Risk
4/30/2013
12:48 PM
Dino Londis
Dino Londis
Slideshows
100%
0%

10 Top Password Managers

Tired of being stuck in password hell? Consider these password managers that balance security with convenience.
Previous
2 of 11
Next


LastPass is often the first name mentioned when people discuss password managers. Founded in April 2008, when the major contenders in end-user password management were RoboForm, 1Password and KeePass, LastPass works on virtually every operating system. On the desktop, it installs on the browser as an extension, so you might need to provide explicit permission to let it run.

LastPass automatically fills out forms, allows for import and export, and permits sharing of passwords through the Internet (a better alternative than using plain text email, which is insecure). It also lets you create and keep simple notes, generate complex passwords, and create a USB key using Google Authenticator Support.

The premium version of LastPass costs $12 a year, which buys you mobile support even for WebOS. You also get multi-factor authentication via YubiKey, which you use like a USB thumb drive. LastPass also offers a credit monitoring service that will send email alerts when your credit report is modified.

Finally, LastPass for Android has a custom input method that automatically fills in your username and password when you log into apps such as Facebook.

Price: Free for desktop, $12/year for mobile

RECOMMENDED READING:

Twitter Two-Factor Authentication: Too Little, Too Late?

Want Stronger Passwords? Try Bad Grammar

6 Password Security Essentials For Developers

5 Ways To Solve The Password Reset Problem

8 Ways To Avoid Getting Your Life Hacked

7 Tips To Toughen Passwords

Previous
2 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 5   >   >>
Buster57
50%
50%
Buster57,
User Rank: Apprentice
5/1/2013 | 5:49:28 PM
re: 10 Top Password Managers
Keepass is easily the best password manager...and it's free!
ctcusick
50%
50%
ctcusick,
User Rank: Apprentice
5/1/2013 | 7:05:41 PM
re: 10 Top Password Managers
Yup, Keepass is the best. I knew of someone who once loaded his entire company's keepass database into a cloud service so he could access passwords remotely. What an amazing idiot. Cloud services are NOT secure. DO NOT sacrifice your computing security, your privacy and liberty, for the latest new wiz-bang technology gizmo or feature.

Did you know that most news website's 'comments' sections obtain one's Contact list (depending on if you log in with an integrated account from facebook, windows live, google, or similar)?

Why would you want corporations and others to know who you know, all so you can use a technology feature (in this example, leaving a comment on a website, such as a foxnewsdotcom online article, or similar)??
JM
50%
50%
JM,
User Rank: Apprentice
5/1/2013 | 7:26:06 PM
re: 10 Top Password Managers
I have used KeePass for years and consider it the best of the lot for several reasons.

1. You make it sound like open source is bad. In fact, it is extremely valuable. The code in KeePass enjoys a level of inspection and verification beyond any closed source program.

2. It stores an indexed database, where each entry can have any number of user defined fields. For example, for an entry for a credit card, in addition to the normal username, password, and URL info, I can store named-fields for any other data I want to store. For example, a credit card number field, a CVC field, a date field, a Name-as-on-card field, a phone number to call if it's lost field, and fields for the special answers to questions the web site asks me when I log in. This capability makes all the difference. I refuse to use a data storage app that canGÇÖt do this. It makes the app broadly useful for all sorts of data and makes it a truly effective system for storing data you want to keep private. There is only one place I ever go to, KeePass.

3. It uses a double lock - a file with a tons of random bits, plus the password you type in. I physically copy that file to each of my computers and my phone, so it never touches the internet or any cloud storage. To break in, not only would someone have to guess the password I type in, they'd also need that file.

4. It gives me total control over my data. It stores the data locally, not on the cloud. But I can store it in a dropbox folder if I want to, making it available on the cloud. All my choice. I personnaly have mine on dropbox so that my phone, mac, and pcGÇÖs are all synchronized automatically.

5. It works across multiple platforms. I have it working on a MAC, several PC's, my Android phone, and a friend uses it on Linux.

6. Your sentence saying it is lightweight and going on to say what it doesnGÇÖt do makes it sound like a bad thing and that it is missing something. In fact, all the things you mention represent a fabulous feature! You can stick the entire tiny program on a memory stick and run it on a machine without having to "install it" It doesn't require mucking up the windows registry etc. I can run it on a friendGÇÖs computer and the computer is clean when I'm done.

7. The GÇ£AutoTypeGÇ¥ feature that fills in all the info required to log into a site works great. ItGÇÖs even programmable so that on complicated web sites that donGÇÖt use the standard username and password, but demand more things to be filled out, it can be easily programmed to do this job. ItGÇÖs simple enough, even my mother (in her 80GÇÖs) has used this with no help from me!

8. It's F R E E !
lspielman916
50%
50%
lspielman916,
User Rank: Apprentice
5/1/2013 | 7:57:34 PM
re: 10 Top Password Managers
I have been a RoboForm user for about 7 years. I LOVE IT! No, I do not work for the company. Am a paid subscriber. Couldn't live without it.

One thing that the article left off was that for at least the last year+ they store everything in the cloud! I have multiple computers and do a lot of global travel. As soon as I use one of my other computers/tablets/smartphones, after I sign in to RoboForm, ALL of my data is synchronized. Yes, I do use a double lock.
stevew928
50%
50%
stevew928,
User Rank: Apprentice
5/1/2013 | 8:18:56 PM
re: 10 Top Password Managers
I think you forgot one of the best and oldest, Password Wallet by Selznick. I've been using it since my Palm Pilot days. I think there is a version for just about every platform and it has quite a few sync options.
shawn
50%
50%
shawn,
User Rank: Apprentice
5/1/2013 | 10:15:18 PM
re: 10 Top Password Managers
I haven't been successful at finding a Password safe for multi-roles & multi-users :(
For example local admin password for PC is stored with Service Desk, Infrastructure & Apps Support roles all having access to the password. The SQL server's password is accessible to Infra & Apps but not SD. Citrix is only accessible to Infra....and the IT Manager has God-access to all.
Is there non-web-based software with these features out there??
RB
50%
50%
RB,
User Rank: Apprentice
5/2/2013 | 12:14:57 AM
re: 10 Top Password Managers
I don't understand why eWallet did not make your list. It has excellent support and runs on Windows, Mac OS, Android, IOS, Windows Phone and Blackberry. All data is DES encrypted. Syncing can be done via USB internal WIFI home network or via the cloud,
beergas
50%
50%
beergas,
User Rank: Apprentice
5/2/2013 | 1:31:05 AM
re: 10 Top Password Managers
LastPass still my fave. Works w/ most sites, free, unlimited. lots options. Win 8 x64 Pro in both modes.
SkyRanger
50%
50%
SkyRanger,
User Rank: Apprentice
5/2/2013 | 12:07:47 PM
re: 10 Top Password Managers
Keepass is a nice tool for the freebie seekers. However, it lacks in features compared to RoboForm. I couldn't be happier with my purchase. Great for PC's or thumb drive users. I use the thumb drive at work AND nothing is installed on the PC (leaves no trace). Feature rich: biometric fingerprint authentication, Microsoft document login, popup login, secure notes, secure contacts, etc.
~ I first encrypt the thumbdrive (password protected to unlock the drive). Once I launch the app from the thumbdrive (it integrates with Firefox, Chrome, Opera or Explorer), I have to enter a password one more time from the browser before it will allow me to use it. It can also timeout if you forget to retrieve it at the end of the day.
I also selected to sync the passwords using the online RoboForm server but you can just as easily make the default as the thumbdrive or the one installed at home on your browser.
Leo Regulus
50%
50%
Leo Regulus,
User Rank: Apprentice
5/2/2013 | 3:56:04 PM
re: 10 Top Password Managers
Really, really, really GROSS.

It is now the second quarter of the new year.

Information Week only had one important New Year's Resolution this year. '"No Slide Show Articles with out a prominent 'View-as-one-page' link." How's that working out for you so far?

On my side of the fence, as Client/customer, You aren't doing well at all. Nearly every issue, you violate me with one of your Slide Show articles.

Please, re-examine your priorities. You do know how to do it - 'View as Single Page' link. It just isn't that hard and speaks volumes about your respect and concern for your Client / Customers.

Also, when I have to skip articles, I do not get to see your advertisers' messages.
Page 1 / 5   >   >>
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1516
Published: 2015-09-03
Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVE-2015-4077
Published: 2015-09-03
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allows local users to read arbitrary kernel memory via a 0x22608C ioctl call.

CVE-2015-4552
Published: 2015-09-03
Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.

CVE-2015-5189
Published: 2015-09-03
Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.

CVE-2015-5190
Published: 2015-09-03
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.