Passwords, Passwords Everywhere…

Passwords, passwords everywhere, but nary a place or method to keep them secure?

Most humans can’t keep more than a few important pieces of information in their brains for long periods of time, such as a password. I know I can’t keep more than a few “good” passwords in memory for more than a few weeks — the more passwords I have, the shorter I tend to remember them. Also, I tend to have a “good” password that I use for important things (like bank websites), which gets rotated every so often, and a “not-so-good” password that I use for less secure things that are much less important (like web forums). The problem is, the more places I use these different passwords, the more difficult it becomes to keep track of which is which, what the passwords are, and how often I need to change them.

Back in 2003, I found a good solution to the problem. Password Manager runs as a standalone Java application that encrypts into a file of all of my passwords, usernames, addresses, and other odd things that I need to remember but not write down. Four years ago, I had the idea that I could run Password Manager directly from my 64MB USB keychain. This way, I could run the application and have access to all of my passwords, etc. anywhere Java was installed — Windows, Linux, etc. With its very small footprint (~400KB), I could keep every password, keycode, and secret that I could think of on a USB device that lived in my pocket and access it via the nearest computer just by plugging it into a USB port and lauching the application. Considering that the application encrypts all of its data into a file controlled by one “master” password, its safe even if I lose the USB keychain — if I lost the device that held my information, I’d no longer have the information, but no one else would either since nobody else knows my “master” password to unlock the data.

This worked quite well for a long time — four years, to be exact — until I discovered something a bit better.

Clipperz.com is a website, but unlike most websites in that it provides a very specific service in a well thought out manner. The Clipperz website is essentially one gigantic JavaScript that keeps things that you need to remember in a secure fashion; a password manager. However, its also a bit more than that…

On Clipperz, you can create what they term as “direct logins” such that the service directs your web browser to the login page of a site and enters your credentials for you automatically. This basically turns the service into a rudimentary “single sign-on” portal. Just log into Clipperz with your username/password, and you’ll have access to all your favorite websites without having to remember or change your password for them. You can also create highly customized entries for things not even connected to a website — like a combination to a lock, or personal information you need handy.

The beauty of Clipperz is that, while it is a “secure” website with the appropriate SSL/TLS certificates and accessible via httpS, the service never actually keeps your data. Each piece of information you enter to be stored is encrypted by your web browser before it is transmitted to the service. This way, if things at Clipperz get dark and someone compromises their database, the intruder gets a bunch of encrypted information he/she doesn’t necessarily know what to do with.

So, what about my USB key with the Java application?

Well, it was somewhat of a pain to plug in the USB device, navigate my way to the directory the program lives, launch the Java application, wait for it to start, open its encrypted database, be prompted to enter the master password, and then finally locate the secret that I needed to remember. Yes, the process takes about 2 minutes, tops, but that’s mainly a Java limitation of the systems that I usually use.

Clipperz has the ability to store an “offline version” that is read-only. Basically, it loads all my secret data into a file with its JavaScript and images, saves the file as an encrypted set of data that I can copy onto my USB stick. VERY handy, because even if I’m “offline”, I can load the file into a web browser, type in my master password and have access to my data in less than half the time of launching a Java application. The file is secure, so the risks are the same as with the Java program — lose the USB stick, and I don’t have access to the data but nobody else does either.

Clipperz claims to have a few new things on the horizon, such as the ability to “share secrets with family members and associates”. For the life of me, I can’t imagine any circumstance where someone would need to do this, but there’s the option coming soon…

One more pro for Clipperz (and con for Password Manager): you can review the source code for Clipperz at any time, while Password Manager is free no one other than the developer may review the source code.

About this entry

You’re currently reading “Passwords, Passwords Everywhere…”, an entry on Paranoid Linux Ninja Geek

Published:: 12.05.07 / 8pm

Category:: philosophy, security, tech

Tags:

Post Navigation:: « Photo sharing, storing, archiving (cont’d)
Virtually Nifty, Thrifty and… Swifty »

Argo 12.08.07 / 3am

Hi. I prefer Passpack to Clipperz.
Passpack uses AES 256-bit with host-proof-hosting pattern as Clipperz, but offers more functionality. For example, Passpack supports import/export, backup/restore, a full functional offline version, anti-phishing mechanism, quick-search, tags. Moreover, its 1-click login works contestually to the site and improve my user experience. What do you think about?

Marco Barulli 12.08.07 / 8am

Dear Dave,
thanks for your kind words about Clipperz.

A new release featuring import, export and more is due this week.

Thanks again,
Marco
Clipperz co-founder

Paranoid Linux Ninja Geek

Recent Posts

Categories

Archives

Passwords, Passwords Everywhere…

Comments are closed

Badges

Stats

Blogroll

Meta