There has been a lot written about Password management. It is vitally important to keep passwords secure, and without a password manager it is tempting to use the same password for many sites, or even to use a simple formula that changes the password for each site based on the equivalent of a salt value using the sites name. Neither of these is a good strategy if the passwords are for sites or applications you cannot afford to compromise. What I am proposing here is to use a password manager, in this case KeePass and to manage the database that KeePass uses by using Microsoft's free Mesh.

KeePass is a very robust password management system, it is open source released under the GNU Public license. Its licensing page can be viewed here. I will not go into it's features too much as they can be viewed on the site, but I will mention how security is taken seriously. One particular feature I really like is how any passwords copied are automatically erased from memory after a period of time (12 seconds by default). When KeePass is set up you can choose to use a password to open it, or a key file, or both. I use both. One of the problems of using a database is backup. What happens if you lose the databsae and where do you back it up and how often. This is where Mesh comes into the picture. 

Mesh is still in beta at present, but I have been using it for a long time and it works well for me. There are some features I would really like to see in it that are not available, but that is not relevant to this entry. Mesh is in effect an online backup solution that automatically synchronises files or folders that you specify onto Microsoft servers. You can set up more than one computer to use Mesh and select which folders to synchronize. This works out very well because it means you can use each computer with the same Password manager. The file wil automatically get synchronised. If someone finds the password database it does not matter as it is encrypted. If they see the key file they still can't open the database without the pass phrase (assuming you set up a pass phrase). By using a passphrase as well, there is an extremely low probability that the pasword database can be compromised. If you lose your laptop, not only are your passwords safe, but your other computers will still have the latest version.

By using the password manager, it means you can use it to automatically generate very strong passwords for everywhere you require it. There is no need to remember them, and no need to type them as KeePass can either type them for you or allows a safe copy mechanism where the clipboard will be cleared after you have used the password (12 seconds by default). So every web site you use, every application can have a unique and strong password. There is very ittle danger of losing a passowrd as your database is automatically backed up and synchronised with any other computer you want as soon as you modify your password database.

This is a simple overview, there is one thing to keep in mind. You really have to choose a good strong password for the KeePass application itself. Make sure it is one you will remember but not one that others can guess. Use the usual rules for making a strong password, there is a good guide from Microsoft on how to create a strong password. They also have an online password checker which will not record your password jist give you an idea of how strong it is.

Strong passwords are imperative in the battle against identity theft. Start using a password manager today, don't wait until after the horse has bolted. Use a cloud computing solution to make sure you don't lose your password database. The security will feel comforting when you think of how easy it is to mitigate the risks of identity threft. There is never a guarantee when using online systems, but this is such a simple way to make life very difficult for would be hackers and thieves.