Password Management with PasswordSafe
by William Lynch - Senior Consultant for CTG's Information Security Services Practice - Monday, 10 January 2005.
Everyone is aware that selecting passwords wisely and safeguarding them should be an important priority, yet most people need to remember so many passwords that it's nearly impossible to do so. Because of the need to recall dozens of passwords and keep up with their rotation many people are forced to use insecure shortcuts such as storing passwords in an unencrypted file or overusing the same password on many systems. PasswordSafe is one solution to the problem.

PasswordSafe is intended to be a secure solution for maintaining a list of passwords. It uses a secure, encrypted database to store each password and can only be accessed by providing the master password. Originally developed by Bruce Schneier's Counterpane Labs it is now developed and administered by Jim Russell and Rony Shapiro as a SourceForge project. PasswordSafe can be downloaded here.

How is PasswordSafe more secure than storing passwords in a text file or database? All passwords within the database (called a safe) are encrypted using the Blowfish algorithm, also developed by Bruce Schneier, which has so far proven to be unbreakable. Provided a secure master password, referred to as the combination, has been chosen for the safe, no one should be able to decrypt the passwords stored within the safe, even if they obtain a copy of the file. For this reason, it is imperative to choose a strong master password. For guidance in selecting the master password, refer to Eric Wolfram's "How to Pick a Safe Password". Take caution to never lose or forget the combination (master password) for any safe. PasswordSafe intentionally has no way to recover a lost combination, because doing so would compromise its security.

Getting started with PasswordSafe

First, download and install the latest version of PasswordSafe which is available for all Windows platforms, including WinCE. For Linux users, there is a forked version (from the old 1.x series) called MyPasswordSafe available here, but its use is beyond the scope of this article.

The first time PasswordSafe is started, the following dialog appears:

Select "Create new database" and a prompt for the master password appears.

Weak passwords are discouraged with the following prompt.

If this prompt appears, a different master password should be created.

The newly created safe looks like this:

To create a new entry choose "Add Entry" from the Edit menu.

The password above has been created using the Random Password generator button on the right.

A prompt will appear asking if the default username should be the one supplied for the first entry.

Once the entry has been created it will show up in the safe.


Most IT pros have seen potentially embarrassing information about their colleagues

More than three-quarters of IT professionals have seen and kept secret potentially embarrassing information about their colleagues, according to new research conducted by AlienVault.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Feb 10th