Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I use Keepass, but to type the passwords I need to copy them to the clipboard, which makes the password vulnerable to interception.

I see that equivalent applications for android avoid this issue by using android-specific techniques (alternative keyboard).

Is there any way to use password managers more securely?

share|improve this question
add comment

2 Answers

Yes you can use KeePass more securely than how you are currently and you do not need to switch to another password manager. KeePass2 contains a feature called Auto-Type Obfuscation. Instead of copy-pasting the password you can right-click on the password and select 'Auto-Type' and it will then ALT-TAB (switch) to the last window that had focus and start typing in the username and password (or you can configure it to type other data too if you have more or less fields).

To enable obfuscation on the auto-type right-click on the password record and edit/view the record. Click the Auto-Type tab and at the bottom there will be a textbox that says 'Two-channel auto-type obfuscation'.

When this is enabled the username and password details are obfuscated by jumbling it up and entering it out of order and it is also split into parts with some parts in the clipboard and some parts being entered as a keyboard. This way it would be extremely difficult for a keylogger or clipboard catcher to get the whole password or have any idea how to reconstruct it in full.

Ref: http://keepass.info/help/v2/autotype_obfuscation.html

share|improve this answer
add comment

I myself use LastPass which, by way of a web-browser extension, directly fills login form fields by way of identifying the field DOM IDs and directly setting their value to the appropriate information, thus circumventing any sort of copy + paste business. If LastPass is unable to identify the login fields automatically you may manually inspect the form and enter the field IDs into the LastPass profile by hand.

All of my website passwords these days are unique 20+ random character strings, but thanks to LastPass I'm automatically logged in to sites with the service's "Autologin" feature as soon as I visit the site. I hardly ever even click "login" or "submit" anymore.

For logging into the service itself, you are provided with the option to use an on-screen keyboard to thwart any efforts of keyloggers that may have found their way onto your system. Other (not entirely relevant) security features include one-time passwords and two-factor authentication through a variety of different auth services.

On the mobile side of things, the LastPass app for Android supplies a lightweight web-browser that fills in form fields for websites with saved information, once again circumventing any use of the clipboard and copy + paste procedures.

As you implied, LastPass also supplies an alternate keyboard allowing for credential insertion into most Android apps and web-browsers.

This of course does not work for credentials for programs or other secured non-website/app items, all of which still require that I copy and paste credentials as needed.

There is also the possibility of selecting the text of your usernames/passwords and click + dragging them into the form fields which may circumvent the system clipboard depending on your OS.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.