Hi, I have already thought of that method before but again, Winzip is easy to hack into. I have tried the brute force dictionary attack plus several other tools and got in within minutes.
I use Passcrypt because it use military strength encryption (448-bit), meaning that it will take a reaaallllly long time to hack into the database unless you have a Quantum CPU!
 | Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years. Thanks, CNET Support |
General discussion
2/24/06 Questions about storing and managing passwords
When logging in to a secure Web page, the browser will often have an option to save my password. Or the Web site will ask if I want to store my password. Are these the same? Where and how are these passwords saved? How secure is it to do this? Are the passwords stored in an encrypted format, and if so, can they be hacked? As a precaution, I never store passwords anywhere in electronic form. I don't trust password managers because there is no way to know what they are doing with the information. What is the safe way to manage passwords?
Submitted by: Gary H.
*******************************************************
Answer:
Well, Gary H., your question starts out simple, but goes quite a bit deeper into online security. Let's start with the difference between the browser's "remember my password" vs. a Web site's "keep me logged in" option.
Your browser actually saves your login name and password info, encrypted, on your hard drive, and fills the fields when you pull up that certain Web page again. However, how it saves it depends on the browser's actual implementation.
By contrast, the "remember my password" option on a website actually saves a special cookie (think of it as a marker) that's unique to you that when come back to the website, it shows that you're user so-and-so and logs you in. That cookie likely will NOT actually contain any password info for any one to unscramble, but rather is just something the website itself understands, but, again it depends on actual implementation. It's probably similar to your local supermarket handing you a membership card. By loading that number, they know it was you using the card, since no one else has that number. The website's "remember my login" would probably work along similar lines.
Neither is technically "secure" since any one who can physically access your computer (i.e. sit down at your table) can get into those websites, either way. Assuming your home is reasonable safe from intruders, that leaves external hack attempts.
The best defense against external hack attempts is a hardware firewall, and regular security updates for your operating system, probably WinXP.
Windows is already setup to warn you and/or to apply the updates automatically so all that remains is a hardware firewall, esp. if you are on broadband connection to the Internet. If the hackers can't reach your PC, they can't hack it. You can of course, not connect the PC to the outside at all, but that would be rather drastic.
On the other hand, is there anything on those websites that you really need to protect from hackers? Or, if you are more worried about the stuff on your PC, why? Hacking individual people's PC's consumes time, with very little chance of payback for the hackers. Think of it this way... let's say they are after... Credit card numbers. How many credit cards is one likely to own? Maybe 2 or 5. Would their numbers be stored on the PC? If so where? It's impossible to say. It could be in Word documents, Excel spreadsheets, Quicken, MS Money... etc. Choices are endless, and searching through it all would be time consuming. Hackers would be far more likely to get lucky with Phishing or Pharming scams, most of that can be automated and takes almost no time at all on the part of the scammer. It's easier to ask you for the password than to dig it out of you (or your PC), so to speak.
As for trustworthiness of password managers... I personally use one. I have no qualms about using one. Your firewall should automatically block traffic from unauthorized programs, which is how you know which program is not doing what it?s supposed to. However, it is quite difficult to "prove" security. In a way, it's like defending against terrorists. We have to be 100% effective, they just have to be 0.0001% effective...
If you are so worried, get a cheap PDA and put your passwords on those, and keep the PDA with you at all times. But then you have to worry about the PDA getting lost and all that...
The entire idea of security is balancing risk vs. convenience. Password managers increase convenience, but also increase risk by offering a central location to lose ALL of the passwords at once. Firewalls decrease the risk of external hacks, but also decrease convenience by requiring various config of port forwarding and such. It is all about trade-offs, and what is acceptable to me may not be acceptable to you. Ultimately, you will have to decide if the risk of using a password manager outweighs the convenience of having one and having it remember stuff for you.
Submitted by: Kasey C. of San Francisco, CA
Discussion is locked
31 - 60 of 102 Posts
- Collapse
- Collapse -
- Collapse -
I use a freebie program called Whisper 32 which produces an encrypted file that can be stored on a floppy disk. I have used it for years and find it useful because you can store the answers to the multiple questions (quite reasonably) asked nowadays to get onto secure websites. Where you store the floppy is your personal choice.
- Collapse -
And it's free and all that.
- Collapse -
I am terrible with numbers and passwords so I use a Timex Data Link. That way the information is always on me and it is also password protected in case it is lost or stolen. The Timex also syc's with my computer using Outlook and enters my contacts in the watch. Love it.
- Collapse -
The e-token is a usb disk on key that is an encripted password key - simple, safe, generates passwords saves them organizes etc. realtive cheap - got mine as a freebie at a computer convention - I know that this may sound like a commercial but this is truly a safe and trustworthy product..
- Collapse -
I use Mozilla FireFox to store my passwords as you can have them all stored and encrypted but they are only accessible using a master password. When you set up the master password, FireFox even gives you a scale to show how secure your chosen password will be. Even viewing the saved passwords requires you to enter the master password, so as long as I remember to either log off of my computer, or close FireFox, after having entered my master password, nobody else can use my saved passwords! That is unless somebody finds a way to hack into the FireFox password management system!!
- Collapse -
I have over 135 passworded logins. I save the website name, username, and passwords in an excel workbook with 31 day sheet for bills and alphabetical sheets for all the rest. I save the workbook to a removeable disk and print copies after each update and shred the old ones. I don't want any password information saved on my computers or on the network.
- Collapse -
Now for me I keep passwords to mathematical simplicity - I have only one!.
Why! well if your 68 y.o. it's likely you're down to two working brain cells, which probably means that what you found out at 8 o'clock you've forgotten at 5 mins. past (more than one password!! I'd need a brain transplant.
What I do as a consequence of this memory deficiency is to use virus and anti-spyware overkill. I have as my main security Symantec/Norton 2005 and 4 # purchased antiSpyware downloaded programs and one on-line scanner.
Additionally I only go to trusted and large Company URL's thus, I believe, strickly limiting Internet intrusion.
I know I'm tempting fate here, but I seem to be avoiding problems - so long as I regularly update my protection features.
- Collapse -
the other alternative is to disconnect your computer from the internet.
How can you be sure that big company sites are not compromising your computer?
I wouldn't trust Microsoft with anything so why would I trust their sites? Maybe nobody's compromised them, but that's not to say they haven't compromised themselves.
Yes, by only using sites of big trusted companies, you've reduced your risk, but you haven't removed it.
- Collapse -
I use a password reminder system that is really secure I think. My actual password is never recorded in toto anywhere except my head, but I have reminders in several places. Even on my computer.
I only use a computer in one place, my den at home. I also use only three passwords for everything and rank them according to how sensitive the information might be. One is a "throw-away" password I use in places where I don't much care if anyone else might find out what it is. The next is for places/things where it could be detrimental if discovered but not financially damaging. The third is one I only use in critical (financial) situations. I choose the actual passwords by selecting something I can see from where I sit at my computer. An example of this selection might be:
I always have a calendar in my den. The calender is always from "First Federal Bank". I select "Federal" as the password and then add 2 or 3 numbers to it. The calendar then becomes my "reminder" when I need to use the pw. Also I will rename web shortcuts to include *part* of the password but not all. In the this case, I would rename the desktop shortcut or browser bookmark for let's say... Discover card to "Discover f....33"
(if my password for Discover card was "federal33"). Thus, I always have a reminder within sight of my computer chair and also on my computer. BTW.. "federal33" is not one of my passwords, so don't EVEN think about it.
I am the only user for this computer, so that does enter into my thinking on this.
- Collapse -
I'm one who's convinced that any password is crackable given enough time, resources, and determination. However, I like this suggestion I read a long time ago, and it has served me well. It even allows me to give the password to someone and they will be unable to remember it in 99% of cases.
Pick a word or phrase that is meaningful to you and easy to remember. As an example, let's use "community".
Now transpose each letter on the keyboard, say up one and to the left. So (and look at your keyboards now) "community" becomes "d9jj7j856". It's not going to prevent a truly determined entity from gaining access, but it's a little trick that will make your password much more opaque to others, especially if you choose a word or phrase that isn't readily obvious to someone who knows anything about you.
As for storing them, I favor password protected files, ideally stored off the PC in removable media such as a disk, flash drive, or PDA. Pieces of paper are much more likely to be scarfed up or lost by someone.
And you're asking for trouble if you run withour a software and hardware firewall; antispam and antivirus software; and fail to purge your browser history after every session.
From someone who learned the hard way.
- Collapse -
I have different passwords for different groups of sites. Depending on the sensitivity of the information I enter at the site, I may use a lame password (to get to some free info site that requires you register and login) or up to a very complex, mixed case, alphanumeric password with more than 8 characters. There is no way I can remember them all. I used to keep a cheat sheet in my wallet (right along with my credit cards, drivers license and other written info that shouldn't be lost.)
Now, I use Password Safe, which is a free utility that is available from Bruce Schneier. http://www.schneier.com/passsafe.html
This program provides a secure place to store all my passwords, it has a function to generate a random password for me to use when I register at a new site, and it has a function to copy the password to the Windows clipboard so I can paste it into a login field. The whole thing is protected with a pass phrase, and the data is encrypted. Since Mr. Schneier is a noted authority on cryptography, I trust that the crypto is implemented correctly.
The two risk areas with using this application are: the passphrase used to open the application and database might be guessed (is someone gets my computer), so I use a 15 character, mixed case alpha-numeric phrase; a trojan or other malware on my computer could capture either my keystrokes opening the application or capture one of my passwords while it is in memory in the clipboard (so I keep my A/V software updated regularly.) Overall I am satisfied with this level of risk.
- Collapse -
KeePass is another rather good free open-source password manager: http://keepass.sourceforge.net/
- Collapse -
I don't store the passwords either on my computer or via the website for websites where money can be spent. Mostly because I have teenagers in the house and because in the past a not-so-tech-savvy visitor bid on some auction items online mistakenly assuming they were using their own account. Doh. I use the internet a lot for research and news, so those passwords I will store.
The passwords range from passwords I don't care about which would be six characters and easy to remember to maximum security passwords of 14 or more characters. Also, depending on my opinion of the security needed for the account, when I'm recording the password info I may list the whole password or I may use hints/reminders instead of actually recording the password. So the hint may look something like this:
give favorite tv evenly divided integer sequence aunt's maiden exponetial alphabet
In the hints, some of the words actually refer to numbers and some of the words that seem to be referring to numbers refer to alphas, etc.
I store the passwords on flash media. This media doesn't travel - stays in the same place always until needed. When I need a password, I pop the media in a slot and copy/paste. Of course I also keep a hard copy printout and another external digital backup of the data. I also use the same media system for licenses/activations of software I've downloaded and related emails.
When travelling, I used to rely on the password retrieval systems from the websites when I couldn't remember a password. But I think it's time to invest in some security enabled flash media.
PS. The above example of a password hint is completely fabricated and has nothing to do with passwords I actually use.
- Collapse -
Hi all,
Interesting discussion here 
My vote is:
I am using USB stick to login into Windows and access to my encrypted files. Works fine for a years.
Here's a guide:
http://www.rohos.com/configuring_usb_stick_logon.htm
and small video clip:
http://www.rohos.com/demo/open_disk_by_usb.htm
Have a nice security!
- Collapse -
Another great tool with a nice interface for protecting all your passwords with one master password is a shareware program called Access Manager.
http://www.accessmanager.co.uk
- Collapse -
I believe using Roboform is a great advantage for people who have alot of passwords and have memory lapse as I seem to have
- Collapse -
I have used Roboform for many years which encrypts your passwords. You only have to remember one password to get into Roboform. Sure your passwords are all in one place, on the pc but you can back up Roboform's contents to a floppy or usb key etc. incase of computer failure and you just need to restore from your floppy etc. Just remember to back up regularly.
- Collapse -
Just want to concur with the other posters that suggest Roboform. It's a perfect example of a value priced software product with premium functionality.
It handles passwords and is also an excellent form filler. It's secure, portable with a USB key, can be used as a direct shortcut to automatically login to a lot of sites, the price is more than fair, updates are free and it just works great. I have 141 passwords in the system and it's fast and literally never has software hickups. I use it in conjunction with the macro program Macro Express to automate interactions our company has with the FDA website and couldn't have been more pleased. Can't say enough great things.
- Collapse -
I use a biometrics authentication card (a fingerprint reader) from APC. It uses a OmniPass to remember all my passwords. You can use it at different levels of security as your needs desire. It allows you a couple of options: 1. Once you log onto your pc you can have unlimited access to your passwords. You can also set it to automatically hit "enter" or "login" or whatever and it inputs your passwords, and logs in you, no human intereference needed. Option 2. You can require fingerprint authentication for every password it inputs. This means every time you come to a site you would swipe your finger and it then would input your password. This is somewhat more secure as it requires you to physically swipe your finger at each website login, not just at the computer logon.
3. You can also take more darastic measures like "force authentication" by requiring a finger print read on all windows logons and or website logins. This is an option, because if not enabled (which it's not by default) you can still manually enter a password and gain access. If you set this on it requires you to swipe your finger to gain access. You cannot type in a password. The caveat to this is if the device would be stolen or otherwise malfunction you wouldn't be able to gain access to your stuff.
The program also has a section to encrypt your hard drive.
The device is avaliable in a USB pod, a usb mouse with the device built-in, or a much pricier card for a PCMCIA slot on a laptop (which is what I use).
It works pretty well with most sites. I have found a few that because of the ambiguities of the site design it doesn't work well with, but very very few, maybe 2 out of the 50 or so sites I have accounts on. Also when I boot my computer I have to remove and reinsert the card for it to work. I don't know if this is just my pc or if its the card or drivers. I have the latest versions. This is not a major problem with me because I rarely reboot my system. It works fine coming out of standby and hibernation, which is what I mostly use.
It does support multiple users. The right account is pulled up based on logon authentication.
I'm sure there are several other similiar products from simliar companies, I just chose this device because I needed something slick I could use with my laptop because I'm on the go.
http://www.apc.com/resource/include/techspec_index.cfm?base_sku=BIOCB40 - pc card retail $150
http://www.apc.com/resource/include/techspec_index.cfm?base_sku=BIOM34 - mouse retail $60
http://www.apc.com/resource/include/techspec_index.cfm?base_sku=BIOPOD - usb pod retail $50
- Collapse -
Honestly if you are just the average person with a couple of bank accounts that you access online then it's relly not a big deal. I work in the Fraud department for my job and really there is nothing that can't be fixed if your identity is ever stolen or someone accesses your info. Most Bank's have a fraud protection dept. that you can easily get credited for unauthorized purchases. I use a microsoft fingerprint reader and i find that very handy. I still know all of my passwords just incase it breaks down. However, Like the first person who replied to this question said. It takes too much time for a hacker to get info off of your computer. They would rather get your info from a phishing scam or something similar. They can hack a credit card company's entire database and get thousands of customer's info that way. Also they can buy valid card # from fraudulent websites. There are many easier ways to get that info than hack someone individual account or computer. Unless you are in charge of someone else's information then don't sweat the small stuff. Do what fairly convenient for you.
- Collapse -
I need to be able to take my passwords with me when I travel so I keep my printed on index cards, which I update by pencilling in changes. I update the file and reprint the cards periodically (maybe once or twice a year. On the card, if possible I don't list the actual password but something to remind me what it is.
Of course I keep the cards secure when at home and in my purse when travelling.
- Collapse -
I have a terrible memory and do not like to use the same passwords for different sites. Most of my passwords are variations on one or two "themes" that I use.
I use Norton's Password Manager mainly because it came with Systemworks a few years back (now it is a stand alone). It works fine with me here at home. It has a separate profile for every desktop so you have to first get onto my desktop (which is pw protected), then get administrative priledges through a time management program I use for limiting my children's time online called Enuff, then they have to sign into Password Manager. If they can do that (then God bless em' I won't have to worry about paying for college), then they can get access to my passwords.
I think that I am fairly well protected but I still change the passwords every 3 months or so and agree with the person who said to use at least 8 characters and mix them with numbers, symbols, upper and lowercase letters, and no real words (at least English words).
Password manager also stores my credit card information and the one thing that I like about it is that is allows you to drag and drop the numbers into the boxes online. This way, if anyone has enough time on their hands to be tracking my keystrokes without me knowing about it, they don't get the card numbers. As another person said, on websites that I trust and have a lot of business with, I will let them store my credit card numbers.....but only a few (Amazon is one for me too).
I have had a card hacked 2 times in the 10 years or so I have been doing all my banking and a lot of my shopping over the net. I check every card EVERY day and make sure all the charges are legit. When I see something that I (or my wife) don't recognize, I call the credit card company and they take care of thing. I remember one time about 5 years ago, the card company cancelled my card because someone had gotten ahold of it and was charging to all kinds of porno sites. Their security department (then Bank One, now Chase....need to give them a thumbs up!)tracks your purchases (and let's not get into a discussion about big brother and all that...I have nothing to hide!) and when they say all these charges (I think they cancelled after 5) they cancelled the card and called me. Another time I was making a lot of purchases from the same website and they called me that day and asked me if they were legit charges. I told them they were and that was that. The last time a card number was stolen was about 3 months ago. This guy/gal was sneaky, making small, infrequent, charges but by checking every day, I caught it immediately and had to change account numbers.
I think that my instances of theft were done by small companies that I may have ordered something from. I have no clue as to whether they were caught or not.
This is long so finally, I have a word processing file where I keep some important passwords (like how to log onto my desktop and the one for password manager) but I use my own code. I can get to them from my wife's desktop if I forget mine and hers is easy and there is nothing stored in password manager under her account. She would have no clue how to buy something over the net anyway.
I do have Norton Internet Security also so I have a good (IMO) firewall up and running all the time and I need it for parental controls (the computer is in our family room where we all spend out time but you never know with a 15 and a 9 year old!!!). I noticed that Norton must be changing the way they monitor because the other day I got a warning while working online (I have cable so I am always online) about a possible threat. Now I know they warn when there are other computers trying to access yours but this was a virus warning (and I get definitions sent to me sometimes 4 times a day) which never occurred before. It wanted to scan immediately and I let it. It found what it was looking for and destroyed it. I see a lot of bad mouthing about Norton products but they have been good to me for many, many years but that is another story.
I didn't plan on writing this much but I hope it helps some of you. I am disabled and on a lot of pain meds so my memory is effected and I need my own system to remember all those passwords and such. One last thing, remember, if you are using a site like Yahoo for forums or whatever, you don't need to be as worried about your passwors and usernames and with a site such as Vanguard (although the great thing about them is that even if someone gets my passwords and cleans out my account, they will only transfer money to my bank account or send a check only to my address).
Take care and again, I hope some of this helps,
Mike
- Collapse -
I have a terrible memory and do not like to use the same passwords for different sites. Most of my passwords are variations on one or two "themes" that I use.
I use Norton's Password Manager mainly because it came with Systemworks a few years back (now it is a stand alone). It works fine with me here at home. It has a separate profile for every desktop so you have to first get onto my desktop (which is pw protected), then get administrative priledges through a time management program I use for limiting my children's time online called Enuff, then they have to sign into Password Manager. If they can do that (then God bless em' I won't have to worry about paying for college), then they can get access to my passwords.
I think that I am fairly well protected but I still change the passwords every 3 months or so and agree with the person who said to use at least 8 characters and mix them with numbers, symbols, upper and lowercase letters, and no real words (at least English words).
Password manager also stores my credit card information and the one thing that I like about it is that is allows you to drag and drop the numbers into the boxes online. This way, if anyone has enough time on their hands to be tracking my keystrokes without me knowing about it, they don't get the card numbers. As another person said, on websites that I trust and have a lot of business with, I will let them store my credit card numbers.....but only a few (Amazon is one for me too).
I have had a card hacked 2 times in the 10 years or so I have been doing all my banking and a lot of my shopping over the net. I check every card EVERY day and make sure all the charges are legit. When I see something that I (or my wife) don't recognize, I call the credit card company and they take care of thing. I remember one time about 5 years ago, the card company cancelled my card because someone had gotten ahold of it and was charging to all kinds of porno sites. Their security department (then Bank One, now Chase....need to give them a thumbs up!)tracks your purchases (and let's not get into a discussion about big brother and all that...I have nothing to hide!) and when they say all these charges (I think they cancelled after 5) they cancelled the card and called me. Another time I was making a lot of purchases from the same website and they called me that day and asked me if they were legit charges. I told them they were and that was that. The last time a card number was stolen was about 3 months ago. This guy/gal was sneaky, making small, infrequent, charges but by checking every day, I caught it immediately and had to change account numbers.
I think that my instances of theft were done by small companies that I may have ordered something from. I have no clue as to whether they were caught or not.
This is long so finally, I have a word processing file where I keep some important passwords (like how to log onto my desktop and the one for password manager) but I use my own code. I can get to them from my wife's desktop if I forget mine and hers is easy and there is nothing stored in password manager under her account. She would have no clue how to buy something over the net anyway.
I do have Norton Internet Security also so I have a good (IMO) firewall up and running all the time and I need it for parental controls (the computer is in our family room where we all spend out time but you never know with a 15 and a 9 year old!!!). I noticed that Norton must be changing the way they monitor because the other day I got a warning while working online (I have cable so I am always online) about a possible threat. Now I know they warn when there are other computers trying to access yours but this was a virus warning (and I get definitions sent to me sometimes 4 times a day) which never occurred before. It wanted to scan immediately and I let it. It found what it was looking for and destroyed it. I see a lot of bad mouthing about Norton products but they have been good to me for many, many years but that is another story.
I didn't plan on writing this much but I hope it helps some of you. I am disabled and on a lot of pain meds so my memory is effected and I need my own system to remember all those passwords and such. One last thing, remember, if you are using a site like Yahoo for forums or whatever, you don't need to be as worried about your passwors and usernames and with a site such as Vanguard (although the great thing about them is that even if someone gets my passwords and cleans out my account, they will only transfer money to my bank account or send a check only to my address).
Take care and again, I hope some of this helps,
Mike
- Collapse -
It has been several years since I've used my real credit card number online. My bank has a "virtual credit card number generator" which I use to make all online purchases as well as those made by phone. You simply log into the bank and generate a new number which is only good for one purchase and totally useless after it is billed. You can also generate numbers with a $ limit. I would enocourage all who use online banking to talk to your bank and see if they have this software available, most do. This way no one has your real number and you don't have to worry about sites where you purchase being hacked, they won't have your credit card number!!!!
- Collapse -
You know, I've been using my CC number online for many years at hundreds of sites, from little Mom & Pop business sites (for a pet supply) to large national and at international sites too.
My card has never had even one unauthorized use.
As someone said, if you give your number over the phone or use it at a brick and mortar store, some other human beings will be seeing it. That's a possible compromise right there. I did that for years before there was an internet with no trouble either.
There is risk in everything. If anyone does steal it, and you are paying reasonable attention to your account, the costs to you are minimal anyway.
So, what's the big deal?
No question that one needs to be very cautious with bank and SS #.
Everyone has to determine their own risk, but a CC is a *convenience*. If you are that paranoid about using it, then it isn't a convenience anymore.
- Collapse -
If you are that worried about using a credit card online consider this. A local business recently had an employee that was using a skimmer to gather CC informatilon. He then proceeded to use that information to charge about $150,000. Consider that the next time you hand your credit card to someone.
- Collapse -
I have been using my credit card online for many years. Never had any problems.... until!!!
Recently, it seems I hosted someone to a nice hotel in Japan!.
After this event, I cancelled the card and started using the one time use numbers.
I also have a daily habit of checking online for whatever has been charged to the card. This is why I found the problem immediatelly, perhaps avoiding the lavish dinners and other expensive japanese indulgences my uninvited guests would come up with.
Dealing with credit card companies after fraudulent oftentimes adds salt to the wound. Prevention is key!
- Collapse -
It's true. One takes chances with just about any financial interaction. I think there is increased risk with high limit cards or cards used for some foreign charges. I know my personal bank only called me when I ordered something from an online company in Australia, but not for a UK one.
Anyway, this was the first I'd heard of those One Time Safe Shopping numbers. I googled and found out that the bank our corporate accounts are with (MBNA) offers that. I'm passing the info on to our Procurement Dept.
Thanks!
CNET Forums
Operating Systems
Software
Electronics & Gadgets
Hardware
Tablets & Mobile Devices
General Help
Roadshow Autos
Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic