PasswordMaker :: Reviews :: Add-ons for Firefox

Rated 5 out of 5 stars

by icerob on Jan. 3, 2010 · permalink

Seems pretty awesome to me. Improves both usability and security.

This review is for a previous version of the add-on (1.7.3).

Rated 5 out of 5 stars

by K Mitchnik on Dec. 3, 2009 · permalink

A security problem with Firefox's password manager is that its kept locally, albeit secured, together with a username and its URL. Thus, the file can be copied, the encrypted files extracted, and because no limits can be imposed on examining a file, brute force decryption methods can be made indefinitely until a master password is found, such as with the freeware program, FireMaster. As more financial institutions go online, the benefit for the work involved makes it increasingly more lucrative for a professional hacker, and the losses great for a user. A simple way to insure best security is to generate an NSA or NIST quality password that is never stored, but used as needed, and that some way can be made to easily remember such as password.

This app does such a thing reliably, including using variables to increasingly confound the password, while still maintaining ease in remembering a password. The program is very flexible and covers many possible ways to use a master password, username and password combination, but with a price, its requires one to read the manual in detail to understand what is being done and what the many fields, and options, that are available in this app.

For a simple general use, this app has a basic mode, which uses a strong cipher generator. But many older websites limit the total characters for a password, or only take alphanumerics, or a limited number of symbols, and few allow the full unicode set including international characters. Thus, the basic mode can generate unsupported passwords for a particular site. If one customized websites as needed, the user has to remember specific customizations for each websites unless its exported in a configuration file that is then uploaded to a 'secret' location to be used on other computers elsewhere.

Luckily, I've found a way to use this app with limited customization that's easy to rmember.

Users should know that many password generator apps do not generate passwords that would not meet standards set by NIST document SP800-63V1_0_2.pdf or reduce their security by storing important local variables with FireFox. Many apps also do not specify which hash algorithm was used to create their passwords, and thus, its not pedigreed by the quality of documentation and analysis given such algorithm. One also cannot be sure if a truly secure hash was implemented properly, or that a backdoor has been built into the application somewhere.

So far, PasswordMaker passes my muster and appears to be one of the most secure methods for making quality passwords. It suffers a tad from its rich but very tech laden, user interface that could use a little more cosmetics to appeal to general users. Its fine for me.

This review is for a previous version of the add-on (1.7.3).

Rated 5 out of 5 stars

by kwutchak on Aug. 26, 2009 · permalink

PasswordMaker is usually the first add on I install when I set up a new browser. I'm so rapt by the way it provides easy high security authentication that I insist my wife and mother use it.

I wouldn't be without it!

This review is for a previous version of the add-on (1.7.3).

Rated 5 out of 5 stars

by L Davis on July 13, 2009 · permalink

This is an absolute must for me. I have like 50+ internet accounts, all with secure passwords. All I have to do is remember one master password. There are other password tools and generators that are perhaps more popular, but NONE so powerful as this one.

The level of control over password generation is unparalleled, bar none! And yet, it's so easy to use. You can create groups, and within those groups, you can have accounts -- each with specific parameters regarding that particular password. You can specify pretty much every aspect of the password: the length, the character set, whether to auto-populate, any modifiers to hash in, l33t level, l33t usage before and/or after password generation, any prefixes and/or suffixes, username, and hash method. I mean, what more could ask? If you don't want that level of control over each password, you can specify global settings and have at it.

Once the password is generated, it will show you the relative strength of the generated password (and this, my friends, is key). You can also specify auto-complete fields. Other password extensions don't do any of that.

TIPS I have found helpful:
1. hold ALT and press the ` key (left of the number 1) -- this activates the CoolKey and fills in all password fields

2. changing the character set order, can change the password

3. you can export your settings -- in case your computer dies, or you have more than one computer, or more than one OS

4. because you can create accounts, I use it for non-net accounts

This is really the most sophisticated password extension available. There are many features I haven't even touched. This extension is for net novices AND net know-it-alls alike.