FAQ

From PasswordMaker

Revision as of 19:13, 29 August 2007 by Tanstaafl (Talk | contribs)
Jump to: navigation, search

Contents

If someone gets my master password, can't he determine all of my generated passwords?

No. There are ten other variables he would need for each account. They are:

  • URL
  • character set
  • which of nine hash algorithms was used
  • date counter (if any)
  • username (if any)
  • password length
  • password prefix (if any)
  • password suffix (if any)
  • which of nine l33t-speak levels was used
  • when l33t-speak was applied (if at all)

Probably the most interesting of these is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

Can someone "unscramble" my generated passwords to determine my master password?

This is a common complaint heard about hashed-based password systems (for example, see page two of A Convenient Method for Securely Managing Passwords). The complaint simply doesn't hold water with PasswordMaker because PasswordMaker adds nine other variables not used in the traditional password=master+url formula. Those nine variables create an enormous search space which would take thousands of years to search, even using a distributed network of one million modern PCs. The nine variables are:

  • character set
  • which of nine hash algorithms was used
  • date counter (if any)
  • username (if any)
  • password length
  • password prefix (if any)
  • password suffix (if any)
  • which of nine l33t-speak levels was used
  • when l33t-speak was applied (if at all)

Of course, the URLs of the sites must also be known since they are used in password calculation. Probably the most interesting of these variables is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

Where is my master password stored?

Nowhere, unless you choose the option Store Master Password on disk and in memory (encrypted). If you choose this option, your master password is stored using 256-bit strong encryption in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, look here. For further protection you can instruct your operating system to encrypt passwordmaker.rdf. Instructions on how to do this with Windows XP/2000/NT are here. Instructions for Mac OS/X Tiger are here.

Where are the generated passwords stored?

Nowhere. The generated passwords are calculated on-the-fly as they are needed. The RAM used to store and calculate the generated passwords is proactively cleared to prevent passwords from being stored in a swap file/virtual memory/paging file.

Where is account information and other settings stored?

Everything is stored in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, look here.

How do I know PasswordMaker isn't sending my passwords to you without my knowledge?

Although you can read the source code to determine this for yourself, there's an easier way. Install a packet sniffer and use PasswordMaker to generate some passwords. You won't see any traffic to or from PasswordMaker -- ever. It never connects to the internet. Two popular packet sniffers are snort (for Unix/Linux/OSX) and ipInterceptor (for Windows). Both tools reveal *all* network traffic, not just HTTP.

I want PasswordMaker to automatically populate webpage forms for me, but I don't want to change my password on some sites. Is PasswordMaker still a good choice?

Yes. You can take advantage of PasswordMaker's other features (such as form completion) while still choosing your own passwords. Simply create an account in Advanced Options, set the password prefix to your current password, password length to the length of your current password, and check Auto-populate username and password fields for sites that contain this URL. Note: password prefixes are saved to disk unencrypted. An upcoming version will have a better solution for passwords you don't want to change.

Personal tools