Risk

4/30/2013
12:48 PM
Dino Londis
Dino Londis
Slideshows
100%
0%

10 Top Password Managers

Tired of being stuck in password hell? Consider these password managers that balance security with convenience.
Previous
1 of 11
Next


In 2011, IBM predictedthat in five years we will not be using passwords to access secure resources such as ATMs and PCs. Instead of entering a PIN or typing a username and password into a PC, we will simply look into a camera or speak a name into a microphone, because our eyes and voices are unique, IBM says.

[Super-strong unique passwords are pointless! Join Dark Reading Radio on Wednesday, Sep. 17, 2014 at 1 p.m. ET for a grown-up conversation about passwords with Cormac Herley of Microsoft Research.]

Biometric recognition replaces the entry point for what password managers are already doing today. Companies such as RoboForm and LastPass provide a platform that requires only one complex password to access your secure websites, credit card information and even documents that you keep inside an encrypted database. Depending on the platform, the database could be stored locally, on the company's servers or even in Dropbox.

Some password managers use browser extensions that keep your data in a local profile, syncing with a cloud server. Because the data is encrypted and transferred through a secure connection, you can be reasonably confident that your data is safe.

Other password managers keep your data on a thumb drive you carry around from computer to computer. With this approach you always know where your data is -- as long as you don't leave it in a PC and walk away.

Some products are free and charge for a mobile premium; others are subscription-based or charge single flat fee. One product, Dashlane, rewards you when you use its service by awarding points you can use to earn discounts on future purchases.

Some password managers offer two-factor authentication, requiring a smartcard as well as your password to log in. With this type of two-factor authentication, even if your password is decrypted, hackers still can't access your account -- but neither can you, if you don't have your smartcard. That's why this type of authentication is usually offered as an option; most customers prefer a less-strict password management service.

All password managers do have one thing in common: They require you to remember one complex password. But complex should not mean hard to remember; it could be a sentence, for example. If you forget your master password, after all, you can't access your data -- and since the company that developed your password manager doesn't have it, you'll have to reset all your passwords and start over.

Password managers also generate complex passwords, provide import and export tools, allow for simple notes and automatically complete online forms for more efficient online checkout. Here are 10 password manager tools worth considering.

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 5 / 5
lspielman916
50%
50%
lspielman916,
User Rank: Apprentice
5/1/2013 | 7:57:34 PM
re: 10 Top Password Managers
I have been a RoboForm user for about 7 years. I LOVE IT! No, I do not work for the company. Am a paid subscriber. Couldn't live without it.

One thing that the article left off was that for at least the last year+ they store everything in the cloud! I have multiple computers and do a lot of global travel. As soon as I use one of my other computers/tablets/smartphones, after I sign in to RoboForm, ALL of my data is synchronized. Yes, I do use a double lock.
JM
50%
50%
JM,
User Rank: Apprentice
5/1/2013 | 7:26:06 PM
re: 10 Top Password Managers
I have used KeePass for years and consider it the best of the lot for several reasons.

1. You make it sound like open source is bad. In fact, it is extremely valuable. The code in KeePass enjoys a level of inspection and verification beyond any closed source program.

2. It stores an indexed database, where each entry can have any number of user defined fields. For example, for an entry for a credit card, in addition to the normal username, password, and URL info, I can store named-fields for any other data I want to store. For example, a credit card number field, a CVC field, a date field, a Name-as-on-card field, a phone number to call if it's lost field, and fields for the special answers to questions the web site asks me when I log in. This capability makes all the difference. I refuse to use a data storage app that canGt do this. It makes the app broadly useful for all sorts of data and makes it a truly effective system for storing data you want to keep private. There is only one place I ever go to, KeePass.

3. It uses a double lock - a file with a tons of random bits, plus the password you type in. I physically copy that file to each of my computers and my phone, so it never touches the internet or any cloud storage. To break in, not only would someone have to guess the password I type in, they'd also need that file.

4. It gives me total control over my data. It stores the data locally, not on the cloud. But I can store it in a dropbox folder if I want to, making it available on the cloud. All my choice. I personnaly have mine on dropbox so that my phone, mac, and pcGs are all synchronized automatically.

5. It works across multiple platforms. I have it working on a MAC, several PC's, my Android phone, and a friend uses it on Linux.

6. Your sentence saying it is lightweight and going on to say what it doesnGt do makes it sound like a bad thing and that it is missing something. In fact, all the things you mention represent a fabulous feature! You can stick the entire tiny program on a memory stick and run it on a machine without having to "install it" It doesn't require mucking up the windows registry etc. I can run it on a friendGs computer and the computer is clean when I'm done.

7. The GǣAutoTypeGǥ feature that fills in all the info required to log into a site works great. ItGs even programmable so that on complicated web sites that donGt use the standard username and password, but demand more things to be filled out, it can be easily programmed to do this job. ItGs simple enough, even my mother (in her 80Gs) has used this with no help from me!

8. It's F R E E !
ctcusick
50%
50%
ctcusick,
User Rank: Apprentice
5/1/2013 | 7:05:41 PM
re: 10 Top Password Managers
Yup, Keepass is the best. I knew of someone who once loaded his entire company's keepass database into a cloud service so he could access passwords remotely. What an amazing idiot. Cloud services are NOT secure. DO NOT sacrifice your computing security, your privacy and liberty, for the latest new wiz-bang technology gizmo or feature.

Did you know that most news website's 'comments' sections obtain one's Contact list (depending on if you log in with an integrated account from facebook, windows live, google, or similar)?

Why would you want corporations and others to know who you know, all so you can use a technology feature (in this example, leaving a comment on a website, such as a foxnewsdotcom online article, or similar)??
Buster57
50%
50%
Buster57,
User Rank: Apprentice
5/1/2013 | 5:49:28 PM
re: 10 Top Password Managers
Keepass is easily the best password manager...and it's free!
<<   <   Page 5 / 5
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
To Click or Not to Click: The Answer Is Easy
Kowsik Guruswamy, Chief Technology Officer at Menlo Security,  11/14/2018
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19279
PUBLISHED: 2018-11-14
PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater.
CVE-2018-19280
PUBLISHED: 2018-11-14
Centreon 3.4.x has XSS via the resource name or macro expression of a poller macro.
CVE-2018-19281
PUBLISHED: 2018-11-14
Centreon 3.4.x allows SNMP trap SQL Injection.
CVE-2018-17960
PUBLISHED: 2018-11-14
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
CVE-2018-19278
PUBLISHED: 2018-11-14
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed lengt...