Password Managmenet

Hello:
I'd like to ask everyone - especially those with multiple online bank accounts and/or who have done AOR's - how you manage passwords. I've searched the FW forums but have not found anything on this topic. Right now my passwords are either stored in my head or on a sheet of paper. I'm wondering if there is a better way. I've been intrigued by roboform (www.roboform.com) and a quick google search reveals quite a few pw management programs that I've never heard of as well. Obviously, I have some issues with giving up my passwords to a program, but the convenience factor might win me over. Also, anyone have any old-fashioned (non high-tech) ways to remember a password?

I keep them all in a small telephone-address book. I'm not anxious to store them on a web-based program. I would guess that there must be free-standing programs which could be loaded on to your computer, but I'd be concerned about the risk of hackers.

good luck

RushnRockt said: Roboform-ing here all the way. I have dozens of passwords for all kinds of websites, so I can't remember everything, I feel confident enough with this software. I also have copies of all passwords in "Any Password"

P.S. Roboform is not web-based[/Q

I second that suggestion.</blockquote>

I keep mine in an encrypted excel file. However, even if someone gained access to that, I have the actual passwords stored in a different location; the excel file only has a reference/code word for each password.

First 10 password are free, to store more costs $20 well worth it.

I always post my passwords on Fatwallet... That way, I always know where to find them.

sammy1224 said: I always post my passwords on Fatwallet... That way, I always know where to find them.
besidesw, if you forget, all others can remind you of the forgotten password.

I put my login and user info along with my bookmarks, but I enter them in a cryptic manner that only I could recognize.

One thing you might find useful is a password scheme, so you can figure out any web password just from the name of the site you're on.

You might start with a secure random pass-phrase that has at least one each of a capital letter, lower case letter, and a number. Then take the first letter of the site and bump it up by two letters, then insert it into the third position in your passphrase. Then take the third letter of the site and bump it down by one and insert it into the fifth position of your passphrase.

For example, I'm signing on to FatWallet. My secure passphrase is u8lnBt. From 'FatWallet', f -> h and t -> s, so my password for FatWallet is u8hlsnBt.

Because it may be possible for a concerted effort to yield your forum passwords, and thus find the pattern, I would segment my passwords into three levels. The first and most common level I would use on forums, etc., where a security breach would be trivial. The second I'd use on financial sites where a breach could really suck. The third I'd use for my business matters where a breach could be devestating. Each level would have a different passphrase and an increasingly more complicated scheme.

--Joe

It's not just passwords -- it's also usernames that need to be managed. I have so many usernames, account numbers, etc. on various sites.

I just use Yodlee to view/auto-login to my accounts. The MoneyCenter version also has a feature to reveal your password if you ever need your login info.

For the accounts that don't work with Yodlee, I have an encrypted Access file

I have been using passwordsafe for a few months now and am very happy with it. I only wish it had a sidebar like interface but I haven't found any reasons to switch from it. If you have a fingerprint reader, like I do, then you don't even need to enter password for the master database. Just scan your finger and you are good to go.

p

Wow, for FW finance we sure have a lot of people spending cash on software to do what excel can do for free (there are freeware form fillers as well). Excel on a locked USB key is how I do it. It's funny all the ways people go about 'protecting' themselves - once you move into pws more complex than 'password' your biggest concern is people with physical access (cleaning/housekeeper/family) installing a sw or (more worrisome and less detectable) HW keylogger.

I use Password Corral.
All of my coworkers uses password corral as we have too many password that needs to be changed in timely basis as they expire and there is no way to remember all passwords.

Link:Password Corral

Just my 2 cents

bterwilliger said: Wow, for FW finance we sure have a lot of people spending cash on software to do what excel can do for free (there are freeware form fillers as well). Excel on a locked USB key is how I do it. It's funny all the ways people go about 'protecting' themselves - once you move into pws more complex than 'password' your biggest concern is people with physical access (cleaning/housekeeper/family) installing a sw or (more worrisome and less detectable) HW keylogger.

As mentioned, Roboform also lets you easily fill-in forms and log on to all your accounts. And of course, it has its own password to be able to use it.

I also vouch for Keepass.. Open source software that works as well or better than commercial software and it has a small memory footprint.
http://keepass.sourceforge.net/

I've been using it for about a year now.
Supports AES Rjindael encryption.

See a list of features here:
Features

The only con i see is that it doesn't fill in passwords for you on websites automatically. However, it does have shortcuts to copy your login/password into the copy/paste buffer for you to paste it. (It automatically clears the buffer after x number of seconds, so other programs can't read your password from memory.)

Storing passwords in there is vastly superior than storing it on paper or passworded excel (easily crackable).
It would be very difficult to crack the master password for Keepass if you have a good/mixed/long password. I've made my master password about 25 characters long, so it would take a long time to brute force it. Keepass also has a feature where you can store a key file on a usb flash drive, so that any time you want to open up Keepass you have to have the master password and the flash drive to get to your passwords. People who may have keystroke logged your password would need your flash drive in addition to your master password to get to your passwords.

I use the same user name and password for all the online banking accounts.
That way I never forget and never have to rely on any software. I am not comfortable with giving my password to anyone, including the software.

I have a book I keep in a drawer! How archaic is that! I doubt someone could figure out my code for the accounts and I have about 4 passwords I use and I only write the first 3 letters down, since I know the passwords by heart. I have 5 years of passwords in there and it must be at least 100 different ones.
( Credit Card logins, banking, forums,shopping....) crazy! the only problem is if I die, no one in my family will be able to access all my stuff, so I need to set that up better in my will!
( yeah, about that will I need to get around too...)

RushnRockt said: Roboform-ing here all the way. I have dozens of passwords for all kinds of websites, so I can't remember everything, I feel confident enough with this software. I also have copies of all passwords in "Any Password"

P.S. Roboform is not web-based

roboform for me as well, great program. for backup, i use my palm.
edit: and, as for many others, when i write down the passwords, i store them in cryptic form only I know

I just use "password1234!@#$" on all sites... it is much easier!!!

JUST KIDDING!!!

I use passwordmaker (http://passwordmaker.org), which is a firefox extension. Just remember a master password, and your site-specific password is calculated on the fly, and can be copied to the clipboard. Nothing to be stolen, and nothing can be key-logged. It also has some sort of fill-in capability. And an online version is also available.

Password Safe: http://passwordsafe.sourceforge.net/ available in multiple languages and a U3 version. Also see: http://www.schneier.com/passsafe.html

Roboform is very handy and easy to use as well.

As previously mentioned, TrueCrypt looks very attractive for overall system encryption (http://www.truecrypt.org/). I have not tried it yet, but it's on my list to evaluate.

All these tools depend upon the security of the software (do you trust the code) and the underlying computer (are all applications and the OS kept up to date and patched). If the computer/network is compromised, you are potentially vulnerable to local keylogging or hijacking. You are also vulnerable to breaches in the remote system - not something you have control over, but by changing your passwords periodically, and using different strong passwords for each of the sensitive sites you access (i.e., sites involving money), you can exercise some control over your risk exposure.

For general security discussions, check out http://www.counterpane.com/crypto-gram.html. Previous newsletters are available online.