What Do I Think about Password Manager Applications?

A classmate from high school (yes, I know, that was a long time ago.  But I know it wasn't as long ago as some of you out there, now is it?) asked me a question based on my last blog post.  My classmate was wondering what I thought about password manager applications that are out there on the World Wide Interwebs.  I asked her if I could ruminate for a little while on that.

Truth is I'm afraid I am a bit of a neo-Luddite as I mentioned before.  I actually write down my passwords in a little Moleskin notebook which I don't keep anywhere near any of my computers.  I generally keep the password book locked up in a lockbox I have hidden at home or it is always on my person (usually in my backpack under layers of stuff that no one else really wants to go through).  However, I do know where it is at all times and up to now it works for me.

But maybe I really should change that attitude a bit.  I'm getting old and these hands are starting to cramp up sometimes.  Luckily they stay in exercise on a regular basis typing on keyboards, but there are twinges sometimes.  I probably should start keeping password and other information safe somewhere that I can't easily lose and I don't have to use my ugly handwriting.

So, what is a password manager application?  Well, it's exactly what is says to be for the most part.  You can keep your passwords in it.  But you can usually store other information as well, like information on your credit cards, important business cards, information on your personal documents, etc.  Pretty much anything you can think of can go into the manager application.  There's usually some templates in the application that have specific fields for you to enter the information as well as a catch-all to allow you to add in information that does not fit in a particular category.  There are versions for the PC, Mac, Android, iOS, Linux, UNIX, and probably any other system out there.

So, do you need one?  Well, that's up to you.  Do you need a secure location that you can access quickly to get information on a particular credit card or you need you ATM password you've forgotten for the umpteenth time?  Sounds like a good reason to me to get it.  Just be careful.

Remember that a password manager is a program like any other.  Any program can be modified.  A program's security can be cracked.  You're only as safe as the encryption that exists on the program.  But don't let that scare you off, OK?

One good thing about most password manager applications is that it will have utility built-in that will help you generate random strong passwords.  mSecure, for instance, has a utility that will generate a random string of ten to thirty characters (depending on the length you want to use.  Remember, you want as long as possible) with different character types.  The only thing I would add would be to allow you to start the password with a letter.  A lot of applications out there don't like it if you start a password with a number or special character.

You need to take the time and research which one is right for you.  There are tons of free ones, free ones which are really tryout versions to get you to buy the application, and paid applications.  Whichever one you want to try is up to you.

My suggestion (and there are really ONLY my suggestions!) are this:

1. Do the research.  Already mentioned that.  'Nuff said.
2. Make sure whatever program you decide to get, make sure it has the strongest encryption possible.  Encryption is the part of the program that is going to hide the data by making it unreadable.  That encryption really needs to be tough to crack to protect your passwords!  My suggestion is that you make sure the program uses AES256 or 256-bit Blowfish, which is the federal government's encryption standard and has been very successful since it was developed several years ago.
3. Don't be a cheapskate.  Pay the money for the program.  A lot of the free or trail versions are probably good and will do the job.  But honestly, this IS your digital life you're trying to protect.  If the paid version has some additional features that will secure you data I would go for it and pay for the full version. 
4. Make sure you put a strong password on that password manager application.  If you don't put a strong password on your password manager the hacker won't need to break the encryption.  He'll already be in your password manager.

Some of the programs out there require you to have an Internet connection and store your passwords online ("in the cloud").  This way you can access your passwords from anywhere from any device you have the application or can access them through a web page interface.  I don't know how comfortable I am with that sort of thing.  That's just one more place a hacker can attempt to break somehow.  I would hope that whoever wrote/maintains your password manager software has some really good risk mitigation techniques onboard to protect their investment and your online passwords.

I will I could have been more helpful, but at this point I don't have an opinion one way or another on password manager applications.  I'll update this once I do more research if I have any better ideas.

mSecure Password Manager