I have tried many keylogger software, such as key logger from http://www.paqtool.com.
However, many anti-virus software can find it. Seems http://www.paqtool.com can develop one special version for me that other software can not find it, but it is too expensive.

Anyone using Mac OS X can use the built-in Keychain application with Safari or Camino browsers (as well as many other applications). Lots of articles about password storage fail to mention this, and when they do highlight a 3rd-party product for Mac, there is no rationale given about why it may (or may not) be better than simply using the supplied Keychain feature. A cross-platform 3rd-party solution may be useful IF a common database can be used by different binaries (i.e., taking your password database from platform to platform).

another simple fix is to jyst type you username/password details into the IE/Firefox bookmark link...

The most secure password storage is between your two ears!!

Also, best practice dictates turning OFF any "AutoComplete" functionality!

@dj

Not a good idea. Doesn't give you a chance to review the status of the website and its site certificate before presenting your credentials. Not to mention how those credentials are easily accessed (in the bookmark) for anyone with physical access to the system.

Better security means less convenience!

To be honest, any online password storage could be hacked and your security compromised a sheet of paper on your desk that you lock in a safe when you leave the house is the only way, either that or memorise all the little blighters

db

PassPack is a free online password manager. It supports antiphishing, disposable-logins (anti-keylogger) and a great 1 click autologin. It is a good alternative to installed software. Have a look at http://www.youtube.com/watch?v=Zjc7syolpOE for a quick introduction.

I like having a word document on my thumb drive. It reads like a short story. However, in the story are parts to my passwords and logins such that I open it and cut-and-paste the pieces into the proper spaces on the websites. There's no typing so keystroke loggers are useless.

If someone has access to my machine then it's not my machine anymore. So that's where I worry about securing it.

Passwords are kept in as text file. There's a standard password I use, and the file just lists the variations for each site. "Usual pass, 1 for i, 0 for o,double the suffix, no prefix." I just have to know the standard password.

There is KeePass, http://keepass.info/ which encrypts your password and you can configure it with favorites URL to call up and fill out your userid/password for you. Couple this with a USB with fingerprint biometric and you can feel pretty safe from any keylogger app.

I use a handwritten cheat sheet for my passwords, except I don't write the actual password--only a cryptic clue to the password. It saves me from the frustration of getting mixed up about which password matches up with which site, and if someone comes across it, they still won't know what the actual password is.

I'm curious, though, about what is more risky--entering financial data every time I make a transaction online, such as my credit card number, or having that credit card info stored on the retailer's server, such as when Amazon.com saves credit info to make purchasing faster?

Should I opt out of retail websites "remembering" my financial information and enter it from scratch every time?

@Logical Extremes: OS X and its keychain have a number of security holes relating to its use of bundle identifiers. Some of these vulns are fixed in Leopard.

There are a lot of security people who endorse writing down passwords and putting them in your wallet. I prefer using a system like Keepass, with a strong password or two-factor, but as long the passwords aren't clearly linked to specific sites, I guess writing them in a secured location would be better than the all-too-common alternatives (writing IT down in an unsecured location and using IT for every site and application). Here's the write-down-your-passwords URL I most often receive as support for that argument:

http://www.schneier.com/blog/archives/2005/06/write_down_your.html

Ive used RoboForm for years. Works even with Vista !
Great Article.

MarvinK> There are a lot of security people who endorse writing down passwords and putting them in your wallet.

Well, really, there's one: Bruce Schneier. Others may quote him, but he is the historical promulgator of this strategy, which is why the link you receive goes to his blog.

Despite being endorsed by Mr Schneier, the strategy is based on fallacious logic. The argument is that since one is already accustomed to protecting one's wallet, it's therefore a good place to keep passwords as well because they will benefit from the protection already invested in the wallet. There are two problems with this:

1. We actually accept that our wallets might be lost or stolen. That's why we don't keep *all* our money in them, or even thousands of dollars. Just what we need, and only a few credit cards.

2. How many people can, off the top of their heads, enumerate all the passwords they would write down in this scheme? Once the wallet is lost, all those passwords have to be changed, but how do we know which ones? Obviously a copy of this list has to exist somewhere else and be kept up to date, which nullifies the argument for putting the list in the wallet in the first place.

Mr. Schneier is an extremely intelligent and interesting person, but he is not infallible.

If you wish to rely on Firefox's password storage, with or without a master password, be very cautious about what extensions (Add-ons) you install. Extensions execute in "chrome" context, like the rest of the browser GUI, which means they can do anything the browser can do: read/write local files, execute programs, and access *all* of the password information in the password storage, i.e. every URL, username, and password.

This results in two threats:

1. An extension that has a bit of malicious code in it can send your password data anywhere it pleases.

2. An extension that has a cross-site scripting (XSS) vulnerability (a bit of a misnomer in this case, but it will do) can compromise your password storage when it processes malicious content. For example, an extension might display web content in a chrome window (chrome windows are the various windows and panes outside the main browser windows in Firefox, such as toolbars and sidebars). If not written correctly, such an extension may execute malicious Javascript supplied by an attacker, in chrome context.

Really, one should be choosy about extensions even if one is not using password storage: again, they can run arbitrary code. Unfortunately, the extensions infrastructure is not well vetted security-wise, and few extensions use code-signing or even SSL to secure upgrades.

What are some people's thoughts about the sxipper Firefox extension for password management?

N Barber> What are some people's thoughts about the sxipper Firefox extension

I haven't used it, but I just downloaded the .xpi to take a look. Nearly 36000 lines of Javascript in 69 separate files. Would be a pain in the butt to do a security audit, which may mean no one ever has. Personally, I wouldn't trust it.

Curious: what does this do for you that the built-in password manager does not?

Great topic. Does anyone trust or use the Norton Internet Security 2008 "Identity Safe" to store and automatically fill in user names and passwords (and rate password strength) for the sites you choose via IE or FireFox? I keep my passwords locked in my Palm T|X, though the important ones are firmly committed to memory. The user names are stored in their complete form or stored only as a clue, depending on the site it's for. But the passwords I leave incomplete...perhaps with only the first and last characters as a reminder or some other form of a clue...unless it's for something w/o security issues, such as a discussion group or a news site. The data on my Palm is backed up to my computer. The data on the Palm itself can be encrypted using one of several algorithm choices in addition to being password protected. When it comes to using public access, I don't use public computers or wireless public access to reach sensitive sites to log onto, such as my bank...I wait until I use my own computer wired...or, if in public and wireless, I'm using a VPN.

(As an arbitrary rule I don't use the FireFox password storage...and definitely not with IE.) BTW, I've not used NIS 2008 Identity Safe to store credit card numbers...only certain passwords and usernames. The question by Sean about whether to have one's financial data stored on a company's server is a good one. Any thoughts? Any rules of thumb? It's convenient but seemingly risky, given the unknown IT security practices of various companies and the intermittent stories in the news of data loss/theft involving companies.

Though I use FF password storage, I encrypt and password protect the feature, and use an additional add-in which forces a "disconnect" after (user-configurable) 5 minutes of inactivity, thereby forcing me to properly access the storage again, even in the same session. Thus, even if I hit a rogue web site will access is denied, my information is safe. (Q: What is a good, safe time-out setting?)

As for saving my credit card information on a retailer's site - forget it. Don't rely on a third party to protect your personal information. You leave it somewhere else, it is no longer yours to control. It really does belong to the key-keeper(s).

Now to check out some of the other apps mentioned in the article and following comments...

Passwords are a cheap lock! Implementing some kind of two-factor authentication is a much more sure fire way of protecting access, plus it can help mitigate the need to change passwords as frequently. Here's a helpful link: https://secure.entrust.com/contact/index.cfm?action=wpdownload2&tpl=resources&resource=WP_Enterprise_Auth_Final_July07.pdf&id=22741

To protect my passwords, I normally refrain from having them remembered by web browsers like IE and firefox.

I also frequently remove history files and files which can be used by hackers from my computer. An easy way to accomplish this is covered in my blog:
http://evidenceeraserreview.blogspot.com/

I don't understand at all why you recommend Keepass -- it's pathetic -- on windows xp anyway. No way a basic user can install and use that piece of overly complexified crap.

I use 1Password on OSX and it's so superior to KeePass I'm shocked you would recommend it -- doesn't do what it says, on windows xp anyway. horrible. Avoid unless maybe you're a programmer.

We encourage users to analyze, comment on and even challenge washingtonpost.com's articles, blogs, reviews and multimedia features.

User reviews and comments that include profanity or personal attacks or other inappropriate comments or material will be removed from the site. Additionally, entries that are unsigned or contain "signatures" by someone other than the actual author will be removed. Finally, we will take steps to block users who violate any of our posting standards, terms of use or privacy policies or any other policies governing this site. Please review the full rules governing commentaries and discussions.