John Beynon

So we’re all guilty of it – we have one favorite password (or hopefully a selection of passwords) that we use around various sites for our  email, IM clients, twitter, facebook etc etc. If we’re not guilty of this crime – our wives, girlfriends, partners, family members, friends certainly will be! I’ve never been comfortable with this method – sure it’s convenient but in these times we need to be ever more aware of protecting our online identity.

As a result of this weeks FLOSS which had Eric Jung author of FoxyProxy on the show, he also spoke about his other tool PasswordMaker which really attracted my attention.

PasswordMaker does exactly what it says on the tin, makes passwords. It exists in a variety of formats, a Firefox extension, an OSX desktop widget, an online version (with code available as download) and many more! But where PasswordMaker differs is that it will generate you a complex password for each site/resource you visit and you don’t need to store them anywhere – you only need to remember one password – “One password to rule them all!”

It works by taking your master password along with the address of a website (usually just the domain bit or any other string) and generating you a complex password using a one way hash – it will generate the same password every time if you enter the same master password, account settings and address/text string so you don’t ever need to store the generated passwords, you simply regenerate them each time – and with the multitude of methods available to generate passwords it’s made really simple. There are many different encryption algorithms to choose from, password lengths, password characters so provided you use the same settings whenever you want to retrieve your password then you’ll always get the same password returned.

The Firefox extension makes it really simple – on clicking the icon you are presented with a screen to enter your master password, the ‘using text’ field will have been prefilled with the domain of the site (configurable to use subdomain, query string etc too via options) you are visiting. Once you enter your master password, the extension will generate a password which you can copy to the clipboard and use it from there – it even clears it after a set amount of time.

Should you need to generate a password for say MSN, then you can override the address with a simple string of text say ‘msnmessenger’ which will then be used to produce a password for you – equally server logins, FTP accounts, DB connections – provided you have a master password and a memorable unique identifier for the thing being secured then it will work for you – provided you can accept a minor inconvenience to have to enter your master password each time you need to use it.

It’s really worth checking out! Why not try it on a few sites and set how you get on…surely being safer on the internet is worth a little inconvenience?

ps If you have room for another podcast then add FLOSS to your pod catcher – it stands for Free Libre Open Source Software.

No related posts.