Password Management

• Speed. Getting a password was a bit of a production. This usally entailed:
  1. wait for Disk Copy to launch
  2. click on the "enter password" window (since it never gets keyboard focus automatically [for security reasons, I'm told]).
  3. enter my password
  4. wait for Disk Copy to finish the mount and quit
  5. open the file in BBEdit

  I know about the 10.2 alias-to-file-on-an-unmounted-disk-image trick. It's a cool trick, but seems to be fatally flawed when dealing with encrypted disk images. Specifically, I'd attempt to open the alias in either the Finder or DragThing. While the image would successfully mount, some code deep in the bowels of the Alias Manager would fail to notice. Instead, it would wait forever, requiring me to force-quit the process.

  This was particularly hard on DragThing, as force quitting it left its preferences file open, and would refuse to subsquently relaunch. Eventually, I'd have to restart the entire computer if I wanted to use DragThing again. James has since fixed this in 4.6.1, but the entire affair is still rather nasty.

• Insecurity. Once opened, all my passwords would appear on-screen in plaintext, ripe for shoulder-surfing. Now, all my passwords are rather hard to break (I use a script to generate random 16-digit alphanumeric strings), but I'm surrounded by enough Really Smart People with photographic memories that this is a valid security concern.

I view the Keychain built-into Mac OS X as being fine for holding relatively unimportant stuff, like my SourceForge login. However, I don't trust it for really important stuff, like root passwords for clients' deployed ecommerce boxes.

I toyed with rolling my own paranoid password manager, but fortunately I remembered Sanford Selznick's PasswordWallet. PasswordWallet doesn't show your passwords on-screen by default, and will even "type" them into another app for you, so the password doesn't even have to roundtrip the clipboard. In addition, there's a Palm version. You can access and add new passwords anywhere!

Oh, and if you intend to try out PasswordWallet under Panther Developer Preview, first remove the trademark symbol from its name prior to launching. It won't launch otherwise. Bug filed.

Wednesday, July 16, 2003
08:29 PM