Tag: security
5 Tools for Keeping Track of Your Passwords
by Ranju Chaudhary on Oct.09, 2010, under Latest Web Technologies
Time and time again, we’re warned of the importance of having strong, secure online passwords. Phishing scams — where legitimate looking e-mails and websites try to trick you into entering in your sensitive login information to a bank site, e-mail host or social network — are bad enough when a scammer is able to compromise your account, but the result can be many times worse if you use that same password for a number of online accounts.
Likewise, when crackers breach servers for various web services and expose the user information to other ne’er-do-wells, your accounts could be at the fate of many shady characters.
That’s why it’s more important than ever to use strong, secure and unique passwords for each of your online accounts. Of course, that sounds great in theory, but the main reason we often reuse the same password or passphrase is because trying to remember 50 different logins, each with various alphanumeric strings, is just not realistic.
Fortunately, there are some great tools and services available to users to not only keep your passwords secure, but to also make them accessible and usable from multiple computers or web browsers. Here are five of my favorites.
1. 1Password ()
1Password from Agile Web Solutions is my favorite way to manage, create and securely access my passwords from a Mac, iPhone, iPad or Android () device. The program is $39.95 (a family license for 5 users is available for $59.95) but you can install it on as many of your own computers as you want. It’s a great way to create and fill-in passwords across the web.
The application has plugins for all the major web browsers — Safari (), Firefox () and Chrome (), and you can also pull up your passwords from the application itself. The app works like this:
When you’re on a website and you create a new account, 1Password will prompt you to save that account to its database. In the future, rather than having to type it in manually or rely on your browser’s built-in manager, you can just use 1Password to automatically fill in your username and password data.
Even better, 1Password includes a truly fantastic password generator that lets you create robust passwords of a length that you choose. You can generate a password for an account and then automatically save it.
1Password saves all of your passwords and login information into its own secure database that is stored on your computer, but where 1Password really shines is with its ability to sync with Dropbox (). Dropbox is a free service that lets you keep a cloud copy of anything within the Dropbox folder on your desktop. That folder is then accessible across computers and devices. Any change to that folder is synced across every connected computer. 1Password can use Dropbox to store its secure database, which means that if you use multiple Macs or want to have constant syncing on the iPhone, iPad or Android, you can.
1Password has a beta version of its app available for Windows. Like the Mac app, the Windows () version can connect to a Dropbox account and sync its database with other platforms.
1Password can even store other form information like credit cards, address information, server logins for your website and software serial numbers.
2. LastPass
LastPass () is a very popular cross-platform password manager that stores all of its data in the cloud. It works on Windows and Mac and in every major web browser. Like 1Password, LastPass can automatically save your logins, help you generate safe and secure passwords and automatically fill in your passwords when you visit a site.
The difference is that instead of storing its database on your computer or in Dropbox, it’s all stored on LastPass’s servers. LastPass actually has a really robust set of security around your data and if its center is compromised, your data still can’t be accessed.
LastPass is free to use but for $12 a year, you can gain access to LastPass’s many mobile apps (including iPhone, BlackBerry and Android) and gain access to priority support. It also means you get to skip any advertisements.
3. KeePass and KeePassX
KeePass and KeePassX () (which is KeePass but for Mac or Linux ()) is a free, open-source password manager. It works very much like 1Password, in that the database is stored on your local computer. Like 1Password, you can use Dropbox to keep KeePass synced across machines and profiles.
KeePass can run off a USB drive, which makes it a great choice for users who frequently work on different machines but don’t want to leave any of their personal data on those machines.
KeePass isn’t as user-friendly as LastPass or 1Password, but its dedicated userbase loves it because it can be extended and used in a variety of ways. Plus, it’s free.
4. RoboForm
RoboForm is very similar to 1Password, but it’s just for Windows users. It works with Internet Explorer (), Firefox, Google Chrome () and with Safari and Opera () via a bookmarklet.
RoboForm also has mobile apps for Android, iPhone, BlackBerry and Symbian. Like KeePass, you can even run it off of a USB drive, which is great for users who want a way to keep their passwords with them and use RoboForm on various computers they use, but don’t want to have to install a program on each of those computers.
You can also use RoboForm with Dropbox, which makes using it across machines that much easier. RoboForm is $29.95 for a single-user/computer license and you can get RoboForm with two computer licenses for $39.95.
5. Firefox Sync
Formerly known as Mozilla Weave, Firefox Sync is a plugin for Firefox 3.5/3.6 that will also be an integrated feature in the upcoming Firefox 4. Firefox Sync is a pretty cool concept and it takes a slightly different approach to password management and syncing from the other tools in this list.
Firefox Sync securely syncs and protects your passwords, bookmarks and browser tabs (you can choose to sync all or none of these items). When you login to another computer with Firefox on it, you can just login to Sync and have access to your existing data and even pull up tabs that are open on your other computer. When you log out, all of that information disappears.
Sync also has iPhone and Android apps so you can bring your tabs over to those mobile devices. The upcoming Firefox Mobile for MeeGo and Android will let you access your passwords securely and remotely as well.
By being built into the browser, Sync is a great way for Firefox users to keep track of their passwords. Because it is part of Firefox, Firefox Sync is really designed for people who use Firefox as their primary web browser. If you use Google Chrome, Internet Explorer or Safari, you’ll want to look at the other options listed above.
Do you use a password manager or syncing tool? Let us know in the comments and also share any of your best password tips.
Update: Several readers in the comments mentioned Passpack, a tool that’s really great for sharing and keeping track of passwords for teams and groups.
“Here You Have” E-mail Virus Clogs Corporate Inboxes
by Ranju Chaudhary on Sep.11, 2010, under Latest Web Technologies
An e-mail virus, dubbed “Here You Have” because of its subject line, has reportedly infected corporate networks of major companies like AIG, Procter & Gamble, Comcast, Disney and even Google since Thursday.
The virus is actually a mass-mailing worm reminiscent of old-school attacks from the early 2000s. It targets corporate networks and then lures users into clicking on a link to a purported PDF file or WMV movie. Instead of a work file, the worm is actually malware that attempts to gain access of your computer and send itself to everyone in your address book.
According to Joe Stewart from the security firm SecureWorks, the virus may have ties to a Libyan hacker who goes by the handle “iraq_resistance.”
Stewart says he found the username “iraq_resistance” referenced in the code of the malware and that the handle has links to Libya. It has purportedly been involved in minor website attacks over the last few years. It appears that this user’s group, “Brigades of Tariq ibn Ziyad,” wants to engage in some sort of electronic jihad.
Despite the speed at which the virus has spread across corporate networks, the unsophisticated nature of the attack lessens the likelihood of any extensive damage. Sophos is reporting that the files linked in the original e-mails no longer exist, but variations of this worm may still be active.
What this really underscores is just how bad even basic security policies are at even large corporations. Beyond anti-virus, heuristics and firewalls, this attack has ultimately spread as fast as it has because users have clicked on the files.
Have we learned nothing from the “Anna Kournikova” and “love letter” attacks from yesteryear? If a file looks strange or it is something you aren’t expecting, contact the sender before opening it up. Especially if you are on a corporate network.
