Good program to store / generate secure passwords

ctoon6

sr. member

Activity: 350

Merit: 251

Quote from: JohnDoe on September 14, 2011, 10:12:38 PM

Quote from: ctoon6 on September 14, 2011, 08:14:34 PM

i would advise against having your passwords anywhere on the internet in any form, regardless of how secure you may think it is. all it takes is for someone to keylog you, or guess your password/recovery question or something. having the PW DB locally makes the task far more arduous if you are just key logged or something less serious. keepass can even launch programs with the password in a launch parameter, steam for example.

LastPass has a screen keyboard and one time passwords to prevent keylogging.

its trivial to beat onscreen keyboards, simply takes a snapshot each time you push the mouse. onetime passwords can be defeated through phishing or directly attacking the website itself.

JohnDoe

sr. member

Activity: 392

Merit: 251

Quote from: ctoon6 on September 14, 2011, 08:14:34 PM

i would advise against having your passwords anywhere on the internet in any form, regardless of how secure you may think it is. all it takes is for someone to keylog you, or guess your password/recovery question or something. having the PW DB locally makes the task far more arduous if you are just key logged or something less serious. keepass can even launch programs with the password in a launch parameter, steam for example.

LastPass has a screen keyboard and one time passwords to prevent keylogging.

ctoon6

sr. member

Activity: 350

Merit: 251

i would advise against having your passwords anywhere on the internet in any form, regardless of how secure you may think it is. all it takes is for someone to keylog you, or guess your password/recovery question or something. having the PW DB locally makes the task far more arduous if you are just key logged or something less serious. keepass can even launch programs with the password in a launch parameter, steam for example.

Code:

cmd://"C:\Program Files (x86)\Steam\steam.exe" -login {USERNAME} {PASSWORD}

Code:

minecraft.exe {USERNAME} {PASSWORD}

if you want anymore things like that just post or pm or something. id be more than happy to help you secure your system, it bothers me to no end with people storing their information on the internet...

that in your URL box will make it far more difficult to get your password remotely because they would not be specifically targeting that method of logging in.

pekv2

hero member

Activity: 770

Merit: 502

Ah, yea, thanks for correcting me.

http://www.dropbox.com/help/27

I just read their features vs waula. I would lean towards waula for storing password backups.

Whether hiding something or not, I wouldn't trust dropbox with my password backups or anything else.
Dropbox http://www.dropbox.com/help/27

Quote

Dropbox employees are prohibited from viewing the content of files you store in your Dropbox account, and are only permitted to view file metadata (e.g., file names and locations).

Waula http://www.wuala.com/en/learn/technology

Quote

Wuala protects your privacy: In stark contrast to most other online storage services, all your files get encrypted on your computer, so that no one - including the employees at Wuala and LaCie - can access your private files. Your password never leaves your computer.

ctoon6

sr. member

Activity: 350

Merit: 251

the files on dropbox are encrypted, however dropbox staff holds the keys. so if dropbox gets hacked, you should still be safe, however if a member of staff abuses their power, your screwed.

pekv2

hero member

Activity: 770

Merit: 502

Lastpass is the best to use. If you ever format your pc, that is if you don't backup "firefox profile" "chrome" w/e browser you use, you sign into lastpass addon, all your passwords are there for you. Password database is encrypted on your pc before they get sent off to online through SSL.

Quote

LastPass is an evolved Host Proof hosted solution, which avoids the stated weakness of vulnerability to XSS as long as you're using the add-on. LastPass strongly believes in using local encryption, and locally created one way salted hashes to provide you with the best of both worlds for your sensitive information: Complete security, while still providing online accessibility and syncing capabilities. We've accomplished this by using 256-bit AES implemented in C++ and JavaScript (for the website) and exclusively encrypting and decrypting on your local PC. No one at LastPass can ever access your sensitive data. We've taken every step we can think of to ensure your security and privacy.

More reasons to use lastpass

There was one breech of lastpass, they patched it, but because everything that was encrypted, only most likely weak masterpassworded accounts might, might have been cracked but doubt it, so they suggested for all to just change the masterpassword for weak passworded accounts.

Complete follow up found here

Unlike sony, they were breeched, everything was in plain text.

Edit:
Dropbox is not encrypted, I've heard waula is though. waula same as lastpass, encrypted on your pc before it leaves your pc.

JohnDoe

sr. member

Activity: 392

Merit: 251

What are Linux people using? KeePassX doesn't have browser integration as far as I can tell. I'm leaning towards LastPass for now. It doesn't seem more insecure than KeePass + Dropbox.

TiagoTiago

hero member

Activity: 616

Merit: 500

Firstbits.com/1fg4i :)

I use PasswordMaker

Stalin-chan

full member

Activity: 196

Merit: 100

Use keypass. It's that simple.

ctoon6

sr. member

Activity: 350

Merit: 251

Quote from: JBDive on September 14, 2011, 07:57:45 AM

Roboform Portable is what I use however Keepass is nearly identical in function. What I don't like about Roboform is although the passwords are encrypted you can look into the file structure of the program enough to see that there are passwords stored for what sites as it uses the name you give it when storing the password as the file name:

F:\MyRoboForm Data
-Default Profile
-Blogs
Bitcointalk.rfp

This in turn tells the attacker that first off you do have an account and at what site, something I may actually be trying to hide. It may be that I am actually trying to hide the fact that I have used say Facebook or a certain email provider as much as I am trying to hide the password itself. I also assume the attacker could concentrate his efforts on cracking that single file vs. the database as a whole. Granted I could type garbage for the name of the site, FGHE equals Facebook but then I have to keep track of that information as well.

Not sure how Keepass handles this.

keepass has all the passwords inside a single DB file.

JBDive

full member

Activity: 238

Merit: 100

Roboform Portable is what I use however Keepass is nearly identical in function. What I don't like about Roboform is although the passwords are encrypted you can look into the file structure of the program enough to see that there are passwords stored for what sites as it uses the name you give it when storing the password as the file name:

F:\MyRoboForm Data
-Default Profile
-Blogs
Bitcointalk.rfp

This in turn tells the attacker that first off you do have an account and at what site, something I may actually be trying to hide. It may be that I am actually trying to hide the fact that I have used say Facebook or a certain email provider as much as I am trying to hide the password itself. I also assume the attacker could concentrate his efforts on cracking that single file vs. the database as a whole. Granted I could type garbage for the name of the site, FGHE equals Facebook but then I have to keep track of that information as well.

Not sure how Keepass handles this.

BitcoinBug

full member

Activity: 196

Merit: 100

If you use KeePass and Chrome, you should definitely check this extension:
https://chrome.google.com/webstore/detail/ompiailgknfdndiefoaoiligalphfdae?hc=search&hcp=main
(there is a version for Firefox too)

Jessica

full member

Activity: 174

Merit: 100

Keepass is great, you definitely should use it!

Gerken

full member

Activity: 126

Merit: 100

Keepass user as well here, it's nice to be able to keep track of usernames as well for sites I only visit a few times a year.

sonba

sr. member

Activity: 395

Merit: 250

Thanks for all the replies. Guess I gonna use KeePass - it got some good evaluations, as well. And no, I'm not gonna store them online. That's why I asked for a program running on my local machine

Maybe I'm a bit paranoid there but it doesn't look to safe to me.

ovidiusoft

sr. member

Activity: 252

Merit: 250

Quote from: ctoon6 on September 12, 2011, 09:53:49 PM

whatever you do, dont store your passwords in an online database, to me this just defies all logic, an takes a hippo shit all over it.

...but because I can already hear the voices shouting "But I want my passwords synced across devices! Pronto!", the good enough solution is to place the password database in Dropbox so it's automagically synced. The better solution would be Sparkleshare on your own server, when they'll have a stable client for all major platforms.

ctoon6

sr. member

Activity: 350

Merit: 251

whatever you do, dont store your passwords in an online database, to me this just defies all logic, an takes a hippo shit all over it.

Revalin

hero member

Activity: 728

Merit: 500

165YUuQUWhBz3d27iXKxRiazQnjEtJNG9g

http://passwordsafe.sourceforge.net/
https://lastpass.com/

ovidiusoft

sr. member

Activity: 252

Merit: 250

KeePass - http://keepass.info/

It's the best I could find. Very powerful encryption, versions for all desktop and mobile OS-es, and has a "autotype" function so you don't need to copy and paste your password, it will fill it directly to your browser (or any other app). Also has a very good password generator. I use it for some time now (2+ years) and I couldn't be happier.

bitdragon

hero member

Activity: 609

Merit: 501

peace

http://www.keepassx.org/downloads/

Topic: Good program to store / generate secure passwords (Read 1842 times)