Psuedo Password Encryption

Watch:

• http://www.arthursucks.com/2011/01/md5sum-ascii-encryption/ 

You simply use 'echo -n "" | md5sum' which simply sucks. If someone uses your terminal, they can check the history and you are gone.

Another thing to note, hashing password is NOT ENCRYPTION. Encryption uses an unknown factor called a key (layman term: a password or passphrase) !

You can also make a rainbow table or in simple terms, md5 hash all the possible passwords into a table and then match the hash and see which one matches and that's the password.

What happen if you simply clean out the history of your terminal / command line ? Doesn't that mean you are done and you need to click on the 'Forget Password' link ?

Please don't use such disingenius way of 'protecting password'. Use a proper password manager that uses properly implemented cryptographic ciphers that are true and tested to withstand attacks like the AES finalists: Rijndael, Serpent and Twofish.

Hashing is always a bad way to store password. Encrypt the password with a master password is always the way to go using a properly implemented cryptographic Password Manager.

A password manager I made: PasswordStore.

PasswordStore 0.2.5 Stable

PasswordStore 0.2.5 Stable is out. 

Take a look at it at:

• https://launchpad.net/passwordstore
• https://sites.google.com/site/thothtech/product-release/passwordstore
• http://freshmeat.net/projects/passwordstore

PasswordStore have gotten a make over soon in this version and probably in the future version 0.3.

LastPass

Here's my personal take on LastPass Password Manager. I am not a user of LastPass myself but from the website, theoretical knowledge and video, I make my deductions.

LastPass Sesame Youtube Video: http://www.youtube.com/watch?v=-q-4Flnt9Hw

If you have watched the above LastPass Sesame Video, you may just end up confused by the complicated steps to simply setup LastPass sesame on your portable executable device (thumbdrives, flash storages...). You had to also use a web browser to access an email sent by LastPass to verify your setup devices and all sorts. It really is so complicated, my thought of trying LastPass sesame got put down by that video.

LastPass technology page: https://lastpass.com/whylastpass_technology.php

According to LastPass's technology page (link above), LastPass have a data centers keeping a store of your passwords and you have a local copy too. The idea of having your passwords in LastPass's hands is simply absurd. Would you trust your passwords in someone else's hands ? Anyone can claim and vow that they have encrypted your passwords and whatever in a way only you can decrypt and they can't. Anyone can vow that they don't know your master password and only you know it. I think even if it's really true, it technologically possible for LastPass to betray that trusts if they want secretly and thus putting users at a huge risks.

I am a huge advocate against leaving sensitive personal information, especially passwords, in someone's hands or servers.

For those who need solid portable password managers, you are best off having a cross-platform (better if it's Java-based) where you can simply have one running on your main desktop or work computer and the other one on your different portable devices. The password manager requires a synchronization capability where you can sync up your portable device password manager and main computer password manager. It is very inconvenient in terms where you have to keep synchronizing the password managers but at least you don't have to rely on someone's servers. You can have your password managers have different master passwords (making it hard to inflitrate all your password managers) or simply just have a single master password to all of your password managers.

PasswordStore, a password manager I built with the intend of it being portable (it's still lacking the portable and sync portion) is an interesting and useful example to review.

PasswordStore

I have attempted to create a password manager and this project, PasswordStore, is a casual password manager software project.

Look out for the latest release at: http://cid-5dddb088a8f2c7bc.skydrive.live.com/browse.aspx/Public%20Folder/PasswordStore

You would notice that the file numbers are by dates e.g. 11102009 which means 11th October 2009. It goes by DDMMYYYY format. In it, it might contain release numbers since I may make multiple releases per day.

How do you run them ? Unzip them and just double click on the 'PasswordStore.jar' file and it would run for most system with Sun Java JVM installed (Java 1.6 required !).