Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/30/2013
12:48 PM
Dino Londis
Dino Londis
Slideshows
100%
0%

10 Top Password Managers

Tired of being stuck in password hell? Consider these password managers that balance security with convenience.
Previous
1 of 11
Next


In 2011, IBM predictedthat in five years we will not be using passwords to access secure resources such as ATMs and PCs. Instead of entering a PIN or typing a username and password into a PC, we will simply look into a camera or speak a name into a microphone, because our eyes and voices are unique, IBM says.

[Super-strong unique passwords are pointless! Join Dark Reading Radio on Wednesday, Sep. 17, 2014 at 1 p.m. ET for a grown-up conversation about passwords with Cormac Herley of Microsoft Research.]

Biometric recognition replaces the entry point for what password managers are already doing today. Companies such as RoboForm and LastPass provide a platform that requires only one complex password to access your secure websites, credit card information and even documents that you keep inside an encrypted database. Depending on the platform, the database could be stored locally, on the company's servers or even in Dropbox.

Some password managers use browser extensions that keep your data in a local profile, syncing with a cloud server. Because the data is encrypted and transferred through a secure connection, you can be reasonably confident that your data is safe.

Other password managers keep your data on a thumb drive you carry around from computer to computer. With this approach you always know where your data is -- as long as you don't leave it in a PC and walk away.

Some products are free and charge for a mobile premium; others are subscription-based or charge single flat fee. One product, Dashlane, rewards you when you use its service by awarding points you can use to earn discounts on future purchases.

Some password managers offer two-factor authentication, requiring a smartcard as well as your password to log in. With this type of two-factor authentication, even if your password is decrypted, hackers still can't access your account -- but neither can you, if you don't have your smartcard. That's why this type of authentication is usually offered as an option; most customers prefer a less-strict password management service.

All password managers do have one thing in common: They require you to remember one complex password. But complex should not mean hard to remember; it could be a sentence, for example. If you forget your master password, after all, you can't access your data -- and since the company that developed your password manager doesn't have it, you'll have to reset all your passwords and start over.

Password managers also generate complex passwords, provide import and export tools, allow for simple notes and automatically complete online forms for more efficient online checkout. Here are 10 password manager tools worth considering.

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 5   >   >>
Buster57
50%
50%
Buster57,
User Rank: Apprentice
5/1/2013 | 5:49:28 PM
re: 10 Top Password Managers
Keepass is easily the best password manager...and it's free!
ctcusick
50%
50%
ctcusick,
User Rank: Apprentice
5/1/2013 | 7:05:41 PM
re: 10 Top Password Managers
Yup, Keepass is the best. I knew of someone who once loaded his entire company's keepass database into a cloud service so he could access passwords remotely. What an amazing idiot. Cloud services are NOT secure. DO NOT sacrifice your computing security, your privacy and liberty, for the latest new wiz-bang technology gizmo or feature.

Did you know that most news website's 'comments' sections obtain one's Contact list (depending on if you log in with an integrated account from facebook, windows live, google, or similar)?

Why would you want corporations and others to know who you know, all so you can use a technology feature (in this example, leaving a comment on a website, such as a foxnewsdotcom online article, or similar)??
JM
50%
50%
JM,
User Rank: Apprentice
5/1/2013 | 7:26:06 PM
re: 10 Top Password Managers
I have used KeePass for years and consider it the best of the lot for several reasons.

1. You make it sound like open source is bad. In fact, it is extremely valuable. The code in KeePass enjoys a level of inspection and verification beyond any closed source program.

2. It stores an indexed database, where each entry can have any number of user defined fields. For example, for an entry for a credit card, in addition to the normal username, password, and URL info, I can store named-fields for any other data I want to store. For example, a credit card number field, a CVC field, a date field, a Name-as-on-card field, a phone number to call if it's lost field, and fields for the special answers to questions the web site asks me when I log in. This capability makes all the difference. I refuse to use a data storage app that canGt do this. It makes the app broadly useful for all sorts of data and makes it a truly effective system for storing data you want to keep private. There is only one place I ever go to, KeePass.

3. It uses a double lock - a file with a tons of random bits, plus the password you type in. I physically copy that file to each of my computers and my phone, so it never touches the internet or any cloud storage. To break in, not only would someone have to guess the password I type in, they'd also need that file.

4. It gives me total control over my data. It stores the data locally, not on the cloud. But I can store it in a dropbox folder if I want to, making it available on the cloud. All my choice. I personnaly have mine on dropbox so that my phone, mac, and pcGs are all synchronized automatically.

5. It works across multiple platforms. I have it working on a MAC, several PC's, my Android phone, and a friend uses it on Linux.

6. Your sentence saying it is lightweight and going on to say what it doesnGt do makes it sound like a bad thing and that it is missing something. In fact, all the things you mention represent a fabulous feature! You can stick the entire tiny program on a memory stick and run it on a machine without having to "install it" It doesn't require mucking up the windows registry etc. I can run it on a friendGs computer and the computer is clean when I'm done.

7. The GǣAutoTypeGǥ feature that fills in all the info required to log into a site works great. ItGs even programmable so that on complicated web sites that donGt use the standard username and password, but demand more things to be filled out, it can be easily programmed to do this job. ItGs simple enough, even my mother (in her 80Gs) has used this with no help from me!

8. It's F R E E !
lspielman916
50%
50%
lspielman916,
User Rank: Apprentice
5/1/2013 | 7:57:34 PM
re: 10 Top Password Managers
I have been a RoboForm user for about 7 years. I LOVE IT! No, I do not work for the company. Am a paid subscriber. Couldn't live without it.

One thing that the article left off was that for at least the last year+ they store everything in the cloud! I have multiple computers and do a lot of global travel. As soon as I use one of my other computers/tablets/smartphones, after I sign in to RoboForm, ALL of my data is synchronized. Yes, I do use a double lock.
stevew928
50%
50%
stevew928,
User Rank: Strategist
5/1/2013 | 8:18:56 PM
re: 10 Top Password Managers
I think you forgot one of the best and oldest, Password Wallet by Selznick. I've been using it since my Palm Pilot days. I think there is a version for just about every platform and it has quite a few sync options.
ShawnHa
50%
50%
ShawnHa,
User Rank: Apprentice
5/1/2013 | 10:15:18 PM
re: 10 Top Password Managers
I haven't been successful at finding a Password safe for multi-roles & multi-users :(
For example local admin password for PC is stored with Service Desk, Infrastructure & Apps Support roles all having access to the password. The SQL server's password is accessible to Infra & Apps but not SD. Citrix is only accessible to Infra....and the IT Manager has God-access to all.
Is there non-web-based software with these features out there??
RB
50%
50%
RB,
User Rank: Apprentice
5/2/2013 | 12:14:57 AM
re: 10 Top Password Managers
I don't understand why eWallet did not make your list. It has excellent support and runs on Windows, Mac OS, Android, IOS, Windows Phone and Blackberry. All data is DES encrypted. Syncing can be done via USB internal WIFI home network or via the cloud,
beergas
50%
50%
beergas,
User Rank: Apprentice
5/2/2013 | 1:31:05 AM
re: 10 Top Password Managers
LastPass still my fave. Works w/ most sites, free, unlimited. lots options. Win 8 x64 Pro in both modes.
SkyRanger
50%
50%
SkyRanger,
User Rank: Apprentice
5/2/2013 | 12:07:47 PM
re: 10 Top Password Managers
Keepass is a nice tool for the freebie seekers. However, it lacks in features compared to RoboForm. I couldn't be happier with my purchase. Great for PC's or thumb drive users. I use the thumb drive at work AND nothing is installed on the PC (leaves no trace). Feature rich: biometric fingerprint authentication, Microsoft document login, popup login, secure notes, secure contacts, etc.
~ I first encrypt the thumbdrive (password protected to unlock the drive). Once I launch the app from the thumbdrive (it integrates with Firefox, Chrome, Opera or Explorer), I have to enter a password one more time from the browser before it will allow me to use it. It can also timeout if you forget to retrieve it at the end of the day.
I also selected to sync the passwords using the online RoboForm server but you can just as easily make the default as the thumbdrive or the one installed at home on your browser.
Leo Regulus
50%
50%
Leo Regulus,
User Rank: Apprentice
5/2/2013 | 3:56:04 PM
re: 10 Top Password Managers
Really, really, really GROSS.

It is now the second quarter of the new year.

Information Week only had one important New Year's Resolution this year. '"No Slide Show Articles with out a prominent 'View-as-one-page' link." How's that working out for you so far?

On my side of the fence, as Client/customer, You aren't doing well at all. Nearly every issue, you violate me with one of your Slide Show articles.

Please, re-examine your priorities. You do know how to do it - 'View as Single Page' link. It just isn't that hard and speaks volumes about your respect and concern for your Client / Customers.

Also, when I have to skip articles, I do not get to see your advertisers' messages.
Page 1 / 5   >   >>
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5423
PUBLISHED: 2020-12-02
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
CVE-2020-29454
PUBLISHED: 2020-12-02
Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
CVE-2020-7199
PUBLISHED: 2020-12-02
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access,...
CVE-2020-14260
PUBLISHED: 2020-12-02
HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system.
CVE-2020-14305
PUBLISHED: 2020-12-02
An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat ...