Password Tools - Invalidate Banks T's and C's

StevieJ

Stompa wrote: »

But how do you know which relates to what? Or perhaps you don't have many entries?

I have about 15 sensitive that I recognise but couldn't remember in full (I access them fairly frequently), I know which is which, I have countless other none sensitive that I keep separate and write down what they are.

Stompa

StevieJ wrote: »

I have about 15 sensitive that I recognise but couldn't remember in full (I access them fairly frequently), I know which is which, I have countless other none sensitive that I keep separate and write down what they are.

OK, these days I tend to use completely random passwords, of the maximum length and complexity allowed, there's no way I'd be able to recognise which was which!

nicko33

masonic wrote: »

Added layers of security can't protect the data when you unencrypt it to use it and that's when the data is at risk.

That's not the only time the data is at risk though.

Added layers of security can protect your data in cases of,
e.g., your house is burgled and your computer is stolen
or if you keep your passwords on a USB memory stick and lose it

masonic

nicko33 wrote: »

That's not the only time the data is at risk though.

Added layers of security can protect your data in cases of,
e.g., your house is burgled and your computer is stolen
or if you keep your passwords on a USB memory stick and lose it

If there is a feasible risk to your data in the event someone gets physical access to it, then it's time to choose a different product or a stronger master password. As I stated above, there is of course a benefit, but it's negligible. AES-256 encryption, which the best tools use, with a sufficiently complex key is computationally infeasible to crack. Adding more encryption on top of that is like adding a third or fourth lock to your front door.

Undisputedtruth

masonic wrote: »

If there is a feasible risk to your data in the event someone gets physical access to it, then it's time to choose a different product or a stronger master password. As I stated above, there is of course a benefit, but it's negligible. AES-256 encryption, which the best tools use, with a sufficiently complex key is computationally infeasible to crack. Adding more encryption on top of that is like adding a third or fourth lock to your front door.

I agree.

I would also suggest using some of the password manager's functionalities to prevent compromises caused by keyloggers and Trojans. My own firewall helps to remove the threat of keyloggers. Even creating a new VM each time to use a password manager is the ultimate security for those willing to take matters to the extreme.

oldfella

Even creating a new VM each time to use a password manager is the ultimate security for those willing to take matters to the extreme.

---

not extreme - its easy and worthwhile - have a look at Linux Slax

Undisputedtruth

Here's another example of internal fraud.

http://www.id-theftprotect.com/news.php?news_id=594&news_keyword=barclays

More reason for using password managers.

Warning: I don't endorsed the website and product services. The purpose of the link is to illustrate banks' internal fraud problem.

Regards

masonic

Undisputedtruth wrote: »

Here's another example of internal fraud.

http://www.id-theftprotect.com/news.php?news_id=594&news_keyword=barclays

More reason for using password managers.

I'm not sure how those two statements tie together? Would use of a password manager have prevented this Barclays employee obtaining the customer details? ...and don't Barclays now have some sort of debit card reader that they insist their customers use to log in to online banking?

I also noticed that article was published in September 2008, and the fraud actually took place 5 years earlier, in 2003. Let's hope some lessons were learned back then.

Undisputedtruth

masonic wrote: »

I'm not sure how those two statements tie together? Would use of a password manager have prevented this Barclays employee obtaining the customer details? ...and don't Barclays now have some sort of debit card reader that they insist their customers use to log in to online banking?

No, the use of password managers would not have prevented the fraud mentioned in the article. The point where I argued in another post is that most people tend to use the same password for all their accounts. Therefore, if an internal staff manages to get hold of your password and pass it on to someone else to access your account details held by another bank then I suspect it would make the situation even more difficult for the bank to detect internal fraud. In this event they'll more likely to blame the customer for divulging the password.

masonic wrote: »

I also noticed that article was published in September 2008, and the fraud actually took place 5 years earlier, in 2003. Let's hope some lessons were learned back then.

Probably not, banks have always had problems with internal fraud just as retailers have problems with their staff stealing.

masonic

Undisputedtruth wrote: »

No, the use of password managers would not have prevented the fraud mentioned in the article. The point where I argued in another post is that most people tend to use the same password for all their accounts. Therefore, if an internal staff manages to get hold of your password and pass it on to someone else to access your account details held by another bank then I suspect it would make the situation even more difficult for the bank to detect internal fraud.

Perhaps, although most banks I have dealt with kept internet banking credentials completely separate from the security questions asked by bank staff and made a big point of telling people not to divulge them to anyone, even the bank. The login process at each bank seems to be somewhat unique and inflexible, so it's hard to imagine 'shared password syndrome' striking in this situation - though the people who are likely to be targetted by bank employees would have a lot to lose in the original account.

Of course, not knowing your internet banking password means that you can't give it to anyone, which is where I guess a password manager does hold some value.