Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It's so difficult to track dozens of passwords in different locations. Syncing fails from time to time and you end up with collision correction avoidance syndrome.

Is there a single source of safe, online, commercial password storage anywhere? One that will be around for years to come and one that is truly safe enough to ensure protection?

share|improve this question
1  
Do you mean most secure or one that causes the least amount of issues? –  ojblass Jun 23 '09 at 3:20
    
Online == not available sometimes when you need it. Stick to a PDA or something. –  womble Jun 23 '09 at 4:31
    
'Online = not available' is likely less of an issue than relying on a PDA to be available. (I just can't get in the habit of carrying one.) –  Darian Miller Jun 24 '09 at 4:10
    
How about Online==reproducible with a little memory and a computer? (i.e. hashing one or two passwords with the domains the accounts belong to) –  reconbot Jul 16 '09 at 14:28

15 Answers 15

up vote 11 down vote accepted

Use keypass and store the database in gmail, live mesh, or what ever online file storrage solution you want. Then you can always get a copy of it for use assuming you have access to keypass which can be on a flash drive and an internet connection.

share|improve this answer
    
This is the solution I'm working at now and was wondering if there's something better. –  Darian Miller Jun 24 '09 at 4:13
    
(+1 right now... will be the answer if no other ideas pop up) Thanks –  Darian Miller Jun 24 '09 at 4:15
    
+1, works for us. –  RainyRat Oct 28 '09 at 23:58

If you are really set on an online model, a few of my coworkers use Passpack, and they are pretty happy with it. I can't say yea or nay, because I don't use it, but it seems pretty secure and safe.

share|improve this answer
    
+1 Thanks. I've seen this awhile back and it peeked my interest, but never felt comfortable enough to 'pull the trigger' and load up all passwords onto a free service. –  Darian Miller Jun 24 '09 at 4:20

I've found LastPass to be a wonderful password manager for my personal passwords. Check out the feature list.

I'm still on a quest for the best (yet affordable) enterprise worthy password manager.

share|improve this answer
1  
How's this decision looking two years later? –  jldugger May 5 '11 at 20:15
    
Still happily using LastPass for my personal secure information manager. Felt even better about it after Steve Gibson gave his approval ( twit.tv/sn256 ). Sadly, no movement (internally) on the enterprise solution.... –  Nathan Hartley May 11 '11 at 15:56
1  
LastPass has an enterprise version now. No idea how it is (but I'm looking at it soon, we could use such a thing). –  Ronald Pottol Dec 4 '12 at 21:07

I wouldn't use one online. I would (and do ) use KeePass. On a side note you can check your passwords rough strength here

share|improve this answer
1  
+1 KeePass is good, though not quite as convenient as something like KWallet or Firefox's builtin password manager... but I fully agree with the point that passwords should be kept locally and privately, not stored on a website (unless you created the website code yourself and are hosting it on your own server that nobody else has access to) –  David Z Jun 23 '09 at 6:00
    
he asked for an "online" service. –  CD1 Jun 24 '09 at 2:27
    
Keepass, in conjunction with live mesh or other online storage, such as Jared suggested is an option. I haven't used KeePass but will take a look. (I've used e-Wallet for years.) Thanks. –  Darian Miller Jun 24 '09 at 4:18
    
@cd1- I realize Darian was asking for an online service but I can't in good conscience reccomand anyone store passwords in something they they don't have physical control over. Every IT type (non-troublshooting) question should be (IMHO) evaluated with the thought that even if possible is it the best solution to the intended goal. I suppose the answer could have just been "No" but that wouldn't have been very informative. –  Jim B Jun 24 '09 at 15:41

Bruce Schneier has Password Safe, which is secure enough for Bruce Schneier to endorse, if you care. It might be Windows only though. http://www.schneier.com/passsafe.html

share|improve this answer
1  
There's a java version available for download that should work anywhere. I keep a copy on my USB key. –  pgs Jun 23 '09 at 16:37
    
I keep a copy of mine in my dropbox account. –  reconbot Jul 15 '09 at 19:15

I wouldn't advise using an online service as well. You have no guarantee that your data isn't accessible to others. If you're on a linux system, try Revelation, simple and straight-forward

share|improve this answer

SuperGenPass might be your answer. It doesn't store anything, can be used from any browser, no accounts needed. It works by hashing a "master" password with the top two levels of the domain. I've chatted with the creator, he's a friendly guy.

From their site:

SuperGenPass is a different kind of password manager. Instead of storing your passwords on your hard disk or online—where they are vulnerable to theft and data loss—SuperGenPass uses a hash algorithm to transform a master password into unique, complex passwords for the Web sites you visit. There’s no software to install: SuperGenPass is a bookmarklet and runs right in your Web browser. And since it never stores or transmits your passwords, it’s ideal for use on multiple and public computers. It’s also completely free.

Being javascript it's had plenty of code review, It has a bookmarklet that's worked perfectly on 99% of the sites I've tried it on, and the occasional time it hasn't you can easily use the mobile version and copy and paste.

share|improve this answer

1Password is great (but then if you are a mac user you might be ok with just a keychain)

share|improve this answer

The simpler the system, the better.

Consider a password system that consists of:

  1. a strong master password
  2. a unique id for each site

So, given your master password is very long, fast to type and not found in any dictionary (e.g. Very12%Long91!Password86#EasilyTyped) the password you use at example.com would be a hash of a hash of Very12%Long91!Password86#EasilyTyped+example.com

$ echo -n 'Very12%Long91!Password86#EasilyTyped+example.com' | sha1
7d123b486ece9841879135562125d3317e7d4436
$ echo -n 7d123b486ece9841879135562125d3317e7d4436 | sha1
5a19c98f66fc82e6af85b8bcf341734b6c44a8d6

There are browser extensions that can help you with this. It's slightly annoying to use this system on non-web systems that don't offer to remember passwords and you have to invent a scheme in case someone makes you change passwords every so often.

Of course, you can only enter your master password on trustworthy terminals.

share|improve this answer
    
It seems to me that using Hashes as password would greatly reduce the password 'space'... –  S19N Feb 22 '12 at 14:01
    
How do you figure? –  Alex Holst Feb 23 '12 at 22:20

I also like and use KeePass - the free version.

share|improve this answer

Gpg encrypted text file stored in version control. Use a couple of scripts to decrypt/encrypt the file as desired. You control the availablity of the file, you can use distributed version control to still have access when you're offline, and how long it will be available is determined by you (i.e. it is easy to switch to different systems if required). Gpg also has the advantage of being able to encrypt to multiple recipients, allowing more than one person to view the password file. Encrypt different files to different recipients to limit who can access credentials for a certain group.

share|improve this answer

Have a look at Yubico's Yubikey; it sounds like it might be what you're looking for. A Yubikey connected to a MacBook

http://yubico.com/products/yubikey/

It's default (i.e., designed) configuration is to be used as a one-time pad for two-factor authentication online, but it also has a "static password" mode which will output (the same) 64 pseudo-random characters when a little green capacitative circle is touched. Works as a USB keyboard so it's universal and works even offline. The random string static password can be changed any time.

A little over 30 $ and arrives in a regular 30 gram envelope (which I thought was too cool to be true) and in no time flat.

Honestly, all the tricks of keeping an encrypted file on a USB key are at once a massive hassle and mostly unecessary. All you need is a password with reasonable entropy that you can't easily guess or bruteforce. Enter Yubikey.

I'm developing some OTP online authentication applications with their API; it's pretty neat, actually. I can vouch for its physical sturdyness, too.

Clarification: I offered this as an alternative to online password storage, especially as it's API based and can be used online. Though, it could also act as a replacement for multiple passwords, if you were comfortable with that.

share|improve this answer
2  
YubiKeys are great, but you still need an authentication server and a useful application that talks to the authentication server to make it do anything of value. –  Nathan Hartley Jul 15 '09 at 15:06
1  
+1 @nathan this is true, sadly, though you do have a long password, at least, which is good. –  msanford Jul 15 '09 at 18:36
1  
I've been meaning to play with one for a long while now, I just ordered one thanks to you. –  reconbot Jul 16 '09 at 14:29
    
@wizard, too bad they don't have a referral program ^_^ Really, though, I think you'll enjoy the Yubikey 2. I'm going to order one shortly to test it out. –  msanford Jul 17 '09 at 4:21

This isn't an answer to your question, but it is related - the execs at Twitter just had their Google accounts broken into, exposing a bunch of confidential information about the company.

I'll assume that Twitter is a much bigger target than you are, so that certainly had something to do with the break-in. I also don't think this incident rules out cloud computing completely. However, ANY online password service is a big target. Passwords are too important to store online.

share|improve this answer

I'd be hesitant to store my sensitive information with an external company. Have you considering implementing a web-based product yourself; you can then make it externally facing if you wish, making it accessible from anywhere.

share|improve this answer

I recently created a system that can store passwords online and safe. The site is: http://allekalleprojects.net/onlinepasswords

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.