The first application tries to free you from the Catch-22 of online passwords. You know how it goes: You're bound to forget them if you play it safe and use a variety of strong passwords, but you run a big risk if you reuse the same password at every site. Most of us tend to recycle passwords, but that invites online thugs to a credentials feast when they break into one poorly protected, unimportant site and steal your log-in there; they can (and will) turn around and try the stolen credentials at online banks and other financial sites.
Well, rejoice, fellow password-haters. I've found a great free solution called Password Hash that combines security and convenience. This browser add-on for Firefox 1.5 and 2.0 and for Internet Explorer 6 lets you keep use the same password at your end for every site, but converts it into a strong and unique password on-the-fly before sending it to the target site. Though I ran across it in a book for IT professionals (Network Security Hacks from O'Reilly), it's extremely easy to use. The Stanford University folks who created it understand that most people won't use complicated security software.
Password Hash works its magic when you hit F2 or type @@ in a password field on a site. You then type your standard password, and when you hit Enter, the add-on combines the password with the domain name (such as google.com or pcworld.com) of the site you're logging in to, and runs them through a calculation (called a hash) to create a unique, strong password. Using the domain name provides a measure of protection against phishing sites, because Password Hash will generate a different password for a spoof sitea??say, bankofamerican.com--than the one it generates for the real site, bankofamerica.com.
What's more, you don't have to save the password anywhere: If you add Password Hash to a different browser on a different computer, it will still generate the same password at any given site. If you can't install the add-on but need to use a different browser somewhere, you can type your usual password and URL into the Password Hash Web site and get the Password Hash password--via an encrypted connection, of course.
It's not a perfect security scheme--nothing is--but it's far, far better than sticking with the "Batman25"-type password that many people use everywhere now. I'd suggest using it, at a minimum, for your sensitive financial accounts. (I'm using it now and gradually switching my passwords over.)
The one gotcha: Password Hash doesn't yet work with IE 7, and its developers haven't announced when it will. But they do say that such compatibility is in the game plan.