Password Settings

This section describes how to set your password preferences, set your Master Password, and control other aspects of password handling.

For step-by-step descriptions of various tasks related to passwords, see Using the Password Manager.

 

In this section: Privacy & Security Preferences - Passwords Password Manager Privacy & Security Preferences - Master Passwords Change Master Password Reset Master Password

Privacy & Security Preferences - Passwords

This section describes the Passwords preferences panel. If you're not already viewing it, follow these steps:

1. Open the Edit menu and choose Preferences.
2. Under the Privacy & Security category, choose Passwords. (If no subcategories are visible, double-click the category to expand the list.)

Password Manager

Password Manager preferences allow you to

• Remember passwords for sites that require me to log in: Select this checkbox to turn Password Manager on, so that it automatically stores your user names and passwords and enters them for you as necessary. To turn off Password Manager, deselect the same checkbox.
• View Stored Passwords: Click this button to view information about your stored passwords and the sites whose user names and passwords you don't want to be stored.

For detailed information about using Password Manager, including how to override it for individual sites and how to view and manage stored passwords, see Using the Password Manager.

Encrypting Versus Obscuring

If you use Password Manager or Form Manager to save passwords and personal data, this sensitive information is stored on your computer in a file that's difficult, but not impossible, for an intruder to read. This way of storing information is sometimes described as "obscuring."

For improved protection, you may want to protect the file with encryption. Encryption makes it nearly impossible for an unauthorized person to view your stored sensitive information.

• Use encryption when storing sensitive data: Select this checkbox to turn on encryption, or deselect it to turn off encryption.

If you have not previously set a master password, you will be asked to create one. To do so, follow the instructions as they appear on your screen.

For more details, see Encrypting Stored Sensitive Information.

Password Manager

This section describes how to use Password Manager dialog box to control your stored passwords. If you are not already viewing it, follow these steps:

1. Open the Edit menu and choose Preferences.
2. Under the Privacy & Security category, click Passwords. (If no subcategories are visible, double-click the category to expand the list.)
3. Click Manage Stored Passwords.

The Password Manager has two tabs:

• Passwords Saved: Click this tab to view the list of sites for which Password Manager has saved your user name and password—that is, the sites for which you selected "Yes" in response to Password Manager"s request to store logon information.

  The second column shows the user name for each site. If the password is stored in encrypted form, "(encrypted)" appears after the user name. (The stored passwords themselves are not displayed.)

  If you remove an entry from the list, the stored user name and password will be discarded, and you will need to log in manually the next time you visit that site.

• Passwords Never Saved: Click this tab to view the list of sites for which you selected "Never for this site" in response to Password Manager"s request to store logon information.

  If a site is included on this list, you must always type in your user name and password manually when you visit this site.

  If you remove an entry from this list, Password Manager will again ask you, the next time you visit the site, whether to store your user name and password.

Regardless of which tab you are viewing, you can remove entries from the list as follows:

• Remove: Select one or more entries that you want to remove, then click Remove.
• Remove All: Click this button to remove all the entries listed in the tab you are viewing.

For more information about the Password Manager, see Using the Password Manager.

Privacy & Security Preferences - Master Passwords

This section describes the Master Passwords preferences panel. If you are not already viewing it, follow these steps:

1. Open the Edit menu and choose Preferences.
2. Under the Privacy & Security category, choose Master Passwords. (If no subcategories are visible, double-click the category to expand the list.)

 

In this section: Change Master Password Master Password Timeout Reset Master Password

Change Master Password

A master password protects a security device, which is a software or hardware device that stores sensitive information associated with your identity, such as keys or certificates. For example, the browser has a built-in Software Security Device, and you can also use external security devices, such as smart cards, if your computer is configured to use them.

The master password for the browser's built-in Software Security Device protects your master key. Your master key is used to encrypt sensitive information such as email passwords, web site passwords, and other data stored by the Password Manager and Form Manager.

• Change Password: Click this button to set or change any of your master passwords. For information about using the Change Master Password dialog box that appears when you click this button, see Change Master Password.

Master Password Timeout

If you are using the Password Manager but are not using certificates, and if you have set a master password, the browser will ask you to enter the password only when the newly launched browser first uses the Password Manager or Form Manager to fill in personal information.

If you are using personal certificates, you can control how often the browser requests your master password. Here are some things you should consider when selecting these options:

• The first time it is needed. If you work in an office with strong physical security measures or if you feel that the consequences of somebody else using your computer to impersonate you are not extreme, click this radio button. This setting causes Certificate Manager to request your master password only the first time it needs access to the private key database after launching. Certificate Manager will not request the master password again until after you exit and relaunch the browser. This setting provides the lowest level of protection.
• Every time it is needed. If you are very concerned about the possibility that somebody else might be able to use your computer to impersonate you, click this radio button. This setting ensures that Certificate Manager will never access the private key database without first requesting your master password. This setting provides the highest level of protection.
• If it has not been used for blank minutes or longer. If you are somewhat concerned about the possibility that somebody else might be able to use your computer to impersonate you, but not enough to type in your master password at frequent intervals, click this radio button and fill in the box with a value you feel comfortable with. For best protection, this should be a fairly low number of minutes, such as 20.

  This setting causes Certificate Manager to request your master password if it needs to access the private key database and the specified interval has elapsed since the last time it used the database. This setting is appropriate if you sometimes send or receive confidential information to or from web sites that support encryption.

  Note that this setting provides little protection against someone using your computer to send a signed email message in your name.

Reset Master Password

Warning: If you reset your master password, you will permanently erase all the web passwords, email passwords, and form data saved on your behalf by Password Manager and Form Manager. You will also lose all your personal certificates associated with the Software Security Device.

To change your master password rather than resetting it, click the Change Password button in the Master Passwords preferences panel.

Note that you must remember your old master password to change it with the Change Password button. Resetting your master password is a last resort that you should use only if you are absolutely sure you've forgotten it.

If you are really sure that you want to reset your master password:

• Reset Master Password: Click this button to reset the master password for the Software Security Device. For more information, see Reset Master Password.

Change Master Password

This section describes the Change Master Password dialog box. If you're not already viewing it, follow these steps:

1. Open the Edit menu and choose Preferences.
2. Under the Privacy & Security category, choose Master Passwords. (If no subcategories are visible, double-click the category to expand the list.)
3. Click Change Password.

A master password protects a security device, which is a software or hardware device that stores sensitive information associated with your identity, such as keys or certificates. For example, the browser has a built-in Software Security Device, and you can also use external security devices, such as smart cards, if your computer is configured to use them.

The master password for the browser's built-in Software Security Device protects your master key. Your master key is used to encrypt sensitive information such as email passwords, web site passwords, and other data stored by the Password Manager and Form Manager.

You use the Change Master Password dialog box to provide the following information:

• Security Device: Each security device requires a separate master password. For example, if you are using one or more smart cards to store some of your certificates, you should set a separate master password for each one. If more than one security device is available, a pop-up menu at the top of the Set Master Password dialog box allows you to choose the device whose password you want to change.

• Current password: If you are changing an existing master password, you must first type the current password. If you don't type the current password correctly, you will see the message "Incorrect password entered" after you click OK. If this happens, your password has not been changed and you must start all over again.
• New password: Type your new password into this field.
• New password (again): Type your new password again. If you don't type it the second time exactly as you did the first time, the OK button remains inactive. If this happens, try typing the new password again.

If someone uses your computer who knows or can guess your master password, that person may be able to access web sites while pretending to be you. This can be dangerous—for example, if you manage your financial accounts over the Internet.

Therefore, it's important to select a master password that's difficult to guess. The password quality meter gives you a rough idea of the quality of your password as you type it based on factors such as length and the use of uppercase letters, lowercase letters, numbers, and symbols. For further guidelines, see the online document Choosing a Good Password.

It's also important to record your master password in a safe place—and not anywhere that's easily accessible to someone else. If you forget this password, you may not be able to access important information, such as web sites that require passwords or certificates stored on your computer.

Reset Master Password

This section describes the Reset Master Password dialog box. If you're not already viewing it, follow these steps:

1. Open the Edit menu and choose Preferences.
2. Under the Privacy & Security category, choose Master Passwords. (If no subcategories are visible, double-click the category to expand the list.)
3. Click Reset Password.

Warning: If you reset your master password, you will permanently erase all the web passwords, email passwords, and form data saved on your behalf by Password Manager and Form Manager. You will also lose all your personal certificates associated with the software security device.

If you remember your master password and decide to change it, you can do so without danger of losing any personal information. If you are viewing the Reset Master Password alert and you decide you want to change your password rather than resetting it, click Cancel to return to the Master Passwords preferences panel, then click Change Password. For details, see Change Master Password.

Note that you must remember your old master password to change it with the Change Password button. Resetting your master password is a last resort that you should use only if you are absolutely sure you've forgotten it.

The seriousness of the situation depends on how much personal data your forgotten master password protects. To find out, follow these instructions before resetting your master password:

• To view stored Password Manager data, see Managing Stored Passwords.
• To view stored Form Manager data, see Saving Information from Forms.
• To view your personal certificates, open Certificate Manager and look at the certificates listed under Your Certificates. Those with "Software Security Device" in the Security Device column will be lost after you reset your master password. For more information, see Managing Certificates.

Resetting your master password does not create a new password. Instead, it removes all the data your old master password protects. You will be asked to specify a new master password the next time Certificate Manager needs to store personal information.

After you reset your master password, you must also re-enter all the web site and email passwords that Password Manager may have stored on your behalf, and you must enter form data by hand until Form Manager accumulates enough data to fill in forms automatically. In addition, any personal certificates associated with the software security device will be permanently erased and you will need to apply for new ones.

Note for smart card users: Each smart card has its own master password. The master password for a smart card protects only the data on that smart card (such as personal certificates). You can normally change the master password for a smart card (assuming that you remember it), but you cannot reset it.

25 January 2002

Copyright © 1994-2002 Netscape Communications Corporation.