Managers Your guts - Our glory. j.dowley@hotmail.com

Transcription

1 Password Managers Your guts - Our glory Jeff Dowley j.dowley@hotmail.com

2 Overview Password managers Meant to aid you in keeping track of the dozens or even hundreds of passwords you may have Most browsers (IE, FF, Opera, Chrome) now include at least some the basics for tracking and completing passwords for your online activities Also meant to aid you in associating particular identities you may have for those same passwords

3 What is meant by identities? Jeff Dowley And a dozen more! What other attributes might an identity have? Shipping address Account numbers Credit cards Etc

4 Can be one of 3 varieties: Local - your PC desktop (or other local drive) Portable - on a mobile (PDA, smart phone), or flash device (USB, etc) Web based - stored in the 'cloud' man

5 Ways that password databases can store your data Insecure - default settings in FF and IE Weak - encrypt only the passwords or have only a master password for an otherwise unencrypted database Moderate - encrypt the data and the database, but use weak hashing algorithm Strong - encrypt with a strong algorithm (two fish, blowfish, etc) Crazy strong - encrypt both with a strong algorithm and a key (sort of two factor authentication)

6 Password managers can also be used as a defense against phishing. Unlike human beings, a password manager program, which can handle automated login script is not susceptible to visual imitations and look alike websites. With this built-in advantage, the use of a password manager is beneficial even if the user only has a few passwords to remember.

7 However not all password managers can automatically handle the more complex login procedures imposed by many banking websites. bit

8 But wait there's more You may also want to associate some of those attributes with forms you have to fill out on the web Ta-da! Enter the form field filler functionality for fun There are some caveats with form filling Not all web sites associate the needed data type (address) with the human viewable 'blank address box' to be filled in If the web site uses scripts to present and capture the data, then the form filler may fail to be fully compatible depending on the scripting language used

9 If the form to be filled in is really being served by web site B on website A's page, then you may be warned about the possible security risks, and then again you may not when you'd like to be! Most web browsers can do some of the form filling for you without even using any 3rd party software or plug-ins And then there are the aforementioned plug-ins or add-ons or toolbars that can aid the browser in completing forms

10 Since you are building a database of what your ID's and passwords are, then you might as well consider keeping even non-computing related data in this 1 secure application You can use the notes field in most safes to create entries es for your bank card or shopping car PIN numbers You could keep track of affiliation cards (rewards programs) and other non-online information

11 But there's more You may want to backup the database with a paper copy to be kept in a safe or safe-deposit box So, the right software will also aid you if you need to re-import that data or if you are bringing your data from another similar application Then there's keeping the password database safe from being sniffed on whatever pc you are using at the time Ex: using a public computer at a library

12 Solution: keep your database on a USB/flash drive and use it in a mode that stores no data on the host PC 2nd advantage - should not require installation, keeping less trace of your information altogether You may want to 'go portable' so that you can always have your db on-hand, and thus work regardless of what PC you are using from day to day You might want to consider saving your db on the net "in the cloud" so that it is accessible everywhere

13 What are the risks and gotcha's KeyPass runs in manual mode and does NOT offer to auto-fill login credentials Roboform does fill in forms Password Safe is a blend of manual and mouse ready to fill in forms You could always forget your main password and really be up a creek

14 There are major disadvantages to an online password manager if it is not utilizing Hostproof Hosting. If you use an online password manager that doesn't use a Host-proof Hosting design the passwords (including the master password) are sent over the network, from which they may be copied unnoticeably during transit, and are stored on server computers using software and hardware over which the password owner has no control and from which the protected passwords might be obtainable by an attacker.

15 Do NOT confuse password-safe safe.net or.com for passwordsafe.sf.net What are some Password Safe products KeePass Uses Schneier's Password Safe souce code Is OSS and freeware Supports plug-ins that help pyou make the tool custom to your needs Import and export utilities KeeForm -? KeeFox -? Twofish Cipher

16 Perhaps use Roboform free for simple web site forum registrations or other low-risk sites Use KeePass or Password Safe for higher security sites (banking, /identity sites)

17 A quick Demo of KeePass v2 The End