Occasionally, you need to share a password with someone. Maybe it's a shared office-wide password, your family's Amazon login, or maybe you just want to share a Netflix account with your roommate. Rather than sharing it over email, you can more seamlessly and securely share passwords in just a few clicks with LastPass—and even prevent the person on the receiving end from ever seeing the password itself.

Obviously, both you and your friend need to be using LastPass to share passwords via LastPass, but as we've talked about many times before, it's just about the easiest, most secure way to deal with passwords on the internet (so if you aren't using it, you probably should be). Assuming you both have accounts, it only takes a few seconds to share a password with someone. Here's how it works:

1. Open up your LastPass vault by clicking the LastPass button in your browser and choosing "My LastPass Vault". If you aren't on a computer with LastPass installed (but you have a LastPass account), you can access your online vault instead.
2. Find the site who's password you want to share, and click the "Share" link on the right-hand side of the row.
3. Type your friend's email address in the box at the top of the Share window. You should use the email address that they use to log into LastPass. You can choose to "share" the password with them, which lets them log in but hides the actual password, or "give" them the password, which allows them to read the password and then use it outside of LastPass, if they prefer.
4. Once you share the password with them, they'll receive an email letting them know. They can then log into their LastPass vault to see it in a new folder called "Pending Shares". If they accept, they'll then be able to log into that site using LastPass as normal.

If the original user deletes the shared password, it'll also be removed from the sharee's vault. In addition, if the original user makes any changes to the password, he or she will have to manually re-share the password unless they are a LastPass Premium user, in which case they can check a box on the Share page to automatically push all changes to the sharees.

Note: While this is a great way to securely share passwords, it's important to note that the "share" feature—the one that lets you give someone access without seeing the password—isn't 100% secure. LastPass explains:

Savvy end users could potentially access the password if they capture it using advanced techniques during the login process, but LastPass will never be able to access this data because it has been encrypted using their public key. It is also possible to obtain shared passwords using another password manager. LastPass recommends that you ensure that you've used a generated password specific to this site you're sharing, and not sharing any passwords that you're uncomfortable with the recipient obtaining.

So, while it's a good way to keep the password mostly hidden, it's still not advisable to share a password with someone you don't trust, or for a site that contains particularly sensitive information (like your email). Still, for a lot of situations, this is just about the easiest way to share your password with someone without sending it over email or text message. Hit the link below to read more.

Sharing Passwords | LastPass User Manual

This week on the Ask Lifehacker podcast, we're learning how music affects your ability to work, getting great deals on mobile apps, and protecting your passwords on public Wi-Fi networks. Also, Facebook blows a billion dollars on Instagram, terms of service contracts are no longer the ironclad documents companies wanted them to be, and a whole lot more.

Sorry the episode is late this week. We had some issues getting it live yesterday, but here it is! We should be back on track for Mondays next week.

How to Watch or Listen to This Week's Episode

You can watch the episode by clicking the play button above, but there are plenty of other ways to get it:

• Directly download the video (MP4) or audio (MP3) version.
• Watch it on our YouTube Channel.
• Watch it on Revision3.
• Listen to it on SoundCloud.
• Subscribe to the HD, SD, or phone-sized, and audio-only feeds on iTunes.
• Subscribe to the HD, SD, phone-sized, or audio-only (MP3) RSS feed.

News and Discussion

This week we're talking about Facebook's acquisition of Instagram, Google+'s new layout, a few legal issues, and the return of Ze Frank.

01:01 Facebook Buys Instagram
Last week, Facebook acquired Instagram for $8 billion. If you're not familiar with Instagram, it's a social photography app that lets you take pictures with your iOS or Android device, apply vintage filters and frames, and share them online with just a few taps. It's the most popular app of its kind, but many people are upset about this acquisition because they're concerned that Facebook will ruin Instagram. While none of us are really worried, if you want to make the switch we've compiled some alternatives for iOS and Android.

05:37 Google+ New Look
Google+ updated with a new look, making it appear much like Facebook's timeline but with a lot more whitespace. Don't like the whitespace? Use the Whitespace Remover extension for both Chrome and Firefox.

08:21 Breaking Terms of Service
You know how you always read every terms of service contract in its entirety? Even the updates? Well, you're the only one. Everyone else pretty much skims them or ignores them entirely. For those of us who don't take the time to page through the enormous documents, there's good news! Breaking a terms of service contract is no longer a crime.

11:15 WTF Is CISPA?
Remember SOPA, the bill that wanted to censor the internet? Nobody liked it, but now we have CISPA and it's being backed by big companies like Microsoft and Facebook. It's not nearly as bad as SOPA, but it's still something to keep an eye on. Thorin runs down why companies are supporting it, if you'd like to learn more.

14:23 Ze Frank Is Back
Poignant and funny internet superstar Ze Frank is back with a new show. He was best known for his daily show called The Show with Ze Frank that frequently featured tips and thoughts with a Lifehacker-y angle. As a result we're happy he's back with A Show with Ze Frank. The first few episodes are up if you want to check them out.

Questions and Answers

Each week we answer five questions from readers and listeners. Here's what we tackled this week.

15:52 Should I get the latest and greatest computer or buy something cheaper?
Although Pash, Whitson, and I all have powerful self-built desktop computers, we also chose the MacBook Air as our laptop because it is fast enough. Whitson has his desktop for gaming purposes, I have mine for video editing/encoding, and Pash doesn't really use his anymore. For writing and browsing, the MacBook Air is more than sufficient. This is all to say that if you don't have a reason to get a powerful computer, you're better off saving money or going for something more compact. All computers are fast nowadays. Most people can do what they want to do on an iPad. Unless you know why you need a faster machine, don't spend extra money for speed. Either put that money towards things that'll matter more—like an SSD or more RAM—or keep that money in your pocket.

19:49 Is it safe to connect to unsecured public Wi-Fi?
No. There's a greater chance that you won't run into trouble, but that doesn't mean it won't suck if you do. Protecting yourself on public Wi-Fi is actually pretty simple. For the most part, you just have to use HTTPS when transferring sensitive information through the web browser (HTTPS Everywhere is a browser extension for Firefox and Chrome that makes this much easier) and make sure you're not providing unsecured network access to your computer. For added safety, set up Hamachi for secure browsing when you're on public networks.

23:49 What can I do about the tiny amount of internal storage (150MB) on my Android device?
Some Android phones just don't have a lot of internal storage and rely on the microSD card to do all the work. BUT, if you want to find out what's taking up space on your device you can just jump into your settings and go to the storage section. (The exact location of your storage info will depend on the version of Android you're using and, potentially, how your device's manufacturer has altered it.) If you find that your internal storage is filled with stuff you don't want or could put on your microSD card instead, you can always move it with pretty much any Android file browser app—including the one that likely came with your device.

26:31 How can I automatically convert videos I download with BitTorrent using Dropfolders and Handbrake?
If you're not familiar, Handbrake is a video conversion tool that takes virtually any input video and spits out an H.264 MP4 file. Dropfolders is a Windows application that watches for video files and automatically adds them to Handbrake to be converted. The person asking this question wants to automatically move videos downloaded by BitTorrent into a drop folder as soon as they complete so they'll be automatically converted to MP4 format by Handbrake. This can be done easily with an application called Belvedere. Mac users can do the same thing with Hazel.

29:06 Should I listen to music when studying/working and, if so, what music?
This often comes down to opinion and what works best for you. Most of us listen to music when working, and the type of music differs. Pash has a variety of tunes, Whitson listens to heavy metal and dubstep (which seems entirely counterintuitive but it works for him), and Thorin and I usually go for instrumental music/soundtracks during work because there are no lyrics, although that's only if I do listen to music in the first place. I tend to start dissecting the arrangements so I prefer silence. Basically, none of us are there same so you have to choose what works best for you.

But as for the science behind work/studying and music, it doesn't really help. There isn't any particular music that's going to actually help you concentrate or think better, but if certain songs get you excited and motivated you should definitely use those to get you started. That said, music can help you concentrate if you're in a noisy environment because it's blocking out the more distracting noise. So if you're working or studying in a coffee shop, for example, you'll want to bring a pair of headphones along. Overall, the best option is to use a white/brown/pink/etc. noise generator like the free one at SimplyNoise. That'll block out distractions best of all.

Downloads of the Week

Each week we talk about our favorite downloads. Here are our picks for this week.

WinPlusX (Windows)
If you're a Windows tweak addict, you probably use tools like the Registry, Computer Management, Disk Management, and Power Options often-apps that are extremely useful, but don't always have obvious or quick shortcuts in the Start Menu. WinPlusX puts them one keyboard shortcut away.

More info on WinPlusX

Flashback Tool
The Flashback Trojan infected a whole bunch of Mac users over the past few weeks. If you want to detect if you have it and remove it without much trouble, Flashback Tool will do the trick. Once you're free of Flashback (if you aren't already), be sure to install Apple's official Java update to patch the vulnerability.

More info on Flashback Tool

Morning Routine (Android)
People clearly have trouble getting up in the morning despite their alarm clock, which is why Morning Routine and other apps exist to make it difficult to actually turn off the alarm. Some require you to shake your device and others will shred money, but Morning Routine forces you to scan a barcode or two (on items in your pantry or refrigerator, for example). This requires you to concentrate enough to keep the camera steady and forces you to get out of bed—unless, of course, you start keeping cereal boxes on your nightstand.

More info on Morning Routine

Getting Great Deals on Apps
Apps are great, but they can get expensive if you keep buying every one that interests you. Last week Thorin looked at how you can watch for great deals so you're never paying full price for your apps. It probably won't save you a ton of money if you're looking to get a discount on cheap apps, but you can save a lot on pricey apps by knowing when to look for sales.

Using Your iPad as a Creative Tool
Last week, Thorin wrote a post on how the iPad can be used as a creative tool. He spoke with creative professionals, such as Jim Guthrie (who composed the music for the great game Sword and Sworcery EP) who've added it to their workflow. If you've wanted to make your iPad more of a content creation tool and less of a consumption device, definitely check out this post.

How Do I Submit a Question?

There are three ways to send in your question:

• Record a video, upload it somewhere, and send a link to tips+asklhshow@lifehacker.com
• Call (347) 687-8109 and record a question. Calls are awesome! We like them!
• Email your question to tips+asklhshow@lifehacker.com.

Please keep your questions as brief as possible. This means about 3-5 sentences for emails and 30-60 seconds for calls and videos. Your questions can be specific, but broader questions are generally better because they'll apply to more people. For example, "how can I breathe new life into my old PDA?" is much better than "what can I do with an old HP iPAQ 210?" Either way, we look forward to hearing from you!

This podcast was edited by Mike Vannelli.

Newspaper, Computer, and Clock (by Brandon Hopkins) provided by the Noun Project.

In general, you want to avoid writing down sensitive information and just keeping it in your head but that's not always an option. If you have to write down a password, or some other sensitive information, you can use a Caesar Cipher to quickly encode and decode that message on your own.

Caesar Ciphers are very simple methods of encryption because the work by shifting the alphabet over a few characters and matching up the letters (see the picture above)—in fact, if you've ever used any cypher as a kid, it was probably a Ceasar Cipher. This cipher turns a statement like "The quick brown fox jumps over the lazy dog" into this:

WKH TXLFN EURZQ IRA MXPSV RYHU WKH ODCB GRJ

The first letter is a W because it's three letters after T. K is three letters after H. H is three letters after E. Basically, you can easily decrypt that message by just rewinding the alphabet by three letters. It's easy to decrypt if you take some time to figure it out, but it's plenty to keep non-motivated people from spying on your stuff.

This is just one useful personal encryption method of many. For more, read this guide.

Caesar Cipher | Wikipedia via Reddit

We've discussed how using passphrases as passwords can boost your security, but if you've chosen a phrase used in every-day speech, you're not doing yourself—or your data—any favors. According to a new Cambridge study, a common phrase, like, say, "outofthepark," is only marginally more secure than a dictionary word, and anyone looking to crack your password already knows to try common phrases along with common words. If you prefer passphrases, here's how to make them more secure.

Why Common Passphrases Aren't As Secure As You Think

The reason that many password systems won't allow you to choose dictionary words as you passwords—or at least require you to add numbers, capitals, or special characters to those words—is because the first thing a hacker will do to try and guess a password is try every word in the dictionary to see if they can get in. Even swapping out "i" for "1" or "e" for "3" often isn't enough—the fact that those tricks have been around for as long as they have means that those common substitutions are easily added to your dictionary list and included with the brute force attack. The goal of encouraging passphrases instead is to create credentials that are entirely nonsensical to a password cracking utility, but memorable to the human who needs to access a given system every day. Photo by Francis Storr.

The trouble though is that so many people, when they embrace passphrases, use common phrases from books, popular movies, memorable quotes, sports teams, or other proper nouns that are easily guessed. A group of researchers from Cambridge University recently published a study (PDF link) where they found that using a dictionary of these common phrases allowed them to crack open about 8,000 passphrases in Amazon's old PayPhrase system. They conclude that passphrases as a password system ultimately provide less then 30 bits of security, which they note is too weak to withstand most online attacks. Ars Technica explains what this means in plain terms:

The "30 bits of security" means the chances of a single guess cracking a four-word passphrase would be one in 2^30. What's more, the two-word phrases cracked in the study provided just 2^20.8 (or 20,656/0.0113) bits of security. Another way of expressing the same finding is that a dictionary of slightly less than 21,000 phrases is enough to guess the login credentials that slightly more than 1 percent of people in the real world will use.

Admittedly, 1 percent of phrases is a very small number, but it's still cause for concern, and drives home the point: any security system, even if it's well built and sufficiently complex, can easily fall prey to user-introduced patterns. In the end, the user—and their password—is almost always the weakest link.

How to Improve Your Passphrases

This doesn't mean that all hope is lost for passphrases, or that you should give up on them and go back to standard strong passwords. Honestly, if you can combine the two, you should—the strength of a strong password with letters, numbers, varying case, and special characters is improved significantly when strung together as a phrase. The key is to pick a phrase that's easy for you to remember, but not, for example, your favorite sports team, or the name of your city and state strung together, or the make and model of your car. Yes, it diminishes the ease of memorization, but it vastly improves your security.

The study explicitly points out that "multi-word phrases, if chosen naively according to natural language tendencies, are not as effective at mitigated guessing attacks as alternate choices, such as choosing 2 random words or choosing a personal name at random." So, in order to boost your passphrase security, you need to pick words that matter to you, but don't matter to anyone else. For example, "NissanAltima" may not be a dictionary word, but it's a proper noun that's easily guessed. Instead, you might try "My03AltimaIsBlue."

When we discussed The XKCD passphrase generator, we pointed out another more secure method worth repeating. If you want to use your favorite lyric from a song, grab the first couple of characters from the words in your favorite line, instead of stringing the whole lyric together. We proposed that a Jackson 5 lover might extract a password from the lyrics "Oh baby give me one more chance to show you that I love you" and come up with "obgmomctsytily," which is significantly more secure.

The XKCD Password Generator itself is a robust tool to generate passwords, mostly because the words it strings together are random—they have no meaning behind them, and would be difficult to break in a dictionary attack, and even harder if you mix case and special characters. You could also take it up a notch and use the shift-to-right method for your passwords, which really makes them unintelligible.

Finally, once you've done all of this, and built a great passphrase that's difficult to crack and hard to break, do yourself a favor and plug it into a password management system like LastPass, KeePass, or 1Password, so you can use different strong passphrases for every service you use, and one memorable one to get into your password vault.

Title image by XKCD.