I can't state enough that I prefer my passwords to be a little more secure then this.

If the webmaster of this site is not happy with his job then I do not want my passwords sold to the highest bidder.

NO THANKS!

Coldmiser487

I've already said my opinion of storing my passwords up on someone else's website.

I would prefer my passwords to be more secure then then this. If the webmaster is unhappy with his job then my passwords are all over the Internet.

No thanks!

Coldmiser487

1password is looking to do this as well. Something about all my passwords sitting on someone else's computer on the internet makes me uneasy. Not like mine is super secure really...Then again how many internet stores have my credit card number in them? ...

*looks around nervously*

baldingnerd

Any advantage to using this over KeePass?

I moved to KeePass a few weeks ago using randomly generated passwords for everything, and yes my login details are secure as hell, but I can't login to anything because I can't remember the passwords :(

I guess what I need to do is export my passwords back out of KeePass and into Firefox Portable I have on my USB stick...

JonGold

Perhaps I spoke too quickly

Coldmiser

@Derek: if the website can decrypt it, so can the web master

Bladefist

To the above comments... you're not storing your password on their servers at all. What you are storing on their servers is one giant encrypted blob.

Derek

Why does auto login NEVER work with every single solution I try? I try 1-click auto login with this one and it doesn't work.

I have been waiting for SO long for a feature where all my firefox passwords automatically login! I must have more than a hundred passwords stored.

Does anyone know a working firefox plugin for this? I want to load up www.avsforum.com and not even have to worry about logging in. Gmail is the only website I have multiple logins anyway.

Please please please someone help me.
Is it something to do with cookies? I hate cookies.

vfreak

If you like the idea of a web-based password manager and the convenience of 1-click logins, but you would prefer an open-source solution to host on your own server try Clipperz Community Edition.

Download it here:
[www.clipperz.com]

Or try the hosted service here:
[www.clipperz.com]

mbarulli

Ok, first, like others expressed I'm not too keen on the idea of entrusting sensitive information to a third-party who swears they are not going to pull something shady.

Second, is this thing entirely open? By this, I mean 100% open-source. If not, it's a non-starter for me. It's not primarily a matter of price or even freedom, it is a matter of security. Without a community of people looking at the implementation the only thing we have to rely on is their word that they have made no mistakes in implementing their system.

lemur

I use and love PassPack. It's very convenient and they are very security conscious. I especially like the easily printable generated one time use passwords they can create for you for use when you in a less controlled environment like an internet cafe.

jdoree

@Bladefist: Generally passwords are not decrypted when you authenticate somewhere. The usual process is the password is stored as an encrypted hash and when you go to login, you enter your plaintext password which is then encrypted and the auth server compares its stored hash with the encrypted has you just sent. In other words, once the password is encrypted and stored it's never actually used in the clear on the back end.

Without further research, I don't know how their system sends the encrypted hash when a web form is expecting a cleartext hash. That concerns me.

And of course while AES is reasonably secure right now, it may not always be so. This all-your-eggs-in-one-online-basket approach is enough concern for me that I wouldn't use this for anything sensitive like financials, but I do think it's OK for non-essential things like message boards, blogs, etc...the kinds of things you should be able to use an openid on anyway!

I also think the "AES is US Gov't Approved" bit is a laugh. Plenty of government approved things have turned out to be total disasters! That claim doesn't increase my confidence.

Troy F.

Hands down the best one that I have found, and I currently use is Password Maker. [passwordmaker.org]

It doesn't store your passwords anywhere, it generates them on the fly. Plus you have a plugin for Firefox, Opera, Yahoo, Mac, or command line/online/php/javascript/desktop executable.

And it's open source to top it all off.

Will

@vfreak: Have you tried Sxipper (add-on for Firefox: [www.sxipper.com])? It's not 100%-effective, but after using it for a couple of weeks I started to like it (takes a few minutes to configure, though, and I still not totally understand how it works).

@JonGold: I love KeePass, but the major problem with it is that it is bound to a local data file, so if you want to add/check/update passwords from your home and work computers, you need to figure out how to keep data files in sync. There are options available, such as [FolderShare.com] or [who.hasfiles.com] (and more), but I personally would prefer a Web-based solution.

Regarding PassPack, it's major limitation is the limited amount of storage. For example, when I tried it first, it could only store about 100 password records. I was told that paid accounts will support more records, but I'm not sure people will be willing to pay.

As @mbarulli mentioned, Clipperz is another Web-based alternative. Once they add support for tagging (grouping) and search (both in plans), it will be very compelling to people seeking Web-based password management. I can't wait.

alekdavis

@JonGold

Keepass is also available in a portable edition for your USB stick:-
[portableapps.com]

FizzyPopMan

@mbarulli: Thanks for this! This looks interesting and is may worth a deeper investigation.

I say it again, please people, don't trust blindly such convenient solutions! Don't trust buzz-words and marketing-do-do.

@Adam, thanks for the reference to the security 'details' (it seems you read my PM ;-)). However, there is still the question how is this implemented? Just because THEY say it's secure doesn't mean it's actually true (SEE NOT WORKING AES-Harddisk: [www.heise-online.co.uk])
I know this makes writing such articles way complicater, but that's what serious journalists do...printing press-releases is not a big thing, to ask the right questions and point the fingers on stinky issues, THAT'S what I would like to see here (and great howto's of course) ;-)

Squirrel

For all your passwords in one place, there's always Yodlee. Great money management tools too!

Full disclosure: I'm an employee - and I can vouch that we have passed countless security audits from our customers and independent agencies.

calvarez

@Posco Grubb: That's exactly the reason why people should prefer trusted open-source solutions or in your case open standards (and let them show you the source code or the implementation.

Squirrel

@squirrel: Thanks for the link about the encrypted HDD... It's an interesting case of a little reverse engineering to expose false marketing.

It also goes to show that for real security, YOU, the user, really need to know how it works in order to evaluate risks and understand weaknesses. The problem is: security is really hard to get right, and the more complex our systems get, the harder it is to understand.

As an illustration: The key to my apartment door was changed a few years ago from a metal notched key to a keycard combined with a PIN. The lock unit was programmed with a hand-held unit by a uniformed facilities employee.

I know how the metal key system works and how it can be foiled. I don't know about card readers, magnetic strip cards, the hand-held configuration machine, or where my PIN is stored. Does the lock unit transmit information wirelessly? Does it have any detectable RF emissions? How does it behave when its batteries are weak? You see, there are potentially many more situations where the security can break down, even though you can't pick my lock the traditional way.

Posco Grubb

@xntrik: From an email to my beloved at home in Switzerland:

I was shocked about the banking system here. I opened a bank account by the RBC bank. They offer e-banking too. I was really surprised how insecure the whole identification system is. You just put the number from your debit-card and your password into the sign-in field, then you have to answer one of threee random questions defined by yourself (though this step is optional) and then you are already logged-in. I cannot stress enough how insecure that is. Every hacker-kiddy could hack those accounts, I could do that without any problems. And it would take only a little bit more knowledge to fake it so, that neither the bank nor the client could prove the hack, so it would seem like the client did actually log-in by himself and made the transfers (to a foreign account in a foreign country).

Even the debit- and credit-cards here are so easily fakeable. They don't have a security chip on it. I could't believe that. That means you can withdraw money from a stolen credit card without entering a pin-code and you can copy a credit- or a debit-card on a plain card very easily because there is no chip who could prevent this or make it at least much harder to do so. It's like a big sign "please steal all my money".

Coincidentally that happened to a Canadien friend 2 weeks ago. I couldn't believe how weird the bank was acting. The question is, why are the Canadien banks not following the best practice in banking security? I don't know any European bank who don't use a much more secure system (SEE THE SYSTEM MOSTLY USED IN SWITZERLAND: [www.ubs.com]). It can't be the cost, this would be like "I don't brush my teeth because toothbrushes and toothpaste is too expensive".

I'm now in Chicago and it seem US banks aren't any better than Canadiens...shocking...

Squirrel

I'd be careful with these sorts of tools, especially if you are looking to utilise them with online banking. A lot of online banking terms and conditions explicitly state that you should NOT use password tools to store your online banking password.

xntrik

More on this topic: [www.zurich.ibm.com]

Squirrel

Hello, I'm a PassPack founding parter, let me answer some questions here.

@Coldmiser: We can't read your passwords. But as I point out to anyone - the important thing is that you *use* a password manager. Some other folks pointed out alternatives that you might feel more comfortable with (Keepass is excellent).

@vfreak: We will be releasing a firefox plugin soon. In the meantime, if you have trouble training the 1 Click login button, please send me an email and I'll get that taken care of for you: support[at]passpack.com

Also, How to Use the PassPack Autologin Button.

@Bladefist: The Packing Key (which encrypts the data) never gets sent to the server, and the data itself gets to us already encrypted -- so we have no way of reading it.

I think I've answered most questions, but anyone here can feel free to email me with more tara[at]passpack.com

Tara-PassPack

Trusting a third party with some of your most sensitive personal information isn't really a good idea.
Trusting an a third party on the internet is just plain stupid.

People don't steal information by breaking encryption keys. They do it by spotting other people's mistakes, by compromising an intermediary, by being an Evil Insider, by phishing or social engineering.

You aren't trusting PassPack's technology, you are trusting their people and all of the people they work or interact with as well, both now an in the future.

robdew

with all password managers, only use them with passwords that you can afford to lose. You can use them with lifehacker or any web-forum where you have to be anonymous or semi-anonymous. But never use them for any banking or any website that links to your real identity. You can afford to lose your password to lifehacker but your bank or ebay for example.

shrini

You guys should really try out Clipperz.com

Devil

I would just never feel comfortable about giving all my passwords to someone else. Regardless of whether its encrypted or not.

fleetwood

@fleetwood: Same here. I use three passwords that I sequentially alter every few months.

1) Low level password- that's when the make you register to get access to something, get a document, download, etc.

2) Medium Level password- That's for store accounts, paypal, ebay, etc.

3) High level- banks, student loan accounts, etc.

It's something I can remember, not easily guessed, and satisfies most password requirements (at least one capital, numbers, etc.).

I guess I'm wondering why this kind of solution is needed at all?

ARP

@ARP: You'd be surprised at how many people really use the same exact password across all accounts. The only way to get them to be secure, is to offer them an easier way to get through the day.

There's a big need for a password solution. Be that PassPack, some other password manager, or even OpenID and friends.

Lots of folks are trying to solve the problem.

Tara-PassPack

As much as I heart the internet, storing my passwords on-line still seems risky to me, even with the best intentioned & honest solution providers.

Guess I'll fence-sit this a little longer.

BlogsOfSteel

I will stick with Keepass.Thank You

Sharjeel

@robdew

I agree; in ths case, the avenue for attack is the Javascript bookmarklet. The primary vulnerability may not sending encrypted passwords to the website, it's putting that simple, active code on your computer.

FWIW, I am a very happy Roboform customer. Every head-to-head review of password managers that I've seen puts RF on top; it' particularly strong with security. Windows only, unfortunately.

Alan Thomas

In regards to generating new passwords to save on your keepass, or passpack. I found a cool site that works great. www.newpass.net

Clark05

This solution is far from secure unfortunately. Not only it might be attacked through javascript (even if it needs a browser bug) but the problem is actually conceptional. Even if they use AES or whetever, it is not really strong cryptography: the key itself is derived from a password (the master password), thus the whole thing can be broken by bruteforcing the masterpassword itself which is far more easier than breaking or bruteforcing AES.

I haven't had a look at this, but this is how password stores work. (Like PasswordSafe, KeePass or my own - shameless plug - FreeSafe for mobiles).

Encrypting the passwords with a master password is a good practice to _slow down_ a data thief. If you have a strong enough master password then you'll have enough time to change all your passwords. But if you store your data on a server then you won't know if someone had access to it so the attacker will be able to try to unlock your passwords without you knowing it.

atleta

Solutions like PassPack and Clipperz seem to be using JavaScript on the client to encrypt the passwords prior to sending them to their servers. This sounds good in theory, but what if the JavaScript code is buggy or compromised? These types of applications have a big red target painted on them. I don't know if I'd trust all my passwords based on the assumption the code is working 100%.

netsec

Even though they claim to encrypt before transmitting passwords to their site, what if the encryption code is either buggy or compromised. Since they're using Ajax, I'm assuming they run Javascript on the client to do the crypto. Of course, this could happen with any e-commerce site where you transmit sensitive information, but here there's a big red target containing all your passwords.

netsec

A) There is nothing one man can make that another man can't destroy. It's a simple matter of my d12+skill vs their d12+skill. Eventually they'll win at least once.

B) Security is effectively a risk based obstacle. The more sensitive I am to the risk, the larger the obstacle I want the other guy to overcome.

Corollary: If it's easy for me, it's going to be easy for someone else too.

grgzfla

@Alan Thomas: Yes, Roboform has been around for a various years and have a strong following from long standing users (like yourself). PassPack, and online password managers in general, are new. We're here to fill the gap that offline programs like Roboform leave open: access to your stuff whenever, where ever you wish. Not everyone needs that, some people really do.

@atleta: It's not PassPack that isn't secure - it's the concept of "passwords" in general? Sure, I can agree with that. It's why we're working on adding 2 factor authentication. We already have OTPs: [tinyurl.com]

@Clark05: Both Keepass and PassPack offer a built in password generator: [tinyurl.com]

Tara-PassPack

I use and adore PassPack. OK, so all my private data stored on one server, which could technically be decrypted.

But what's the alternative?
* Remember the passwords: only possible if you use the same password on every site. Hmmm.
* Something like RoboForm: good, but how do you make it work on another computer?
* Build your own: for most of us, totally not secure.

If you wanted to make it extra secure here's an idea: include a two-character string in the same place in every password BUT don't include it when you type it in PassPack. It will stop the one-click feature working, but you can still copy, paste and edit.

Anybody here from an ultra-secure environment who can advise other methods?

blowski

While I am wary about putting my passwords on someone elses server, and would love a solution of this sort. I am a little more inclined to try a service like this out. As the very first comment suggests, many of us already have our financial information stored on some web server. Not only at e-stores, but the financial/banking sites themselves. We don't know how any of these sites works or what they do to protect our information.

I do have one issue with Passpack, it does not seem to be open source so the back end can't be checked out for any funny business. But, like I said earlier we don't know what any of the other trusted sites are doing either. I also took a look at Clipperz from the suggestion of other commenters. And Clipperz is open source which makes it a little more attractive. It also allows you to set the server up yourself, so then everything is stored on your server. I think Clipperz may be the way to go.

One suggestion for Passpack though. If they plan to go commercial with this webapp they might want to give their users a sense of security by having their site tested by companies like scanalert, verisign, and truste.

pjharris