Password manager

A password manager is a computer program that allows users to store and manage their passwords for local applications or online services such as  web applications, online shops or social media.

Password managers can generate passwords and fill online forms. Password managers may exist as a mix of: computer applications, mobile applications, or as web browser extensions. 

A password manager may assist in generating passwords, storing passwords, usually in an encrypted database. Aside from passwords, these applications may also store data such as credit card information, addresses, and frequent flyer information.

The main purpose of password managers is to alleviate a cyber-security phenomenon known as password fatigue, where an end-user can become overwhelmed from remembering multiple passwords for multiple services and which password is used for what service.

Password managers typically require a user to create and remember one "master" password to unlock and access all information stored in the application. Password managers may choose to integrate multi-factor authentication through fingerprints, or through facial recognition software. Although, this is not required to use the application/browser extension.

Password managers may be installed on a computer or mobile device as an application or as a browser extension.

History 

The first password manager software designed to securely store passwords was Password Safe created by Bruce Schneier, which was released as a free utility on September 5, 1997.  Designed for Microsoft Windows 95, Password Safe used Schneier's Blowfish algorithm to encrypt passwords and other sensitive data. Although Password Safe was released as a free utility, due to U.S. cryptography export restrictions in place at the time, only U.S. and Canadian citizens and permanent residents were initially allowed to download it.

Criticisms

Vulnerabilities
Some applications store passwords as an unencrypted file, leaving the passwords easily accessible to malware or people attempted to steal personal information.

Some password managers require a user-selected master password or passphrase to form the key used to encrypt passwords stored for the application to read. The security of this approach depends on the strength of the chosen password (which may be guessed through malware), and also that the passphrase itself is never stored locally where a malicious program or individual could read it. A compromised master password renders all of the protected passwords vulnerable, meaning that a single point of entry can compromise the confidentiality of sensitive information.

As with password authentication techniques, key logging or acoustic cryptanalysis may be used to guess or copy the "master password". Some password managers attempt to use virtual keyboards to reduce this risk  – though this is still vulnerable to key loggers that take the keystrokes and send what key was pressed to the person/people trying to access confidential information.

Some password managers may include a password generator. Generated passwords may be guessable if the password manager uses a weak method of randomly generating a "seed" that all passwords generated by this program. Or, as in the case of LastPass, the methods used to generate passwords may become compromised, leading to passwords generated by the application being easier to guess.

Furthermore, password managers have the disadvantage that any potential malicious individual or malware would just need to know one password to gain access to all of a user's passwords and that such managers have standardized locations and ways of storing passwords which can be exploited by malware. This is known as a single point of failure.

Blocking of password managers

Various high-profile websites have attempted to block password managers, often backing down when publicly challenged. Reasons cited have included protecting against automated attacks, protecting against phishing, blocking malware, or simply denying compatibility. The Trusteer client security software from IBM features explicit options to block password managers.

Such blocking has been criticized by information security professionals as making users less secure. The typical blocking implementation involves setting autocomplete='off' on the relevant password web form. Consequently, this option is now ignored from Internet Explorer 11 on encrypted sites, Firefox 38, Chrome 34, and in Safari from about 7.0.2.

A 2014 paper from researcher at the Carnegie Mellon University found that whilst browsers refuse to autofill if the protocol on the current login page is different from the protocol at the time the password was saved, some password managers would insecurely fill in passwords for the unsecured (HTTP) version of encrypted (HTTPS) site passwords. Most managers did not protect against iframe and redirection based attacks and exposed additional passwords where password synchronization had been used between multiple devices.

See also 
 List of password managers
 Password fatigue
 Password management
 Security token
 Smart card
 Cryptography

References

External links
 

Password authentication
 
Identity management