Passwords used to have an element of excitement and mystery: as a child you
needed one to join a secret club. They were the glamorous preserve of spies.
In today’s digital age, however, they are a pain.
Whether you’re checking your online bank account or accessing web-based
e-mails, most digital tasks now require a password - and remembering them is
a chore.
The good news is there’s a selection of software that can create or remember
passwords and can enter them automatically as needed. Some services will
also take over the monotony of online form-filling.
No password management setup is perfect - it’s a constant battle between
convenience and security - but here’s how to find the best answers.
CHOOSE WISELY
When faced with remembering multiple passwords, many people write them down or
choose the same phrase every time. The pitfall of the latter approach is
that if someone gets hold of your Facebook password, they will have access
to your bank, credit card and e-mail accounts. It’s relatively harmless to
reuse passwords on nonessential sites such as internet forums but any that
store financial details must have a unique one.
When choosing a password avoid common words or names. Hackers use software
that throws millions of these at password forms to try to unlock accounts -
a technique known as dictionary attacks. Pick passwords containing words and
numbers, with the numbers in the middle - for example, sund53aytimes. A
pet’s name, a celebrity and profanities are all guessable and should be
avoided. Microsoft offers a clear guide at tinyurl.com/2e7tmw
with a checker tool that rates the strength of your chosen password phrase.
Short on inspiration? Firefox browser software has an optional
password-creation plug-in tool (see tinyurl.com/3y782w
) while www.goodpassword.com
can take a personally memorable phrase such as “my sisters are Helen and
Rachel” and create a password out of it - for example, by using the first
letter of each word and replacing certain letters with lookalike keyboard
symbols, in this case ms@h@r.
HIDDEN WEAPONS #
It’s all well and good having dozens of complex passwords but remembering them
is a nightmare, especially those used only occasionally. All the popular web
browsers can be set up to remember and then insert usernames and passwords
onto web forms. With Internet Explorer 7, this is shown under Settings as
part of the browser’s AutoComplete function. If activated, whenever you
enter a username and password on a website, Internet Explorer will ask if it
should remember them. Firefox users should look under Tools, Options and
select the Security button. Then tick the box marked “remember passwords for
sites”.
The problem with this system is that it will work only on one computer. Switch
computers and you won’t have access to the sites unless you can remember
your passwords. Anyone else who uses your computer - family, colleagues or,
potentially, thieves - can gain access to your details.
If you are worried that Internet Explorer has saved passwords you never
intended it to or you want to wipe your slate clean, follow the instructions
at About.com’s guide to erasing stored passwords (tinyurl.com/6bk3y7
). To do this in Firefox, click the Show Passwords button and then hit
Remove All.
PASSWORD MANAGERS
A far more secure way to save passwords is with dedicated software. For
Windows, the best option is Roboform Pro (£15 from www.roboform.com
). This will store and, crucially, encrypt all your passwords, so that you
need to remember only one master password. Once the software is installed,
whenever you visit a password-protected website, Roboform will pop up and
enter the correct details. During setup it will take any passwords you have
insecurely stored in Internet Explorer and house them safely in its own
vault, while simultaneously deleting them from your web browser. A nice
touch.
Roboform’s real party piece, however, is its form-filling. Enter your personal
details once, and the next time you have to register with a website, you
click a button and your address, telephone numbers and other details are
automatically filled in. It makes the odd mistake, but performing
corrections is quick. The mobile version, called Roboform2Go (£20), stores
the software on a USB memory stick that you can take from computer to
computer.
Mac users should opt for 1Password (£17.50 from 1passwd.com
), which shares many of Roboform’s features. If you don’t want to pay, then
KeePass is a good open-source alternative (free from www.keepass.info
) but is Windows only. It’s less user-friendly than the paid-for options,
but it can also keep computer log-in details safe.
The biggest problem with password-manager software is that if you forget the
master password, you are snookered. Another downside is that the information
resides only on one computer - no good if ordering your supermarket shopping
at work and you’ve forgotten your password.
One solution to the latter problem is Clipperz (www.clipperz.com
), a free online password vault. This service can be set to automatically
log you on to your favourite websites from any computer simply by entering a
username and a master password, having told it what to remember initially.
Storing passwords with Clipperz proved straightforward, but setup was a
faff. It’s risky to store any sensitive passwords such as bank account
logins on such a site, though. If your master password is cracked, the first
you’ll know about it is when your bank account is emptied.
UNIVERSAL LOGINS
There have been many attempts to create a universal sign-in service, whereby
you register one username and password that is then shared between different
websites. The best of a bad bunch is Microsoft’s Passport, recently
rebranded as Windows Live ID (tinyurl.com/5ppjt9
). Sign up once and the same log-in gives access to Microsoft’s Hotmail and
Xbox Live online gaming services, and the travel site Expedia (www.expedia.co.uk
) among a thin selection.
A promising new universal sign-in service called OpenID (openid.net
) has received the backing of Yahoo!, Google and Microsoft. The premise is
great, but sadly many sites that claim to be OpenID compatible won’t play
ball with one another. If the kinks are ironed out, this could end the need
to register on every web-based service individually.
MOBILE PROTECTION
The arsenal of mobile gadgets in your pockets can also be better secured. The
first line of defence on a mobile phone is to create your own basic
four-digit Pin code. This can be set to protect the Sim card (to prevent
calls being made), the phone (to protect data on the handset) - or both.
Usually, the code is entered every time the device is switched on, but this is
pointless if your phone was on when it was lost or stolen. Far safer is
setting the Pin to prompt you whenever the keypad is unlocked, but who can
be bothered with that?
Smartphone owners can remotely cripple a stolen handset by sending a text
message to it if it is running Kaspersky’s Mobile Security software (£14 a
year at tinyurl.com/3umk7e ).
The software asks whoever has the phone to enter a verification code and if
this is not done the device is frozen. Newer iPods have a screen-lock Pin
code to prevent thieves from accessing music or contacts stored on the
device. See tinyurl.com/h6yte
for instructions.
