2/24/06 Questions about storing and managing passwords

Hi,

One way to protect is to buy a cheap (low capacity) USB memory stick and to store all your sensitive data (and maybe other useful data such as software keys etc)on that. You simply plug in when you need the information and remove it at other times. Its small and very portable also which can be an added convenience.
To protect against losing it you should ensure that you do not store any information on it which can provide anyone with your name, address, etc so that the information they can access on it is useless to anyone finding it. If worried about the inconvenience of losing it and your passwords, then use a second backup one which you never carry around but leave in a secure place at home (something so small is easy to hide well away from burglars etc).
Vic

Probably not I guess

Which is why I tend not to record the full password but use an abbreviation which only I (hopefully) will understand!

I'm one of those who keeps a paper card file per registered site with log-in and PW hints on them as my password ref tool. Seemed a perfectly secure way to do it and I was puzzled why this didn't seem to fit the bill for most of the posters here.

DOH! Belatedly it occurred to me that there are probably a lot of people who wish to keep secret some of the sites they are registered at. (I'm not making any judgement calls there, honest! These days just being an activist in certain political circles might be a job threat, and certainly could result in government monitoring.

That does impact where someone would store info about more [ahem] personal registrations.

There aren't going to be any absolutely secure methods.
In fact, (thinking of the purloined letter), I wonder if using the most elaborate online tools might make serve to create a more tempting target for hacking?

In any case, the few possibly "sensitive" registrations I have can include mnemonics in the URL also.

As mentioned by others, I would have to think anti virus and firewall protection and operating system security updates are the primary rule of thumb for protecting against malicious access to our home computer, or any other personal information in that case, as Kasey C. of San Francisco, CA advised. However, when typing in passwords or accessing accounts or websites online, any program designed to invade and steal such information only needs a second or two at the right time to hijack said information. All too often, you're a bit late on finding out that such a situation has occurred, and have to suffer a system clean and virus check. Most sites have encryption for protecting your password as far as storage at their end, but if stored in a cookie on your end, it leaves it open to malicious programs other than what your own security walls and protection programs try to protect and defend. More often than not, identity theft of passwords is due to your own home computer being invaded, unless a company has a major hack break in that you have seen rarely or on a more uncommon note, on the news. Storing your passwords on your home computer, then selecting ''do not remember me'' or NOT choosing ''remember my password'' on each specific web site is 'probably' the best thing one can do for not allowing a password the ability to 'float around' online. I merely keep my information in a file in a notepad format, creating said file in SAFE MODE, then I use a program such as 'PDL Hider' ( a file and folder privacy converter ) to alter my files over to a slightly more secure format. A home user can then simply place them in a better location on their computer, ''off station'' of the normal operating system hard drive ( I use two hard drives on my home computer ), or one can store them on a partitioned area of your drive ( even using an external 'ThumbDrive' can be practical ). This way I can feel a bit more secure in not having important files on the main operating system hard drive which may get viewed, monitored or 'violated'. Further, in that I'm not going to try and make this sound as if I'm promoting certain products or brand names, I take a couple of extra steps to feel a bit more safe, and simply put to use additional security programs. So just for an example and using my own personal experience here at home, I've found that a program such as ''Security Task Manager'' in my own case, helps a lot. It?s a system process analyzer, but here for our main point, it includes a sub-program called ''Spy Protector'' which allows the user to select modes where you can prevent keyboard monitoring and other program monitoring such as macros (user activities) mouse activities, starting and ending or use of personal programs, and keyboard inputs (internal messages). This prevents other users if the case, or malicious programs, from accidentally or otherwise malevolently accessing your private info. Activating blocks at these points of access will disable any monitoring of your input to sites from your end. When you need that information to use on a site, simply unlock your concealed password and information file with the .pdl type converter, then as a further safety measure, never 'type in' your information, simply copying and pasting the required field in to complete any information. This is saved to your clipboard at the time of course, but is blocked from being monitored at the time. For later, an easy to use cleaner program such as ?WindowWasher? in my case and its frequent use is 'always' a smart recommendation for normal system cleanup, and washes any all information from that end, including storage cookies. I may have a loophole or two on that process line and way of thinking so feel free to correct me if you wish, as I can take polite corrective criticism most of the time *smiles*. Hope some of this helps. Drew

Doesnt it bug you when websites force you to change your passwords too regulary

I reckon this is more likely to force some people (ie the millions who have not read these forum posts) to backing up your passwords in a manner that is unsafe and thus degrading security!

My suggestion requires no outlay of cash for password management as opposed to purchasing a PDA (which for many is essential but for others another electronic toy). I use RoboForm and I love it. I have been using it for years and it is free if you are only storing a few passwords. Over 10 and it is a lot less costly (I believe the license is somewhere about $30)than a PDA. It is well worth the money and I never have to remember a password, it signs you on to the website and also has an autofill feature so you don't have to fill out online forms ad nauseum. I would recommend that you back your passcards to a floppy, cd or zip drive however.

How refreshing it was to read some inside information regarding password management and your system. I too have often wondered about the same issues as Gary H. I do the pencil and book route. I keep my hard to remember my ''silly'' passwords and the most important ones, marked down in ''several'' small books (simular to a personal pocket, adress book). I do however, allow my own system to record the most frequently used sites that require a password. Banking passes are kept in a special place... my head. You learn to condition yourself to remember pass combinations like these. We as humans learn the ''how to's'' and prefer to depend on ourselves over technology (at times). Something as delicate as a password, should be treated like a new born baby, so in a sense, so should your own personal pass-words. IF you back up or ''burn'' your most important onto disc (multi session), including your important documents, then kudos. As for the hackers aspect, a good Firewall would help that works in tandum with a virus program; plus help from Cnet. News boards like this one, will catch the attention of people like myself and subjects like this. My suggestion and personal experiances have taught me the ''how to's'' and brain food never tasted so good!