Google Working on Password Generator for Chrome

PCWorld - Google is working on a new password manager for its Chrome browser that would also automatically create strong passwords for users.

The new manager is currently in the design phase, but Google has described the process by which it would work.

When a user visits a page that Chrome thinks is asking to set up an account, it will place a key icon in the password field of the registration form. If the person clicks on that key, Chrome will ask the user whether he or she wants it to create a password. If the user says yes, Chrome will generate a password that includes letters, numbers and characters that make it difficult for a hacker to crack and impossible for the user to remember — and ask the user to approve it.

Chrome asks the user to approve the password because it may not jibe with the rules established by the site for a proper password. That means a person may have to modify the password manually before accepting it.

Once the password is accepted, Chrome will sync it with the user’s other devices running the browser — provided the sync feature is activated for the person’s Chrome account.

Google thinks its idea is a good one because if a person doesn’t remember his or her password, then it can’t be given away to phishers and other Net lowlifes.

Google’s ultimate goal is to have browsers authenticate a user’s identity. That would be done through a browser sign-in and something called OpenID. “While implementing browser sign-in is something that we can control, getting most sites on the Internet to use OpenID will take a while,” it said in a company blog. “In the meantime it would be nice to have a way to achieve the same affect of having the browser control authentication.”               More

Hotmail Forcing Stronger Passwords

PCMag.Com - Attention Hotmail users: if your Hotmail password is "123456," it won't be for much longer.

Microsoft said Thursday that the company has added a pair of security features designed to cut down on the number of people whose accounts have been hacked, or who could be compromised in the future. The first, known as "My friend has been hacked!", has already rolled out; the second, a feature to ban common passwords, will arrive soon.

Recognizing that a friend was hacked is something that users can somewhat easily do, but machines may have a more difficult time. Generally, when an account is hijacked, it is either used for spam or to solicit money through a social engineering scheme. A suspicious user may call the friend to double-check. If a hack is discovered, the frind must then begin a process to take back his or her account.

The new program helps prevent that malicious account from poisoning others, and can also help facilitate the takeback process.

"When you report that your friend's account has been compromised, Hotmail takes that report and combines it with the other information from the compromise detection engine to determine if the account in question has in fact been hijacked," Dick Craddock, the group program manager for Hotmail, wrote in a blog post. "It turns out that the report that comes from you can be one of the strongest 'signals' to the detection engine, since you may be the first to notice the compromise. So, when you help out this way, it makes a big difference!"    More