# Password Settings

This section describes how to use the Passwords Settings panel. If you are not already viewing the panel, follow these steps:

1. Open the Edit menu and choose Preferences.
2. Under the Privacy and Security category, choose Passwords. (If no options are visible under Privacy and Security, click its triangle to expand the list.)

In this section: Password Manager Encrypting Versus Obscuring Master Password Timeout Change Master Password

## Password Manager

Password Manager stores your user names and passwords on your computer's hard disk and enters them for you automatically when you visit the sites that require them. For detailed information about using Password Manager, including how to override it for individual sites and how to view and manage stored passwords, see Using the Password Manager

To activate Password Manager so that it automatically stores your user names and passwords and enters them for you as necessary, select the checkbox in the Passwords panel labeled "Remember passwords for sites that require me to log in."

To turn off Password Manager, deselect the same checkbox.

## Encrypting Versus Obscuring

If you use Password Manager or Form Manager to save passwords and personal data, then this sensitive information is stored on your computer in a file that's difficult, but not impossible, for an intruder to read. This way of storing information is sometimes describes as "obscuring."

For improved protection, you may want to protect the file with encryption. Encryption makes it nearly impossible for an unauthorized person to view your stored sensitive information.

To turn on encryption for sensitive information stored on your computer, select the checkbox in the Passwords panel labeled "Use encryption when storing sensitive data." If you have not previously set a master password, you will be asked to create one. To do so, follow the instructions as they appear on your screen. For an overview of the steps involved, see Encrypting Stored Sensitive Information.

To turn off encryption for sensitive information, so that it is obscured but not encrypted, deselect the checkbox.

[ Return to beginning of Passwords section ]

## Master Password Timeout

You can use the Passwords preferences panel to set how often the browser requires your Master Password. Here are some things you should consider when selecting these options:

- First time sensitive information (such as your certificate) is requested. If you work in an office with strong physical security measures or if you feel that the consequences of somebody else using your computer to impersonate you are not extreme, click this radio button. This setting causes Certificate Manager to request your master password only the first time it is required after you launch your browser. Certificate Manager will not request it again until after you exit and relaunch your browser. This setting provides the lowest level of protection.
- Every time sensitive information (such as your certificate) is requested. If you are very concerned about the possibility that somebody else might be able to use your computer to impersonate you, click this radio button. This setting ensures that Certificate Manager will never access the private key database without first requesting your master password. This setting provides the highest level of protection.
- After blank minutes of inactivity on an encrypted site. If you are somewhat concerned about the possibility that somebody else might be able to use your computer to impersonate you, but not enough to type in your master password at frequent intervals, click this radio button and fill in the box with a value you feel comfortable with (for best protection, this should be a fairly low number of minutes, such as 20). This setting is appropriate if you sometimes send or receive confidential information to or from web sites that support encryption. Note that this setting provides little protection against someone using your computer to send a signed email message in your name.

[ Return to beginning of Passwords section ]

## Change Master Password

A master password protects a security device, which is a software or hardware device that stores sensitive information associated with your identity, such as keys or certificates. For example, the browser has a built-in Software Security Device, and you can also use external security devices, such as smart cards, if your computer is configured to use them.

The master password for the browser's buildt-in Software Security Device also protects your master key. Your master key is used to encrypt sensitive information such as email passwords, web site passwords, and other data stored by the Password Manager and Forms Manager. If someone uses your computer who knows or can guess the master password for the software security device, that person may be able to access web sites while pretending to be you. This can be dangerous—for example, if you manage your financial accounts over the Internet. Therefore, it's important to select a master password that is difficult to guess.

[Discussion of new password quality meter]

It's also important to record your master password in a safe place—and not anywhere that's easily accessible to someone else. If you forget this password, you may not be able to access important information, such as web sites that require passwords or certificates stored on your computer.

Note that each security device requires a separate master password. For example, if you are using one or more smart cards to store some of your certificates, you must set a separate master password for each one.

[ Return to beginning of Passwords section ]

5/10/2001

Copyright © 1994-2001 Netscape Communications Corporation.