Is your head in the cloud about passwords? [ARTICLE]

The Internet is becoming so ubiquitous that it’s more important than ever to choose secure passwords and more smartly manage them. Online shopping is on the rise and web-based applications are expanding. Plus, the Internet is no longer something we only use on home- or work-based computers. It is, or may soon become, part of e-readers, mobile devices, vehicles, kiosks, phones and more.

A few months ago, an article about KeePass encouraged noobies to create and store impossible-to-guess passwords. KeePass is a great, free service that can help protect your private information, but one downside for some people is that it requires access to physical storage space, such as a hard drive or memory sticks, to store passwords.

Where are your passwords?

With so many places and ways to access the Internet, storing passwords in a single, physical location may be limiting. And, if you lose the computer or memory stick your passwords are stored, there are no recovery options. You’ll lose access to all those online accounts, and your loss may be someone else’s gain.

So, why not just store passwords where you use them: on the Internet? In techie terms, this is called storing passwords “in the cloud.” The information isn’t physically located in a single place; instead, it is highly encrypted and exists across multiple servers maintained throughout the world.

What do techies think?

There are several Web-based applications designed to store and encrypt your passwords “in the cloud” so you can access from any Internet connection. But, if you can access it, doesn’t that mean other people can too? How safe is it to store passwords “in the cloud?”

Here is a slightly edited version of how some “techies” weighed in on the issue. Recently, Mr. Noobie^®, aka Patric Welch, posted on Facebook a question asking, “Does anyone use a cloud-based password manager?”

C. Theisen: I just signed up for https://www.xmarks.com today. I mainly did it for a bookmark manager but came with password storage as well
M. Smith: Does “being in the clouds” on what the correct password is for different sites count? Call me conservative, but I do not trust anything online involving password storage without Lifelock or a similar service.
J. Burk: I’m with you, PT, I’m not ready to commit to a cloud-based password manager. Probably overly conservative on my part since I do everything else online.
J. Bean: I use Roboform which syncs and backs-up online. Does that count?
C. Theisen: If anyone has ever purchased something online it’s no different.
P. Welch: @Chris – true but at least when you buy something online they only have one of your passwords. I use a different password for every site.
C. Theisen: This is true but I don’t see a huge issue with it. Anyone can get to any info they want online if they want it bad enough. It does make it easier if it’s all in one local but I’m not worrying about it. Yet ;)
P. Welch: @Chris – Great feedback. Thanks!
C. Theisen: Not a problem. It was funny you posted that cause I signed up for Xmarks on the same day. Now what would be really cool is if a service like Xmarks or Roboform would allow you to have 1 password for their site but randomizes your password on sites such as Facebook etc. obviously there would have to be some deal in place with fb and other sites to accept the randomized Roboform password as your password would change each time but its a possibility.
J. Bean: Roboform will create a very difficult and randomized password for you that’s only tied to your master password for access. Pretty sure it won’t change it every visit to the site though.
C. Theisen: That’s really cool Jason. I will check that out.

What insurance do you have?

Technically, using a web-based password manager that stores your information in the cloud should be as safe as making an online purchase with your credit card. The difference is that most credit card companies protect holders from identity theft, but your self-selected passwords offer no insurance.

One solution is to invest in identity theft protection for your Internet activity. Lifelock is an affordable option that proactively scans the Internet to look for illicit use of your personal information. Their services help protect you from accidental disclosure of personal information from your personal computer and other computers that may store your personal information or participate in peer-to-peer file-sharing.

Is it safe to store passwords in the cloud?

If you like the idea of having highly secure passwords that you, and you alone, can easily access from any Internet connection (i.e. “the cloud”), make sure you choose a reputable service. Experienced techies like the free, “Secure Sync” feature available from Xmarks, which currently only works with Firefox 3, as well as the feature-rich Roboform that works only on PC-based browsers.

Both these options require you to remember a master password or pin to get access to the super secure, randomly generated, impossible-to-guess passwords. Think of it this way: if you are using the same password for all your online accounts right now, then this will require about the same amount of brain space while helping you take a giant leap forward in online security.