2/24/06 Questions about storing and managing passwords

Highly recommend RoboForm as a password manager. To submit this reply I had to enter a master password to enter RoboForm and then just clicked on a saved login entry that was encrypted by RoboForm when I first saved the CNET login email and password entries.

I guess it a boils down to the convenience of a program like Roboform versus using your memory to remember usernames and/or passwords.

The advantage of Roboform is that it saves both along with the URL in what they call passcards. All you have to do is click "Login", find the name of the site you want to go to, click on that and you're in. This information is all saved on your PC. Even if you have more than one user on the same computer in your house, they can't get to this stored infromation because it is password protected.

The disadvantage is how the technical world of today has made us all a bit lazy. For example, when someone can't find the remote control to the television they will spend 15 minutes looking around and trying to find it. When the most simple resolution would be to remember that there are buttons on the front of the television itself to change channels also.

The same applies to a program like Roboform. It's great as long as you're using the PC you have the software on. The problem is, what if you lose that information or you're at a friend's house and can't log into a site you have access to because you don't remember the username and password. Roboform has been doing the work for you all this time.

Again, technically the brain isn't a muscle. Theoretically, it is. If you don't exercise it, it's not going to become strong. Just like going to that fastfood place that has nothing but computerized cash registers and most of the employees have used nothing but that type. So if my total is $6 and I hand them $10, and then pull out another $1 and hand that to them so they can save some one dollar bills and simply hand me back a five dollar bill, they will looked at me all confused and say, "I'm sorry sir, I already entered the amount you gave me." Makes me chuckle sarcatically everytime.

Another advantage of Roboform is that it's encrypted. Computer encryption is based on the science of cryptography, which has been used throughout history. Before the digital age, the biggest users of cryptography were governments, particularly for military purposes. The existence of coded messages has been verified as far back as the Roman Empire. But most forms of cryptography in use these days rely on computers, simply because a human-based code is too easy for a computer to crack. Anyway, that can be saved for another discussion.

The choice is yours. Use Roboform if you're going to be using the same PC all the time. It will do the work for you. In my opinion, you should learn to remember them yourself. Write them down on a piece of paper that no one can find but you. Soon you will know all the information by memory. The only disadvantage to that might be good for another discusssion. "Keylogger viruses."

Good post, MikeSC. Another option is to use Roboform's Pass2Go (I think it's called). It's a version of Roboform you can install on any USB portable drive - then you have your passwords with you anywhere you go, although it won't help with your memory.

I guess if I'm going to compliment someone, I should get their name right...

Handy Password is not bad especially installed to USB key and I can login from any PC without Administrator?s rights
Site: http://www.handypassword.com/

I agree completely about the non-portability of password management software. In fact, I do have my most frequently used log-in info memorized - both personal and work-related.

It's just all those PWs I don't use very much (or just don't need to add to my allready taxed brain) that I list hints for on 3X5 cards.

The cards also serve as places to add other info as well including the page links at the site to get to where I usually want to go. There's no end to the site-specific navigation variations. One big help is the phone number with the exact voice mail options to get to the exact dept I need.

Possibly some of the PW apps mentioned in this thread allow for those things as well. But I bet I could beat most people in a card versus program use challenge.

Use a system to generate the password from the website name.
A simple example might be - type the name of the website backwards and add your date of birth on the end.
The system is very easy to remember and gives you a unique password every time, but no need to remember the password.
For security.... never tell anyone your system.

'Nough said.

I am getting messages from you. I fixed the above. Please do not send me any more messages about the above

I guess it a boils down to the convenience of a program like Roboform versus using your memory to remember usernames and/or passwords.

The advantage of Roboform is that it saves both along with the URL in what they call passcards. All you have to do is click ''Login'', find the name of the site you want to go to, click on that and you're in. This information is all saved on your PC. Even if you have more than one user on the same computer in your house, they can't get to this stored infromation because it is password protected.

The disadvantage is how the technical world of today has made us all a bit lazy. For example, when someone can't find the remote control to the television they will spend 15 minutes looking around and trying to find it. When the most simple resolution would be to remember that there are buttons on the front of the television itself to change channels also.

The same applies to a program like Roboform. It's great as long as you're using the PC you have the software on. The problem is, what if you lose that information or you're at a friend's house and can't log into a site you have access to because you don't remember the username and password. Roboform has been doing the work for you all this time.

Again, technically the brain isn't a muscle. Theoretically, it is. If you don't exercise it, it's not going to become strong. Just like going to that fastfood place that has nothing but computerized cash registers and most of the employees have used nothing but that type. So if my total is $6 and I hand them $10, and then pull out another $1 and hand that to them so they can save some one dollar bills and simply hand me back a five dollar bill, they will looked at me all confused and say, ''I'm sorry sir, I already entered the amount you gave me.'' Makes me chuckle sarcatically everytime.

Another advantage of Roboform is that it's encrypted. Computer encryption is based on the science of cryptography, which has been used throughout history. Before the digital age, the biggest users of cryptography were governments, particularly for military purposes. The existence of coded messages has been verified as far back as the Roman Empire. But most forms of cryptography in use these days rely on computers, simply because a human-based code is too easy for a computer to crack. Anyway, that can be saved for another discussion.

The choice is yours. Use Roboform if you're going to be using the same PC all the time. It will do the work for you. In my opinion, you should learn to remember them yourself. Write them down on a piece of paper that no one can find but you. Soon you will know all the information by memory. The only disadvantage to that might be good for another discusssion. ''Keylogger viruses.''

Your statement about looking for the remote shouldn't say that people are too lazy to use the buttons on the front of the tv. They are getting much needed exercise while looking for the remote and lets face it if they are that worried about the remote, they need the exercies anyway.

I use Roboform as well. I realize you can password protect your entries, that is, make Roboform ask you for a master password before filling in a password field, but how do you keep the password from displaying when editing a passcard in Roboform?

I've tried the option to display the password as stars, but someone could easily toggle that option to redisplay the password.

I had the same problem with Roboform... I loved it overall until I left the browser window open for a few minutes. My 14 year old memorized my master password from Roboform and went back later to see what he could find. Fortunately he thought it funny to report to me that he knew all my passwords, rather than clean out my PayPal account or go to town on Ebay.
I wonder if the portable version mentioned on these boards that I could keep on my zip drive would address the lapse in security by leaving my desk for a minute... At least I rarely leave my zip drive sticking out!

When I access my bank, the first window that pops up doesn't have the little padlock on the bottom. They require you to put your social security number in and then (the bank?) saves it somehow.

The spot where you put your SS# says "use saved online ID."

I'm assuming from the answers I've read so far, this is saved somewhere on my bank's site and NOT accessible to others?

The real problem I have is the possibility of identity theft.

The question is: when I first enter that social security number (and subsequently as well, I suppose), can someone else access it not just the first time, but other times as well, since it was entered on a non-secure web page?

Thanks,
Katiebug

I'm really having trouble with this one. Your bank should probably have a different way to login other than your SSN.
I have been using Online banking from the beginning, and have never been asked for SSN online.
As for the padlock, I believe you have to enter sites into the Trusted Zone in Internet Options for that to show.

What i do when i enter my info into my bank account i add a ''S'' right after http and hit go and then i get the padlock and then i enter my information,try it, it works for me.I do this with I.E

1) The padlock in the status bar means your browser is talking with the bank server in SSL, which encrypts the traffic in between, so even if somebody was able to intercept the traffic, they won't be able to understand it.

2) "Use saved ID", as I've explained, likely uses a special cookie with a number that is only assigned to you, and the bank will read that number back and figure out that it's you. Only the bank would know what that number/marker actually means. I seriously doubt they actually save your SSN as the marker. It's not that hard to check, actually.

If you use Internet Explorer on WinXP, the cookies are stored in

C:\Documents and Settings\(your username)\cookies

Substitute (your username) with your actual username.

See if you see your bank's cookie there, and open it in Notepad... You'll get some gobblygook (basically a VERY long number).

But try to remember the nuimbers they give you, it's by far the best way of combatting identity theft.

I have two concerns with the online banking that you have described. First, the lack of a padlock indicates that you are not secure. One respondent mentioned adding an s to http which would manually take you to an SSL secured site (if available), but that should not be required. Second, the use of a social security number as an identifier is an unacceptable risk, whether online, over the phone or in person.

I strongly recommend exchanging sensitive information only via SSL secured sites as indicated by the https instead of http and the padlock in the lower left. I also recommend questioning every request for your social security number. Many businesses are getting the message and providing an alternative to using your full social security number.

Regarding both concerns, you should not blindly trust the technology you use everyday. The same people that you entrust with your sensitive information brought you Y2K.

There is one other thing to be aware of about the issue of not seeing the secure padlock icon on the login page. It is generally true that if you don't see the icon then it is an indication that the site is not secure and your userid and password is sent in cleartext across the internet.

However, it is also possible to make the target of the login form on the web page point to a secure page from an insecure page. In that case, the originating page was not secured, but when you click the "Login" button the form is submitted to "https://..." (notice the "s" for secure) which would make the browser first request a secured connection BEFORE submitting your userid and password.

The problem comes in not knowing if this is the case or not for any given site. Browsers do not currently have any indication that a form on an insecure page will be submitted to a secure page. The only way to tell that I know of is to look at the HTML source of the site and find the "Login" form. If the ACTION is set to "https://...", then the form will post to a secure site and your userid and password should be safe to submit. e.g. on Bank of America's website home page, which is http://www.bankofamerica.com - not secured, the form is:

<form name="frmSignIn" action="https://onlineid.bankofamerica.com/cgi-bin/sso.login.controller?noscript=true"

The action of the SignIn form points to a secured page, so even though the current page is not secure (meaning that the contents of the home page were sent without encryption - not a big deal since there's no personally identifying information on the home page - the form's contents will be sent encrypted back to the Bank's website).

Hope this helps clear it up.

this must be a problem in the US. I live in Canada where it became illegal for any company to use an SIN (our equivalent to the SSN), as a record key. We are also advised stronly never to give out our SIN to anyone except a government request such as for tax or passport reasons.

I found interesting every single post here. So I'll let my suggestion too. Better than saving or storing a password, is to consider how you create it. I share Dotan C Idea, in fact I usually use two words and 4 or 5 numbers to create my password, one more thing, I try to do so in a foreing but yet comprehensible language. I.E. I'm Spanish Speaker, but I can speak and understand english, too. So I always think about something in english, then add another object to that something and a number I can remember, so my password could be a "bird", then I think of "ice", and then the 4 last numbers of my mother's ID number, with that i create sort of a subject and an adjective: frozenbird1200. Is just an example, so hackers, don't think of it as a REAL password =p! Now I have my password I save it in my mobilephone's wallet, far away from my computer. That way I can have a save, easy to remember password, and I can carry it always with me =D. Of course, as Gary said, the risk is now of getting my phone lost or something. So I alway back my passwords up in a little notepad back home. And that's what I do =D.

I have used Keychain to store all of my passwords for about 15 years with not trouble of hackers. I back up the file to a remote server so I have them all if I need to reinstall any of them or I forget what my login info was.
For more info about how cool and easy this interface is:
http://www.apple.com/macosx/features/security/

A simular product by Siber Systems http://www.roboform.com/

I have software that can crack or delete any
passwd. I do it all the time for users who
move to different computers, or users who have
simply forgotten their passwds. The original
intent of passwds was personal privacy. That is
long gone in the workplace, or on the net. Every
company is now snooping its employees, using
excuses like, "We own these computers." Passwds
are old Unix hack, and suggesting that they
provide any level of protection from a determined
criminal .. or boss .. is just naive. There are
much better ways, and they will gather "evidence"
that will warn you .. and that is real protection.
Here's a brief list:
Disk Imaging .. keep that computer plain vanilla.
Hibernate .. turn it off after 30 minutes.
Levels of filtering and firewalls .. on everything.
Proxy on Browser .. supported by remote company.
Personal Laptop .. with data transfer USB cable
.. that shares in and shuts down.
Thumb drives, USB drives .. keep your personal stuff.
Remote accounts .. have a valid remote account, and
enable it locally. Run Postini
on the remote account.
Passwds .. will keep your mother off

I've tried dedicated password storage tools, but frankly I've found a simple solution to be the best: I keep my sensitive passwords in a plain vanilla text file, then I zip and encrypt it using Winzip. Whenever I can't remember a password I just open the file and look it up. Other password programs eat up memory, slow down startup, or interfere with browsing by popping up at annoying times.

I also use a zipped/passworded text file, its about the easiest way. You already have the text editor in Notepad, and most people will have Winzip or some other archiving tool capable of creating a passworded archive (or should).

In the text file I sometimes group similiar usernames & passwords, such as dicussion forum logins, but I mostly just pile 'em in there. I format a line:
|domain/forum name|<tab>|user name|<tab>|password|<return>

That way they line up nicely. Since they aren't in any particular order I usually do a Find <ctrl-F> and search on the domain or forum name to find the right entry. Simple.

I also have a shortcut to the zipped file in my tooltray, this is the fastest way to access it. One click on the shortcut, doubleclick on the text file name in Winzip, enter archive password, and Notepad appears with the password file displayed. No headaches. And a paper copy is just a copule clicks away if I want one.

Of course if you have Excel or some other spreadsheet you could use that instead of a text file, but Notepad is about the fastest application with the smallest footprint you could use.

The link in the QuickLaunch tray is a nice idea. I put my passwords in alphabetical order in the file by website, that way I can find them easily.