Do you have hundreds of logon credentials for various web sites, computer systems, banking systems? Do you have trouble remembering all of your passwords or even the usernames associated with them? I certainly do and I needed a solution. I could always write them down in a notebook and store that safely, but what if I lost the notebook or someone stole it? It’s also not convenient to carry that around with me wherever I went not to mention the increase in the probability that I’d lose it. I could use a spreadsheet? Nah, not even a password protected spreadsheet is a good idea because they are so easy to crack. So I decided to use a piece of software known as a password safe. Password safes are applications which are specifically designed to securely store your credentials in a encrypted file. I chose an application called KeePass, specifically KeePass Professional Edition (v2.17 at time of writing).
I chose KeePass for a number of reasons. Firstly, it is open source, meaning that the source code for the application is available for anyone to look at. This has a number of advantages, the main one being that it increases the trustworthiness of the application. If everyone can see the source code, then it’s unlikely that the application will start sending your usernames and passwords to unscrupulous scammers without your knowledge because someone would have probably spotted that by now! The second advantage of using a popular open source program such as this concerns the re-use of the code – the basic file format and application operation can be inspected and ported to other platforms such as mobile phones, which is where the latter part of this blog post will concentrate.
My other big reason for using KeePass was the simplicity in which it operates. You create a password database on your file system (Documents library, etc), protect that file itself with a Master Password – yes you’ll still need to remember ONE password to unlock all of your other ones, and start creating new passwords. You can organise them in a folder structure, categorise them with different icons, and even store additional information such as the web site it’s associated with or notes and file attachments. KeePass even has its own built-in recycle bin to prevent accidental deletions of important credentials. All of these details are encrypted by default with an AES 256-bit cipher, currently one of the strongest commercial grade algorithms out there. Did I mention it is FREE?
If you want to get really geeky, then you can also protect your password database using a certificate (.key file). Only when both the key file AND your password are combined can you unlock your database.
If you want to get really, really geeky then read on, because I’m about to tell you how I have my password database set up. Obviously I’m going to be leaving certain details out for security reasons, but this story is about how I’ve managed to synchronise my password database with my mobile phone – two way over-the-air synchronisation.
You’ll be aware that my smartphone of choice is Windows Phone 7, and it just so happens that there is a KeePass port on that platform. 7Pass is an amazing little app, available with full functionality for free, or 79p if you’d like to help support the developer, in the Windows Phone Marketplace. It supports a protocol known as WebDAV. WebDAV is a little-used feature of many web servers which enabled them to act as a file server over HTTP/HTTPS – you can browse the contents of a WebDAV enabled web server as if they were a mapped network drive.
My configuration is best expressed in diagram form I think, so I’ve drawn up the diagram you see above. My PCs all run the standard desktop version of KeePass Professional. They all point to the password database stored on an ordinary Windows-based network share located on my Home Server. Now all of my computers can access the same database wherever they are. To add to that, my laptops run Offline Folders which mean that even when I’m away from home I still have access to the database which is automatically synchronised when I return.
Now for the tricky bit, my Windows Home Server runs IIS by default in order to provide the remote access features of that operating system. I created a new virtual folder in IIS, pointing at the folder hosting the password database. I configured WebDAV globally in IIS and specifically targetted the new virtual folder. At this point, it’s a good idea to make sure that WebDAV is working – to do this you simply map a new network drive in Windows Explorer to the URL of the WebDAV folder you are trying to access. Make sure it’s protected by a username and password (I’m using plaintext authentication for compatibility reasons, but utilising windows security), and that you are using the SSL (https) URL for basic encryption. If that works, you’re ready for the next stage.
Because my server is already accessible via the Internet, my WebDAV share is also accessible with no additional effort. I installed 7Pass on my mobile, and set it to open a new password database located on a WebDAV share. I gave it the location of the WebDAV folder I created previously (the folder, NOT the file itself), and the app then allowed me to select the database file from the list of available files. That was it! All I needed to do was enter my password safe password to unlock it and all of my credentials are there for the viewing wherever I go. Because it is located on a WebDAV server, 7Pass is able to upload anything you add on your mobile to the master database on the server.
If, unlike me, you don’t have the infrastructure to do this, you can still happily use KeePass on your Windows PC, Mac, or Linux PC. There’s also mobile versions for the iPhone, iPad, BlackBerry, old style Windows Mobile, Android, PalmOS and even ye very olde Java based mobile phones.
