Originally Posted by
Visconti
RE: Key Loggers - I'm using a program to manage all of my password. It's called 1Password, and if I recall, a Canadian company? Anyway, I think I've read they claimed key loggers are rendered ineffective when using the program in its native environment. I have noticed that after pasting a password, it clears the clipboard shortly afterwards, though even prior to using this program, I've always manually cleared it.
Thanks again for your insights on this. It's very helpful, and greatly apprecaited.
No worries.
Regarding keyloggers... 1Password is a Canadian company, but don't let that necessarily encourage you. Let's deal with the keylogging first. Key loggers usually just record the physical keys used. The reason you've been told they can be rendered ineffective is because of this. If you copy/paste your password (or in some apps, hotkey or use memory resident functions) they only see copy and paste. Here's the rub though. If your app stores the password in a local file and your system gets compromised (AND they know which app you use), it is possible to still steal your password(s)... They just need to copy your password file from your computer and they already have your master password. A bit of paranoia for sure, but still something to be aware of. If your passwords are kept in the cloud, in theory, they should be safe (if the claims of encryption are to be believed), however, you won't have access if you are offline (I mention this because you could have locally encrypted files being managed such as excel or word files).
There are ways to mitigate the issues of both methodologies, but it's a balance between convenience and security that you have to decide on your own which you subscribe to.
Now, back to the companies. Most commercial password companies use analytical software and it's been raised that there are some privacy issues with most of them.
LastPass was used as an example... they had seven components that gathered data on its users. I forget which one, but there was another popular password manager that had something like 11 components... It doesn't matter where they're from (as technically all countries have some sort of law that could force a company to give up at least some information about its users), but it could be a concern...