How safe are password managers?

[JDArt]

You know--the add-on programs (including those in browsers) that remember all your passwords...are these safe? How does the user know that these passwords aren't being "passed" on to someone over the Internet?

[FatNakedGuy]

I really like this site... Hashapass

pick a master password (something you will always remember) and then change the parameter password for each thing you need a unique password for.

[cman78]

Most of the time you don't know if someone else is storing them or capturing them. Especially if you enter them on someone else's web page. I wouldn't recommend ever using them. Your brain is the most secure password manager.

[Rense]

I don't use them for the reason cma78 mentioned.
I'm using a hidden double protected truecrypt file on my desktop and the same file on a secured U3 smartdisk

[cman78]

Originally Posted by Rense

I don't use them for the reason cma78 mentioned.
I'm using a hidden double protected truecrypt file on my desktop and the same file on a secured U3 smartdisk

You must spread some reputation before giving it to Rense again. That TrueCrypt is awesome at least on paper. I will be testing it out this weekend. I have been looking for something for our mobile users for laptop encryption.

[Rense]

not really on paper, but also in practice! Please test it, along with USBagent.
This program automatically starts up truecrypt.

[TonyK]

I have been using Passwords Plus from DataViz since 2005. Started with the Windows version and moved to Mac recently. Downside is it is a Palm OS device only application with OS X or Windows client apps. If you have s Windows smart phone you won't have the information with you.

A benefit is the Blowfish encryption employed.

[JDArt]

Originally Posted by cman78

Most of the time you don't know if someone else is storing them or capturing them.

That's my worry. If you're using a password manager, who's to say that it isn't some spyware that's capturing your passwords over the Internet?

[TonyK]

Depends on the company and your security. from my experience Passwords Plus from DataViz was up and up and did not backdoor anything. Some folks have used BigCroc, another password manager.

I would NEVER use anything soley on the web and nothing that I did not pay for, at least for storing confidential information.

Take care,

[dmrowley]

I am a big fan of Roboform

RoboForm: Password Manager, Form Filler, Password Management

It integrates with your browser, and you just need to remember one password.

There is a demo version that is free to use up to something like 10 passwords, then they ask for $$. I paid and have been very happy with it.

Cheers

[Songman45]

I would have thought naivity about computers was coming to an end. I guess there are still people who think they are winning video games too. There is no such thing as total security in a computer and especially one connected to the internet. Once again, we rely on the word of experts and the reputation of a company without knowing our selves what is going on. You might be surprised at the amount of data that flows out of your computer. Passowrds, even stong encripted ones are user interfaces that make you feel good. When you maintain them on a machine you cannot say with any degree of certaintly how safe they are.

[ah-photography]

Originally Posted by Songman45

I would have thought naivity about computers was coming to an end. I guess there are still people who think they are winning video games too. There is no such thing as total security in a computer and especially one connected to the internet. Once again, we rely on the word of experts and the reputation of a company without knowing our selves what is going on. You might be surprised at the amount of data that flows out of your computer. Passowrds, even stong encripted ones are user interfaces that make you feel good. When you maintain them on a machine you cannot say with any degree of certaintly how safe they are.

Well said!, a key principle of computer security is "defense in depth"; don't rely on one thing. A password manager [any] is worth squat if you're not running a firewall, anti-virus, anti-spyware and keeping upto date with patches

[Epphoto]

I use Norton password manager for 4 years NOW and i love it