AutoHotkey Community

[toralf]

Hi,

I'm looking for an app that can store passwords and short text passages in a save format, kind of a password safe. Could someone please recomment one/two/three apps?

When I google for it, it gives too many hits. So I would like to use your experience to filter those hits.

Thanks a lot
_________________
Ciao
toralf

[Titan]

When you're looking for programs, seach for them on Download.com. There is a whole section dedicated to Security & Encryption so you should check it out.
_________________

[Laszlo]

I use Google toolbar, but other explorer toolbars also have password safes. Why don't you use AHK? It can encrypt short files fast enough. If you are after really high security, PGP is the best, because it uses all kinds of tricks to prevent Windows to write secure data to the swap file or even to get out from the processor cash.

[sosaited]

I am using PINS for saving passwords of my E-mail addresses, etc.

- Open Source.
- Uses 448bit Blowfish Algorithm.
- Can be used even if you move its directory to somewhere else.
_________________
My small "thanks" to AHK in shape of these dedicated 3d images (Topic already in "General" Forum)

[evl]

I guess it depends on what you're using it for, but the idea of storing all my user details in one place scares the **** out of me It's not unlike dangling my wallet out of my window on a piece of string (but replace string with network cable/modem cable )

[PhiLho]

I don't use one, but I know that KeePass is highly ranked in SourceForge projects.

[Guest]

That can be done in AHK, can't it?

[Laszlo]

There are pure AHK encryption solutions (RC4, Tea), others could use dll's. In case of a small file, 128-bit keys are enough, 500-bit keys are just wasting resources. The only thing AHK cannot do directly is to prevent secrets written from the processor cache to memory (when a bus analyzer can catch them on the way, and a kernel level program could read them from the RAM) or to swap to disk as part of the virtual memory (where a disk editor could access them long after its use). Especially bad is this later one: you never know if your secrets are in the clear on your disk.

In general open source is better for security, but without cache- and memory locks they are not secure against sophisticated attacks. I have not seen these locks in open source security software. Have you?

Windows can encrypt folders, files, too. Prior to XP this was not very secure, but I have not heard about serious weaknesses in the Windows XP encryption. Still, it is SW based encryption, which is vulnerable to root-kits, viruses, key loggers, etc.

The highest security is provided by hardware based encryption. Use encrypting disk drives. Seagate is shipping samples, soon you can buy them. Others offer poor solutions, like Excelstor. (Can you guess which company I work for?)

[evl]

How long does it take to crack different levels of encrption these days? I know there are distributed projects that work on various challenges and that recently various weaknesses have been talked about, like in RC5.

Regarding unencrypted data at various stages, shouldn't it be possible to never store the full password somewhere in the first place? e.g. using an edit box for each character and then reading them in turn and over-writing the previous character in memory by using the same variable?

The thing I don't like about Windows' own encryption is, as I recall, that you need to make a recovery disk to backup the necessary credentials. If your operating system dies and you need to get the encrpted files off and you don't have such a disk, you're basically screwed - I've read plenty of similar stories online of people finding this out only too late and therefore I chose to stay well clear of this, or any other method of encryption that can't be recovered simply by details known by the user (e.g. username+password). The same goes for (proprietary) hardware based encryption in a way - what happens if the hardware to unlock the data gets damaged?

[Laszlo]

[evl]

Nice, detailed reply there.

[Laszlo]

The point is that even after a key logger sniffed your Windows username and password, the data on a stolen disk is inaccessible. The whole computer has to be stolen, because each Windows installation is different, and depends on many parameters of your computer. This is the maximum we can do against a key logger.

Biometrics and tokens do enhance the security, even for stupid users, but they can be poorly implemented, too. For example, fingerprints remain on the scanner, and an intruder can copy it. Fingerprint readers should also check for vital signs, like regular blood flow (Doppler sonograph), temperature, micro movements, skin color spectrum, surface chemistry, etc. Without these, it just gives the illusion of security, but doing it right is very expensive.

It is true, Windows does not try it too hard to persuade you to back up your credentials. But, how many times did your HW broke, such that you cannot even repair the Windows installation. It did not happen to me for the last 10 years, and none of my colleagues lost data in this way. I have no exact data, but I assume less than 1% of the users are affected, and very few of them use the Windows encryption, so this does not seem to be a mass problem.

Although I could always salvage my data (SpinRite did a wonderful job), I experienced several disk crashes. (All were Fujitsu drives, of course.) To avoid the panic, I have now a small second disk in my laptop (Toshiba 5GB PC card disk). An automatic background backup program (AutoSave) keeps the last 20 versions of my work files (programs, documents, even the whole My Documents directory) on the small disk. After I set it up I don't have to worry about it. And occasionally I do make a partition image on an external disk, to save me the days of installation, configuration work, should a disaster strike. It has not.

[evl]

[toralf]

Thanks to all of you and your suggestions.

[Laszlo]

Only old versions of PGP are free, you have to pay for the best security on the market.

Try to get independent reviews on KeePass. Even if it is true, what they say on their website, there could be other holes. But for personal use, it looks OK, free and open source. Password stores of Explorer toolbars are OK, too.

It is true that even if you log-in securely in a website or in an application, malware in your PC could still steel secrets. It is a good practice to log-off when you are finished with your work, automatically un-mount secure drives after a certain period of inactivity, etc. And also have the latest security patches, virus definitions, spyware updates, and use a PC with a TPM chip.