My DA Favourites
Fade away by Dozign
Update your links! My blogging continues at http://blog.microugly.com.
20 Jun, 2007

Keeping Passwords Safe

I've been guilty of recycling the same passwords across multiple sites and services.  I'm not so stupid as to use my Internet banking password on other sites, but I have recycled enough passwords for it become a headache had one been leaked.

So I figured it was time to properly secure some of my more critical resources by picking unique passwords for them.  Of course, I will never remember all these passwords which is where KeePass comes in.

KeePass stores all your passwords in a secure database which is protected by one master password.  Each password is stored as a separate entry with a title, user name, password, URL and a notes field.  You can even attach a file.  Passwords can be arranged in a folder tree and each folder can have it's own icon for easy categorisation. 

Passwords are hidden from plain view at all times, unless you choose otherwise, and with the click of a button the password can be copied to the clipboard ready for pasting into a password field.  This means key stroke loggers can't capture your password and after 10 second the password is purged from the clipboard.

KeePass can generate random password of varying complexity, depending on your preferences.  Passwords are cleverly generated in a way to ensure it is truely random, by requiring the user to supply a seed either by mashing the keyboard or moving a mouse randomly over an image of black and white noise. 

On top of all this is a whole host of features to ensure your passwords cannot be captured by any malware on your PC and your database cannot be hacked.   If you forget your master password or lose the database you are very screwed indeed.

Because this is the type of system that would require frequent and immediate access to the database, it's quite convienent that KeePass is comes in a portable flavor suitable for running off a USB pen drive.  The pen drive itself can also be used as an extra measure of security by carrying a key file that's used in conjunction with your master password to secure the database (i.e. if you are missing either the master password or the key file you can't access the database).

But if all this is too manual and inconvienent, I also found an alternative system for ensuring different site have different passwords, PasswordMaker.  It works on a very simple idea of having one master password, which is combined with the URL of the website you need a password for, to produce a unique password.  Provided you can remember your master password and the URL, you can retrieve the unique password at anytime, anywhere. PasswordMaker can be installed as a plugin for Firefox or Internet Explorer or you can simply access the online version of PasswordMaker.  The online version can also be downloaded as a standalone HTML file if you don't want to submit your master password on a live website.

My only problem with PasswordMaker is that it has a variety of parameters that effect how your password is generated.  If you forget the combination of parameters you chose to generate the original password then you going to go through a lot of trial and error to generate it again. 

Filed In:

Comments

1. James Urquhart says…

Currently i do most of my web browsing & admin on my mac, and thus use OSX's built in keychain system to store passwords (although sadly firefox doesn't support it, so i use safari / camino instead). I believe you can also store your keychain's on external drives and they will be loaded into the 'master' keychain automagically (athough i have not tried this out myself, so i don't know how well it works).

Sadly though i have not yet found any built-in system for generating random passwords, although i could probably just write a script to generate one for me i guess.

Posted on Thu 21 Jun, 2007

2. James Urquhart says…

Slightly off topic, but i have tagged you with the 8 random facts meme. If you have the time, please join in. :)

Posted on Mon 25 Jun, 2007

Add comment:


Submit Comment Preview Comment

Rules: Paragraphs and linebreaks are automatically created (two or more linebreaks create a paragraph). Linebreaks between code tags remain linebreaks. Block tags cannot be enclosed by inline tags. Red attributes are required and green is optional.

Use "&lt;" and "&gt;" for "<" and ">". Enclosing PHP code in <code> tags will highlight the code (i.e. <code>&lt;?php echo 'hello world'; ?&gt;</code>).

List of valid tags: