How safe are my passwords?

marcebrown · ‎05-14-2012

The idea of storing both URLs to login pages and the access passwords to them in a cloud scares me.

How safe is this information from hacking? Specifically, has the form of security that is being used ever been known to have been hacked? And what legal responsibility has Norton assumed for any harm that results from this?

dickevans · ‎04-08-2008

marcebrown wrote:
The idea of storing both URLs to login pages and the access passwords to them in a cloud scares me.

How safe is this information from hacking? Specifically, has the form of security that is being used ever been known to have been hacked? And what legal responsibility has Norton assumed for any harm that results from this?

Welcome,

Being safety minded is a good thing. 'Scared' scares me. It can lead to inaction which can be more harmful that taking a considered action.

The data in your online vault is encrypted at your computer. Can it be hacked? Can a lock be picked? The answer to both is yes. It will take more time and effort to break the codes on your data than it might be worth. Keeping your most sensitive passwords to yourself can be a wise move.

I have not read any reports of the identity safe data being compromised but, like all data on all servers, it's only a matter of time.

What Norton's responsibilities are, are contained in the license you accepted as a condition of using the software. I cannot comment/explain the terms of use. If there are parts that you have difficulty understanding I strongly recommend that you contact your own legal counsel for answers.

Stay well and surf safe

Dick
Win7x64 SP1 current NIS V20

peterweb · ‎04-17-2008

marcebrown wrote:
The idea of storing both URLs to login pages and the access passwords to them in a cloud scares me.

How safe is this information from hacking? Specifically, has the form of security that is being used ever been known to have been hacked? And what legal responsibility has Norton assumed for any harm that results from this?

You still have the option to keep the data locally on your computer. Even if you are not ready to trust the cloud, you can still use the software.

Things happen. Export/Backup your Identity Safe data.

SendOfJive · ‎02-07-2009

peterweb wrote:
You still have the option to keep the data locally on your computer. Even if you are not ready to trust the cloud, you can still use the software.

This is true only if you use the Identity Safe that is included as part of Norton Internet Security or Norton 360. The new standalone version of Identity Safe does not offer local storage.

chrlsrchrdsn · ‎05-15-2012

Like most companies, cloud or desktop, they assume no responsibility. I keep all my identity safe info on my network and transfer on a regular basis.

JimboC · ‎09-15-2008

Hi guys,

I have a quick question, similar to marcebrown, the original poster, I am wondering how safe my passwords are in the cloud?

I presume they are encrypted on the servers? I realize this must sound strange asking but a little reassurance would go a long way.

I have read too many stories of forums (e.g. Nvidia) and other well know companies e.g. Yahoo and LinkedIn suffering from attacks that compromised the information on the servers.

Is anybody aware of the kind of encryption used by Symantec for password, e.g. if it’s AES or SHA1 etc?

I have transferred my password to the online Identity Safe of Internet Security 2012 and I am simply wondering how safe they are? I transferred them for the convenience of being able to use them on my multiple computers at home.

Any advice would be much appreciated. If you require any further information, please let me know.

Thanks for your time.

JimboC

dickevans · ‎04-08-2008

JimboC wrote:
Hi guys,

I have a quick question, similar to marcebrown, the original poster, I am wondering how safe my passwords are in the cloud?
I presume they are encrypted on the servers? I realize this must sound strange asking but a little reassurance would go a long way.

I have read too many stories of forums (e.g. Nvidia) and other well know companies e.g. Yahoo and LinkedIn suffering from attacks that compromised the information on the servers.

Is anybody aware of the kind of encryption used by Symantec for password, e.g. if it’s AES or SHA1 etc?

I have transferred my password to the online Identity Safe of Internet Security 2012 and I am simply wondering how safe they are? I transferred them for the convenience of being able to use them on my multiple computers at home.

Any advice would be much appreciated. If you require any further information, please let me know.

Thanks for your time.
JimboC

Hi,

I can't speak for Symantec or Norton but I do have a question for you - do you trust your computer and data to a Norton product?

I don't even want to know what method of security they use for online backup or identity safe data. If I know it then others, much smarter than I am can work out a way to compromise it. I can't tell what I don't know

I think it is also safe to assume [yes, I know the problems with that word] that they are using the best possible security for their systems and our data.

Two more points - first, no single product will protect you form every threat all of the time. Second, your best security product is a fully engaged chair/keyboard interface.

Stay well and surf safe

Dick
Win7x64 SP1 current NIS V20

JimboC · ‎09-15-2008

Hi dickevans,

Thanks for your reply and apologies for not posting sooner.

Yes, I do trust my computer and data to a Norton product having used Norton Anti-virus since 2003 and then Internet Security from the 2006 version onwards. I also use Sysinternals tools such Process Explorer, Process Monitor, Autoruns and Handle (for closing file handles) (among other utilities) to monitor my computer and investigate any suspicious activity. They are available from: http://technet.microsoft.com/en-us/sysinternals/default.aspx All Sysinternals tools are developed and maintained by Mark Russinovich. I have also read the popular Windows Sysinternals Administrator’s Reference (http://technet.microsoft.com/en-us/sysinternals/hh290819 ) from Mark Russinovich and Aaron Margosis.

I also use the open-source Process Hacker ( http://processhacker.sourceforge.net/ ) due to its ability to terminate any process, viewing only unsigned processes and detecting rootkits that attempt to hide by hooking important Windows APIs or by using Direct Kernel Object Manipulation (a rootkit stealth technique). I realize that no single product can protect me which is why I also use the free version of Malwarebytes Anti-Malware (with its real-time protection disabled) as a backup scanner.

My approach to security is to also have all Windows security updates installed and to ensure that all of my software has the latest updates. This is a little difficult sometimes, but I am disciplined and thorough in my approach. I also have Microsoft EMET v3.0 ( http://support.microsoft.com/kb/2458544 ) installed and configured to protect all of my most used applications. I could mention other mitigations that I have enabled but I don’t want to go off-topic (please PM me if interested).

I stay up to date on internet security trends and threats. I am also studying for an ISC2 SSCP and eventually a CISSP. I think the above qualifies as “a fully engaged chair/keyboard interface” in order to avoid the social engineering methods that cause malware infections.

Thanks again for help and words of reassurance.

JimboC