Comments on: Do Not Use Your Browser As A Password Manager

By: Digitivity

Digitivity — Fri, 05 Feb 2010 08:51:37 +0000

What are you using for full disk encryption? (and what OS)?

By: Digitivity

Digitivity — Fri, 05 Feb 2010 08:45:30 +0000

I keep most of my passwords in a text file.

You can then encrypt that file with various tools (but keep it unencrypted when you’re logged on).

I do, however, let the browser cache the passwords. If it loses the passwords, I can just re-enter them from my passwords file.

One thing I don’t do is try to memorize passwords.

By: dav

dav — Fri, 18 Sep 2009 10:01:52 +0000

I use Billeo to manage my passwords which is VeriSign secured and TRUSTe certified. https://addons.mozilla.org/en-US/firefox/addon/12715 It’s a great password manager and a real time saver. It securely saves my passwords and I can easily edit or delete them anytime.

By: scopy

scopy — Wed, 22 Jul 2009 21:17:39 +0000

Security to some is extremely important especially were money and sensitive information is concerned. Using a third party solution that encrypts and can be on usb stick just seems like common sense.

full disk encryption as Phil M mentioned seems like a good idea.

By: Phil M

Phil M — Wed, 22 Jul 2009 18:32:33 +0000

Hmm!

You can curtail the security arguments by using full disk encryption – that way if the laptop / HDD is stolen your passwords are trash.

AFAIK all browsers essentially wall off the password storage area from the web renderer, ensuring that a browser exploit cannot access your saved passwords, in much the same way that a program running under a sandbox can’t actually touch the base OS. I know IE8, FF3 and Opera implement such a solution.

Inbuilt browser password managers are great (I find) as they are seamless. Have you used Opera’s wand? Once you’ve used that you’d be hard pressed to use any other third party solution

By: scopy

scopy — Wed, 22 Jul 2009 08:35:26 +0000

Using your browser as your password manager is not advisable. (Thanks Jason) I have never done used the facility. Basically i don’t know how it works and if the data is encrypted and at what level.

Its a shame that the browsers themselves do not make it clearer how secure the data will be.

By: eli

eli — Tue, 21 Jul 2009 13:54:31 +0000

I use Opera as my primary browser at work and home. And yes, I know it’s not the safest thing in the world, but darn it all I think that magic wand is far and away THE BEST password solution available for convenience and speed. One thing I do is include my wand password data file, and bookmarks, as part of my regular backups. This doesn’t solve the security issue, but its kept me from losing my passwords over several reinstalls of my OS.

By: Stu

Stu — Mon, 20 Jul 2009 19:36:55 +0000

I am also in the process of getting them all into KeePass! But it’s taking a while …

Currently I have 409 passwords stored in FF. Many are also recorded in an openoffice text file, the rest are basically throwaways for those one time log-ins and are mostly memorized or rebuildable since I have a formula for making them in the first place. However, using the add-on Password Exporter, https://addons.mozilla.org/en-US/firefox/addon/2848 , I’ve also saved them all in a .csv that loads nicely into a OOo spreadsheet. And everything is frequently and reduntantly backed up.

By: sinaisix

sinaisix — Mon, 20 Jul 2009 16:46:19 +0000

hi. Nice tip. I really like your posts which i hardly miss. This post really was very helpful. BTW, i have link of your site on my blog. Just my small way of saying thanks.

By: Bryan Price

Bryan Price — Mon, 20 Jul 2009 01:04:08 +0000

KeePass I find to be kludgy. Don’t ask me why, I’ve tried it, and I just never cared for it.

That said, since I run multiple computers, even multiple versions of Firefox (3.0 (now 3.5 release), Shiretoko (3.5 nightly builds) and Minefield (3.6alpha nightly builds), I use Xmarks to sync not only the passwords but the bookmarks as well. And if I get really paranoid, I can use my own server instead of their server. And it can even work with IE (not that I’ve actually tried that myself).