“My First Password Manager”

Dad, I need a recording button hooked up to an earphone.

What?

We were visiting my in-laws and the cousins were upstairs playing. They were taking turns playing sentry, determining who was granted entry to my sister-in-law’s childhood bedroom. There was a password. Or maybe passwords? At any rate, the grown-ups weren’t privy to the specific security parameters, and certainly were not to be entrusted with the password.

Herein lay the problem — My son wanted a method to remember the password for future usage, but with the following restraints:

First and foremost, only he and his oldest cousin (The Gatekeeper) could know his password 🤐. Furthermore, no adults could know the password nor could they be involved in the storage or retrieval of said password 🙉. The password needed to be stored securely for the future, at the grandparents house. Lastly, while my oldest was at the point of knowing his letters, beyond sight words, his phonics skills were not yet at the point where he could write and read arbitrary words.

Now, it must be said that my son tends to remember things, and remember them in detail (Do not make deals with him just to play around, he will remember and hold you to them!). On top of this, it seemed like they were changing the password every couple of minutes. From my old, wise adult perspective, I of course foolishly suggested this wasn’t that big of a deal anyway — neither of you will remember the password even if you write it down, you’ll just come up with something next time.

This was not acceptable.

The older cousin (or maybe a grandparent was sworn to secrecy?) wrote down the password on a piece of paper 📝. By the time I am brought in, two paper plates are already stapled together such that the piece of paper is secured with only a small gap along one small arc accessible. This honestly seemed pretty good to me at this point: The password is stored on its own slip of folded up paper, the paper plate case provides a reasonable outer shell, and this password manager can be stored in a secure location by his grandfather in a place no other kids can access and no other adult cares to look.

But there is still the retrieval question.

Can’t me or grandpa just read it to you?

Of course not, that would violate the principle of least privilege. Worse off, how could he be sure I wouldn’t further leak the password to adversaries, like his younger brother 🤫👂🏼👶!

Back home, we had some voice recorder buttons from an old security awareness project. Essentially those big ‘ol Easy Buttons with the ability to record a custom message. Great! Problem solved, Daddy is the best! Except, of course not: Those have a speaker — other people might hear! I implored of my son, you can just go off to the corner, the bathroom, no one else will hear it!

That level of security and risk was not acceptable for such a crown jewel 👑💎.

Okay, well. Let’s leave the written down password on the piece of paper, inside the paper plates, and I’ll work on building you something next week. Wink, wink 😼. He’ll forget by tomorrow.

He did not forget.

Of course not. As I mentioned, his ability to remember arbitrary details is strong 🧠💪. Well at least this means I get to play with the soldering iron! Electronics! I already have a working button with a speaker, I just need to buy a cheap set of headphones and solder those on instead, right?

A few days pass. I can’t get this to work with what I already have lying around… One of the interesting surprises of being a parent is that (a) your kids don’t yet know the limits of possibility, or at least reasonable possibility and (b) they think you can do anything 💪.

He was right when he told me we could make this crazy Rube Goldberg thing out of stuff we had laying around. It’s nice when someone believes in you.

So I iterated, but I grew frustrated…

There is a reason I do software and not hardware.

At any rate, the actual DIY process and building isn’t blog worthy this time around. I eventually purchased a greeting card record/play module and realized that the headphones I purchased also had a microphone wire. There was some snipping and resoldering, but eventually I delivered something that meets the customer’s requirements. I apparently bought something that will repeat the recording in a loop instead of stopping. The web page said there was a mode switch or jumper, but I didn’t see it. Luckily, it stops if you press the play button again — That’s good enough, alright?!

By this point, I’m not sure if he still remembers the actual password. I mean I’m pretty sure he does because, well, he remembers everything (fortunately / unfortunately?). But we brought home this precious paper plate vault. And I built this stupid thing. You know what, the hacker itch got me. I’m going to read that password.

I shake around the paper plate enclosure and out slips the valuable data. My eyes behold THE password, which is…

1. A truly awesome password (long and strong baby! 📏💪), very cute 🐣, and funny 🤣🤭.
2. Not the password I (thought I) overheard them saying. Yes, of course I was trying to hear it while they played! Maybe a decoy? Maybe a honeypot 🍯?
3. Oh did you think I was about to type it out for you😆😳? Here? On the Internet? Get real, I can keep a secret.

Quis custodiet ipsos custodes 💂👀?

My prying eyes… I guess this is why he wanted to store the password manager off-site where only his grandfather, a trusted administrator, would even know where it is stored, and he would store it with his own lock or other layers of security, presumably.

…well I read it and recorded it: The button is alive!

He comes home from school —

I did it, son! You were correct, you do have the best dad in the world… nay, the Universe!

He’s pretty stoked 👨‍👦🏆🦸‍♂️. He does not question why my voice is saying the password into his ear 😌. He calls down his younger brother. He instructs him to stand about five paces away. The earpiece is inserted: “Did you hear that?”. he asks. His Brother: “No”. A resounding success!

We decided to make one more modification. I cut the wire to the record button. What’s the point of protecting something if you can accidentally destroy it with the touch of a button? The original password on paper is still there, for redundancy, but then someone needs to read it again for him. Fortunately, if we really need to… another opportunity to use the soldering iron.

As all this is going on, I must admit I am pretty proud of the OpSec and thought process that my son is putting into all of this. As someone who does security awareness and training, I would like to say I’ve been training him up…but the reality is probably YouTube. I am sure I can still take some credit here 🤷‍♂️. To be honest with you though, I am actually impressed that a good number of random kids cartoons floating around YouTube, etc. touch on password management and other basic personal security concepts. Even better, they tend to actually get it right.

And no, I’m not going to tell you which videos to check out. It’s called job protection.

At the risk of being superfluous or pedantic (using those SAT words today 🏅), let’s pull out some concepts and more formal lessons from this story so you too can improve your password management practices.

Principle of Least Privilege

Whether it is passwords, a file, an app, database — whatever, you always want to make sure that only the minimum number of people, with an absolute necessity are able to access some data or function. In this case, only The Gatekeeper and my son should be privy to the password. Me, the dad, certainly cannot know the password ☹️ — Not because I cannot be trusted, but because there is still the risk of inadvertent leakage due to possible poor practices or perked up ears of other cousins and siblings!

Operational Security

Beyond controlling access (a single point-in-time decision), there is the matter of the associated processes around creating, using, and managing the password. Here’s a real life example: When looking at the controls for a highly secure key generation process, it was not enough to simply generate the key using a hardware entropy device so it could not be guessed. The process is performed in a special “tent”, which was not only a Faraday cage, but physically prevented visual observation from people and cameras, in an already otherwise “secure location”.

As in all cases, there are costs and tradeoffs associated with the degree of implementation. A parent remembering the password could lead to issues such as the parent writing it down insecurely (:cough: Ahem :cough:, Mom; Dad would use an actual password manager, for the record), misremembering, or saying loud enough for someone else to hear it.

While we already were in possession of perfectly good voice recording buttons, those used speakers. The stakes were apparently too high! Therefore, the time and monetary investment were justified to meet the spec.

Secure Storage

We know this one right? In the real world, the regs (standard / law /whatever) demand encryption! Oh, good ,the cloud provider encrypts the hard drives! Box checked ☑️. However, from a practical stand point we know that we still will likely want some level of database or app encryption so the data is decrypted when needed versus when the drive is powered off. What we typically need is a layered approach.

Now, luckily, my son did not ask me to integrate a fingerprint sensor into this contraption (come to think of it, I could have just used an old phone to accomplish that, and probably the base requirements…), but there were still several layers of secure storage in his design. First, the paper plate password manager would only be stored in a secure location; and within that secure location, the specifics were only to be known by a single grandparent (luckily, the concept of redundancy and backup did not come into play; I don’t like Amazon and soldering that much). Thus, the password manager access was minimized, and the password itself was stored on its own device. We could also increase the attacker’s cost by removing the batteries, cutting a wire, etc. While not impossible to overcome, never forget that all attacks need to balance their cost-benefit and focus on ROI.

Risk Assessment

The part that I am most proud of in this story is my son’s thoughtful consideration of the many factors and requirements. It was not just a matter of “buy security product”, but a matter of considering the various risks, possible controls and costs (money, but mostly time), usability, users and threat actors, etc.

All this to say, remember to ask my favorite Project Manager question: “What problem are we trying to solve?”. It becomes very easy to take those initial requirements and go down a rabbit hole, or to become interested in something shiny, but probably not important.

For example, say you were looking for a password manager/vault solution for personal or corporate needs. Well, it’s clear that it should store passwords and probably offer encryption, but if you don’t want to migrate in six to twelve months, you better document and check your requirements: Does it require a browser extension? Are there cloud-backups? Can admins take over the account upon termination and access the passwords? Password sharing? SSO, MFA, [insert another acronym]? And those are just basic technical requirements, you must consider organizational policies, the end users (I set my mother-in-law up with a password manager years ago, it is not what I use as a more technical person, but it is the best fit for her needs).

As of the time of writing, my son wants to be a Volcanologist (like exploding mountains, not Vulcanologist, like Star Trek), but he may yet have a promising career in the cyber security field. I heard there are now billions of unfilled cybersecurity roles 🙄. Even if he doesn’t, I am proud that he is thinking critically and deeply, is optimistic and inventive, and inspires others to explore and challenge themselves.

If you have kids, I encourage you to start setting the foundation for thinking about security and safety. Here are some discussion topics you can try with your own kids:

Fire Safety

Make a fire safety and evacuation plan with your kids.

• Ask questions like: How can we put out fires? How does a fire extinguisher work? Should we have one near the kitchen (Hint: Yes!). Should we close our doors at night? What if the fire blocks us from getting to you room?
• Make a plan together: Draw a map and let your kids help and decorate. Draw lines for various scenarios. Explain that life is precious, things can be replaced.
• What does a firefighter do?: Talk about firefighters, firetrucks, etc. ENJOY the wormhole of searching for “firetruck tour” or similar on YouTube

Protecting Something Important

Perhaps not a password, but maybe a favorite toy; or something less sentimental that goes back and forth to school like a water bottle.

• How can you track and inventory this important thing? Do you store in a special location? If hidden, how do you remember where so it doesn’t get lost? What is your standard operating procedure to ensure it always gets back to the designated special location.
• How do you protect this thing? Does this mean keeping it in your locker, cubby, or backpack? Do you only take it out under certain situations (put it away before the cousins come!). Do you have a name sticker on it in case it’s accidentally taken home by another kid?
• Discuss the various scenarios and people involved. Who can help protect it? Who or what might be a threat? What processes and practices need to be implemented to ensure we meet these objectives.

Street Smart / Smart Shopping — From A to B

This exercise can help your kids plan strategically and anticipate risks. There are two ways to go about this, depending upon the walkability of your neighborhood.

If you live in a walkable area…

Find a paper map, use an online map, or draw a simplified neighborhood map. Mark out some nearby shops, parks, or other landmarks with your kids.

• Talk about various different routes you could take and the tradeoffs. For example, maybe there is a longer route that avoids that big, loud, scary dog!
• Discuss being prepared for the unexpected: What if the street or sidewalk is closed down, what are alternate routes you would need to take.
• Talk about emergency preparedness, how can you find out about weather or other things before you go out; when is it safe to go out, how far can you go on your own
• Discuss different modes of transportation and the various trade-offs — no sidewalk over here, too bump for a scooter with hard plastic wheels
• Talk about important landmarks, houses of trusted neighbors and friends

If you live in a more remote area or someplace hard to walk…

We can adapt the above to focus on visiting stores and supermarkets.

• How do we stay safe in the parking lots? What actions can we take to be safe, such as holding a hand, not running, etc. Talk about expectations and limitations of others (Your too small to be seen in front of a big SUV)
• Where are the high risk areas, and why? (e.g., between parking lot and entrance)
• Once inside the store, talk about the map/layout, and establish certain locations by name for reference (even if not the official names)
• Talk about how you can avoid being separated, where to go if separated, and how to find an adult you can trust to help reconnect you.

In either scenario, these types of questions can help keep your kids safe and help you understand how they will approach certain problems before they become big issues. Establishing baseline knowledge helps to reduce a lot of risk. In addition, talking about possible future decisions ahead of time reduces the stress of figuring things out in an emergency. Thinking about alternatives and decision inputs helps you think critically and teaches kids to explore and keep their eyes open.

For more street smart tips, check out:

Enjoyed this post? If you had a good laugh or learned something new, don’t forget to follow and (as the kids say now) smash that clap 👏button 50x 🙌 🙌 🙌.

You may also like some of my other lighthearted post about security. Check these out:

Or about my family: