurel. My sister received a text some time ago stating that a package couldn't be delivered, with a link to click. The earlier Laurel would have tapped it without a second thought. This time she forwarded it to me first. A small thing, but it's the entire course functioning before the course existed. The same principle applies here: once the password manager handles the remembering, you get to be the person who checks first, rather than the person rushing to log in who clicks whatever is fastest.
One position I'll restate here, because it matters today: passwords you can memorize are already too weak. I know some of you still believe you have a sound system. You don't, and neither did Kelly, and his was sitting in a public breach list as proof. Use the manager. The argument is closed — I've heard every version of it already.
A genuine caution
Do not lose that master password. There is usually a recovery process, but it can take days, and some services genuinely cannot restore your access if you lose both the password and the recovery information. Write it down, store it somewhere secure, and tell one trusted family member where that is. That isn't paranoia; it's planning for the day you drop your phone in the toilet.
Before next time
Change your email and your bank password to something the manager generated, if we didn't finish today. Two accounts. That is the assignment.
~kenneth