1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Resolved Password Managers versus the Browser

Discussion in 'Security and Privacy' started by leushino, 2010/08/26.

Thread Status:
Not open for further replies.
Page 1 of 2
  1. 2010/08/26
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    Lastpass has much to recommend it, particularly in light of its ability to generate strong passwords, allow for frequent and easy changes and save all of that information in an encrypted form on their server rather than my computer. In fact, I've used it for months and recognize its strengths.

    But it does have some detractions, one of which is the fact that my information is stored out there, so to speak. I've never been fully comfortable with this idea.

    Frankly, I long for the simple days of letting my browser handle my passwords (i.e. Firefox/Chrome). Any input would be appreciated.
     
    leushino,
    #1
  2. 2010/08/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    PeteC,
    #2


  3. to hide this advert.

  4. 2010/08/27
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    Pete, thanks for the response. Isn't Roboform pretty much the same program as the Lastpass extension for Firefox?
     
    leushino,
    #3
  5. 2010/08/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    No - Roboform stores the password data on the HD - not on a remote server.
     
    PeteC,
    #4
  6. 2010/08/27
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    Well you know, Pete, I was listening recently to Steve Gibson on TWIT talking about Lastpass and trumpeting its security. Apparently he seems to have no problems with storing one's passwords on an external server as opposed to on one's own hard drive.

    May I ask you... do you use a password manager and if so, which one? If not, how do you manage your passwords?
     
    leushino,
    #5
  7. 2010/08/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    I use Roboform.
     
    PeteC,
    #6
  8. 2010/08/27
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    Not to belabor this more than needs be, is there a reason you would choose Roboform over Lastpass? Furthermore, are you choosing the paid-for or the free version of the program? Thanks.
     
    leushino,
    #7
  9. 2010/08/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    I have the paid version of Roboform and until you posted had never heard of Lastpass. I would never willingly store any of my data on the internet, especially not passwords.
     
    PeteC,
    #8
  10. 2010/08/27
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    As I mentioned, Steve Gibson (the security guru who appears on Leo Laporte's internet show once a month: TWIT) is currently trumpeting the extension/program. It's worth a read if you're unfamiliar with the program. You can read about it here:

    https://lastpass.com/

    I'm not trying to convince you of anything since I'm a bit befuddled by it all myself.
     
    leushino,
    #9
  11. 2010/08/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Sorry - no interest, I am satisfied with what I use and I wonder if Steve Gibson of Shields Up fame actually uses the program.

    As I stated before I do not believe in storing my personal info/data with a third psrty on the internet.
     
    PeteC,
    #10
  12. 2010/08/27
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    Oh... I completely understand, Pete. If I were absolutely sure of the program, I would never have posted here. I'm not trying to convince you (or anyone else) of anything. I'm just seeking to get some information from folks wiser than I.

    Instead of using a program like Roboform, what about using either Chrome's or Firefox's method of storing passwords under a master password? Would that be a reasonably secure way of handling one's passwords?
     
    leushino,
    #11
  13. 2010/08/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    That's basically what Roboform does. As a Microsoft MVP I use IE8 almost exclusively, Firefox very occasionally - also with Roboform, and have never installed Chrome.

    If you hang about there may be other responses to your initial question - so far you have my opinions only :)
     
    PeteC,
    #12
  14. 2010/08/27
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Never use the browser to store passwords. Even when encrypted, they can be retrieved using Windows APIs very easily, and decrypted. Browser form and paqssword storage is insecure, any browser.
     
    TonyT,
    #13
  15. 2010/08/27
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    The one calling himself a security guru. Do some research on the guy... and see how much he really knows about security ;)
     
    Admin.,
    #14
  16. 2010/08/27
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    Tony, what do you suggest then? It's hard enough to generate strong passwords that are different from one another throughout the many sites on which one is a member. Lastpass is an extension for Chrome, IE and FF BUT it stores your passwords (and information for form fill) on its site in encrypted form. The only thing the user needs to do is remember a single master password which even the LP folks do not know. BUT... the information is on their servers unlike Roboform which Pete mentioned. So... I repeat: what do you suggest?
     
    leushino,
    #15
  17. 2010/08/27
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    Arie, Leo Laporte seems to swear by Gibson. And we must admit that Gibson has developed some great software programs (i.e. spinrite). I can't really find anything of a negative nature in regards to his security knowledge. Can you point me in the right direction?
     
    leushino,
    #16
  18. 2010/08/27
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    If I had the time I would, but we all know how to use the Internet ;)
     
    Admin.,
    #17
  19. 2010/08/28
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Use 3rd party software as was already mentioned in this post.

    I would never store my passwords at someone else's site. I would store them at MY OWN servers, but not someone else's servers.

    What if that provider goes out of business? What happens to your passwords? Once out of business or declared bankruptcy, they are no nonger required to keep your data.

    Also, are they legally bound in any way to protect your passwords? I highly doubt it.

    I suggest you read the manuals at the various software sites such as Roboform, etc, and decide for youirself if the encryption used is strong enough for your liking. Roboform appears to be secure enough.

    However, I personally don't use any pasword managers, and I don't let my browsers save or auto fill form information. Simple reason, if I lose my laptop, or it gets stolen, anyone could then access my banking, email and other secure sites automatically. And if someone entered my home when I was not there he could do the same on my desktop computers.

    Sites such as this forum use cookies to store usernames and passwords and I use the "Remember Me" feature at Login. Sites such as this are not secure sites (like banking) and I am not concerned about such passwords.

    Leo and Gibson have one common purpose: to earn money from referrals off the software they promote. And they DO earn money from doing that.
     
    TonyT,
    #18
  20. 2010/08/28
    leushino

    leushino Well-Known Member Thread Starter

    Joined:
    2010/08/01
    Messages:
    201
    Likes Received:
    11
    Here's my understanding about the questions you raise.

    If someone were to get hold of my laptop, it would not matter since the passwords are only retrieved with a knowledge of the master password which only I know (and it's a strong one). The company addresses the issue of your question as to whether they go out of business or their servers are hacked. I would agree with you that there is no safer place than the user's brain BUT the impossibility of remembered dozens and dozens of strong passwords mitigates against that avenue. As for my banking, that is NOT kept by Lastpass. That is one site for which I keep the password myself. Below is a link to a series of FAQ many of which address some of the points you've raised.

    https://lastpass.com/support_faqs.php

    I think I've probably beaten this thing to death. I appreciate the input from everyone. I'll mark the thread as resolved. Thanks.
     
    leushino,
    #19
  21. 2010/08/28
    scout321x Contributing Member

    scout321x Inactive

    Joined:
    2002/02/23
    Messages:
    237
    Likes Received:
    3
    I'm looking at KeePass for a manager. It's open source and free. And your main password can be up to 128 characters. And even then I would not store passwords to financial web sites anywhere in a computer, mine or otherwise.

    It is bad enough to store your jewels in someone else's pocket but to do so and have no idea where that pocket is physically located is really scary!
     
    scout321x,
    #20
Page 1 of 2
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...