Tired of entering your username and password every time you check your webmail or logon to your favorite online vendor's site? I was, but I knew that storing usernames and passwords in my web browser was incredibly insecure.
If you don't believe me, do a web search. There are dozens of free tools that will reveal passwords stored in Internet Explorer and other browsers. That's why I started looking for a third-party password manager.
One of my favorite features in
Norton Internet Security 2009 is the Identity Safe, which allows you to store passwords securely on your local hard drive. Unfortunately, synchronizing the contents of Identity Safe on multiple computers can be time-consuming. Furthermore, stored usernames and passwords aren't available when you work on computers you don't own.
LastPass, however, does much the same thing as Norton's Identity Safe, but it stores the information online, so you can access it over the Internet.
Setting up LastPass takes two steps. First, you create an online account by providing an email address and creating a master password. Next, you download a small program that installs the appropriate add-in for Internet Explorer and/or Mozilla Firefox.
Thereafter, whenever you submit a new username/password combination, LastPass asks whether you want to save the information. The next time you visit the site, a notification bar appears automatically with the appropriate options. You logon with a simple click.
Since the logon process is automated, you don't have to use easy-to-remember passwords. In fact, the software will even generate so-called "strong passwords" for you. Strong passwords are usually eight or more characters, consisting of upper and lower case alphabetic, numeric, and non-alphanumeric characters. "Weak passwords" are pet names, the names of children or grandchildren, birthdays, or anything else that's easy to guess.
All data is encrypted locally, which means only encrypted information is stored on the LastPass' online servers or travels across the Internet. Actually, it's double-encrypted. The information is scrambled locally using super-secure AES, and the locally-encrypted data is transmitted using SSL, just like online credit card transactions.
The company stresses that you, and only you, know the master decryption key (password), so you'd better not forget it! Lastpass cannot unlock your data, no matter what. If you forget your master password, your storage vault will be lost, and you'll have to start over.
If your Internet connection drops or LastPass' servers go offline, you're not up the creek. The locally-stored password information will remain available, you just won't be able to add new information or change passwords until connectivity is restored.
As an added bonus, the software also auto-fill forms, supplying your name, address, telephone numbers, credit card numbers, and other personal information as needed. Again, you can be assured this information is secure, as long as your master password isn't compromised.
LastPass says it plans to sell advertising on the service's password management web interface, so the basic version is free. The software currently supports Internet Explorer (on Windows) and Mozilla Firefox (on Windows and other platforms), but versions for other browsers, such as Safari, are in the works.
If you want an ad-free management interface or more features, you can opt for
Premium LastPass, which also includes support for iPhone, BlackBerry, Windows Mobile, and Android; multi factor authentication using USB thumb drives; priority email and emergency phone support, and other features, all for only $12 a year. Visit
LastPass.com for more information.
Other password managers, such as
RoboForm and
TurboPasswords, usually aren't free. If there's a free version, there's a usually a catch, such as a limit on the number of logon accounts. The free, basic version of LastPass has no strings, so it's worth a try. If you're not convinced, at least stop storing passwords in your web browser!
A lousy economy is the worst time to be lax about security. There's always a surge of scams and schemes when unemployment is on the rise. A password manager might not save the fort, but it's a good start.
