Online password managers

Question

Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the other, but what I mean is the whole idea of public service for storing personal passwords. Is it viable in its essence?

About a year ago I signed up for one of such services passpack. It seems reliable and professional but I am still afraid to start really use it and upload my numerous passwords there. And it's not because I'm not willing to upgrade to paid account. Just very careful and doubtful. Am I wrong?

Answer 1

If you're asking in theory, can such a system be built securely?
My answer would be yes, absolutely, but it's not trivial work - and most likely would be done wrong (depending on who designed and built it).

If you're asking about existing services, while I'm not familiar with the one you mentioned, in general I don't know of any good, reliable, secure systems for this.

If you're asking, how can I tell if a specific system is secure and reliable?, well, ya can't.
Unless you (or an expert you trust, and is proficient enough in the given technology) performed an in-depth code review, penetration test, and other security reviews. And periodic deployment and server examinations. And so forth...

And no, getting a 3rd party certification such as HackerSafe (not even PCI:DSS) is not good enough, not for you to entrust the keys to your most sensitive data. (Unless its a service you know well enough to trust).

Answer 2

I would recommend switching to Keepass or KeepassX for linux and put all your passwords in the one encrypted keepass database, (locked with a password or a key file) and then putting the database file into the cloud like S3 from Amazon Web Services or Dropbox. By doing this...you have a portable database file which can downloaded to any computer from the cloud and opened only by the keepass software with your decryption key/password.

Answer 3

In my opinion using a service like passpack could add another "weak ring" to your chain.

Your passwords are safe as how much paranoid you are about them (think about all the password best-practices), using a service like passpack make your passwords safe also as the whole passpack service itself (are their servers secure? the front-end? and so on..)

You should evaluate which one of these security sides you consider safer and which one you trust more. Are your password policies safe and trusty more than the security of a random password manager app? If yes, then this service may not be for you.

Answer 4

I'm using lastpass.com for quite long time. Passwords are encrypted with 256-bit AES with master password as key. Decrypting process starts in your browser. Although passwords are encrypted, getting password from server is over SSL which makes double encryption. They have 2 data center, and one backup server which is one more time encrypted. If you are scared of keyloggers (should be on public computers), there is a in-site virtual keyboard for logging with master password. One time password are also options.

Also, there is sharing accounts with other users without giving them your password.. Check it.

I'm not working for lastpass.com, just satisfied :).

Answer 5

Some points to be considered.

What are the alternatives ? IMHO using a online password manager is less risky than the following

• using the same password for all your accounts
• using a static spreadsheet that is not encrypted for storing your passwords

Collaboration. Must you share passwords ?

• Online password managers are designed to facilitate password sharing, if you're sharing passwords you must be able to easily update passwords whilst insuring that everyone sees the latest version immediately.

On the other hand Kneepass is a good solution, the problem being that you're taking on more responsibility for backups etc, whilst even though its open source there is no guarantee that there are no vulnerabilities in the code.

Answer 6

I would not consider storing my password online. Atleast I cant trust them that much .

If you are interested, roboform for windows (used it quite a time back), is good, and its newer feature comes with Online sync also. Keepassx for linux is a good tool too.