up vote 2 down vote favorite
share [g+] share [fb]

As most people here, I have a couple of accounts out there (over 300 last time I looked). I consolidated a few with OpenID but not every site supports them. I also use password managers and safes but all those solutions leave something to be desired. Which led me to the following idea: Can I use my mobile phone as a "security" device?

It has an independent keyboard, it can connect to my computer via USB, etc. Is there any software (like a plug-in for Firefox) that allows to fill in passwords from a mobile phone or, even better, work something like OpenID (no passwords involved but the master password on the mobile device)?

Note: This question is not about security issues with mobile phones (easy to steal, etc) nor is it about security bugs in OSs for mobile phones and I'm also not interested in Firefox Sync and the like. I really would like to replace all "gimme password" dialogs with pressing a button on my mobile phone.

link|improve this question
57% accept rate
What kind of phone is it? – Sebastian Paaske Tørholm Feb 4 '11 at 12:50
It's a Nokia N90 but I'm willing to buy a new one. So treat this as "not limited to any specific device by me" – Aaron Digulla Feb 4 '11 at 12:53
1  
try lastpass if you haven't already. its ruddy brilliant. – Sirex Feb 4 '11 at 13:06
feedback

3 Answers

up vote 2 down vote

[Disclosure: I work for RIM as a software developer in the BlackBerry Security group. I'm speaking as myself, not as a rep of RIM… I use this app all the time and find it quite handy.]

BlackBerries have a secure password storage app called Password Keeper, which you can use to store your passwords; it can also generate randomized passwords for you. Each password is stored with a title, username, password, website and notes to help you keep track of things.

The passwords are encrypted in the device's secure storage; you need to enter a password (which can be different from your BlackBerry's password, if you've set one… and you really should) whenever you launch the app.

AFAIK there are token generating apps like SecurID as well. I'll note that none of these operate quite the way you're describing, you'll still have to enter the password or token yourself. Unless you want to trust your browser, etc. with your passwords (if you do, please set a Master Password in Firefox) you're going to end up entering passwords by hand.

link|improve this answer
feedback
up vote 2 down vote

As sirex says, Lastpass is brilliant. You won't need to even go through the hassle of connecting your cellphone, as it stores your usernames and passwords after a one-time correct login, or you can import accounts from other password managers, it then auto-fills your details on subsequent visits so you only have to click the login button.

If you then are concerned that this would only be for one computer, or you don't want to go through the hassle of downloading lastpass for each computer you work at, try using firefox portable in dropbox for on-the-road password bliss.

You will need:

  1. A small thumbdrive to "install" firefox on.
  2. Lastpass for Firefox Portable - click full list of downloads and scroll down, there is a special version for use with portable apps.
  3. Portable Firefox.
link|improve this answer
How does Lastpass protect against a trojan? – Aaron Digulla Feb 25 '11 at 16:50
1  
Answer: Lastpass offers a screen keyboard so simple keyloggers won't work. It doesn't protect against more sophisticated trojans that make screenshots and capture mouse movements, though. – Aaron Digulla Feb 25 '11 at 16:54
Taken from the Official FAQs: "I'm worried that there might be a key logger on this PC, can you help?" A: If you click on the 'Show Keyboard' link on the LastPass.com homepage you'll be able to login without using the keyboard. This will also log you into the plug-in if you have it installed. – Paul Feb 26 '11 at 15:54
Taken from the official "Avoiding Phishing Scams" page **Top 8 Rules To Protect Yourself From Phishing Scams**1. NEVER tell your LastPass Master password to ANYONE for ANY REASON.2. ALWAYS use anti-virus, anti-malware, and firewall software.3. NEVER click on any links in emails unless you specifically requested that the email be sent to you.4. NEVER assume that any email you receive was actually sent by the recipient listed as the sender.5. AVOID using untrusted computers or untrusted computer networks. – Paul Feb 26 '11 at 15:56
6. DO NOT be impressed if someone claiming to be from LastPass has any personal or confidential information about you whatsoever.7. USE LASTPASS to automatically fill login credentials for websites you visit.8. ALWAYS click on the LastPass browser plugin star icon to access your LastPass vault. – Paul Feb 26 '11 at 16:01
feedback
up vote 0 down vote

maybe 1password can help. http://agilewebsolutions.com/onepassword

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.