LastPass vs. Xmarks: Password Synchronization

Since Xmarks announced that they were being bought by LastPass, I decided to give LastPass another try.  In the past week I have done so.  Here are my thoughts.

LastPass Vault

Last time I tried the LastPass Firefox extension, I was put off by the requirement to log in every time I started the browser.  Subsequently, I've taken a different posture with regard to the security of my sensitive data on computers, and in particular on laptops.  I have now taken the tack that sensitive data needs to remain secure, even if a data thief has access to the hard drive.  As such, I started using KeePass to store my non-web passwords (whereas before I kept them in a plain text file), I created a TrueCrypt vault in my Dropbox folder in which I keep tax records and other sensitive documents, and I have started encrypting the passwords stored in the browser.

Initially, this meant that I had to swallow the enter-a-password-whenever-you-start-the-browser pill.  I didn't like this, but I adjusted my behavior to minimize instead of close the browser, and I used suspend or hibernate whenever possible instead of shutting down.

Well, with LastPass, you don't need to keep your browser running in order to stay logged in.  They have a desktop app which stores your logged-in state at the OS level, and communicates with all of your browsers.  That means you sign in once in Firefox, and you're automatically signed in in Chrome.  If (for some unknown reason) you are compelled to use MSIE for something and you're logged in there too.  (LastPass also supports Safari and Opera, but I don't currently use those.)

This scores major points with me in the trade-off between security and convenience!

LastPass Menu

Since I'm comparing LastPass to Xmarks, I should mention the basics.  Both services are ways of synchronizing your passwords between all of your web browsers on each of your computers.  Both services encrypt your data on your computer before transmitting it to their servers.  Xmarks uses your browser's built-in bookmarks database (which can be encrypted with a password or not), while LastPass uses its own encrypted vault to store the passwords.

The premise behind LastPass is that the password that encrypts your data could be "The Last Password You'll Have to Remember!"  If you only need to remember one password, then it can be a strong password, with different character types and such.

They certainly do go a long way towards making it possible to not type in (or even know) your passwords for any website.  LastPass can (optionally) create strong passwords for you that it will auto-fill and auto-login when you visit the appropriate site.  They have excellent browser support across all the major platforms, including smartphones, which brings us to their business model: LastPass is a freemium service.  They give you basic functionality for free, and when you're ready to be a power user, you can pay for the next level of service.  In the case of LastPass, this next level comes in the form of their smartphone apps, which, as I am not a premium member, and do not have a smartphone, are beyond the scope of this review.  I did, as promised, pay for Xmarks Premium, however.

Bookmarklets

So what happens when you can't install the LastPass extension?  As it happens, I'm not allowed to install the LastPass extension on my work computer.  That's OK though, because LastPass has some very excellent bookmarklets that allow you to fill in login information, form data, or simply log you in (as in automatically fill login information and submit).
A bookmarklet is a piece of Javascript that is stored in a bookmark.  You drag a link to your bookmarks bar or right-click to add it.  LastPass creates bookmarklets especially for your account (probably because it's more secure that way), so you'll need to log in to get them.  Instructions are here.

Anyway, at work, I stuck the "LastPass Login!" bookmarklet in my bookmarks toolbar, logged in to LastPass, and viola!  Instant access to my passwords.  (Okay, I had to add lastpass.com to my third party cookies whitelist, but that isn't necessary unless you block third party cookies.)  You can't add login information or form data to the LastPass vault with the bookmarklets, but you can do that with the website.

LastPass behaves much like your browser's normal password saving feature.  When it detects something it can do, a bar will pop down from the top of the browser until you take an action or dismiss it.  LastPass puts its logo inside form and password fields that it wants to interact with.  You can also access the LastPass menu from a button installed in your toolbar.

If you choose to save some information, you are presented with more options:

Saving a site's login information with LastPass

More things that LastPass can do:

Stored Mint.com password

•  Store and fill shipping and contact information, credit card data, or any other specific form on the web.  After installing the plugin, LastPass had collected much of this information from saved form fields (not credit card numbers though, obviously).
• Store passwords and other form data for sites that normally prevent your browser from storing the information.  One such site that blocks normal password saving is Mint.com.
• Import passwords from browsers and just about anywhere they're stored (including KeePass).  It will export to Firefox if you decide to stop using it.
• Store, retrieve, and print secure notes - something that might come in handy should the need arise.
• Share selected passwords with another user - this is useful if I want to be able to log in to Google and Facebook on my wife's computer and we each have separate accounts (or if we share access to a credit card account and the credentials change).  If I update the password in my LastPass account, the correct password shows up in hers as well.

LastPass confused by a Facebook form

LastPass isn't perfect, but it's pretty good, and I've decided to use it going forward.  One drawback of Xmarks' password syncing was that if you had more than one saved password with the same user ID (or no user ID) for a site, Xmarks would refuse to sync your passwords until you had either deleted one of the passwords or created separate profiles for each of the passwords.  One reason you might have two passwords with no username is on sites such as live.com, which save your username, but don't create an auto-filled form field for it and ask you to just re-enter your password.  LastPass handles this situation by giving you the option to select which credentials you want to use from a drop-down menu, or using keyboard shortcuts.

No More Xmarks: Now What?

Update: Xmarks is not dead after all.  Crisis averted.  Yay!  I'm keeping the post as-is below both for historical reasons and because it's still good information.

Xmarks just announced that they are closing up shop because they can't find a sustainable way to make money.  Earlier, I did a post on this blog comparing Xmarks and Firefox Sync.  It appears that now the option has been taken away from us.

What I ended up doing between the two services was using Firefox Sync for keeping everything in sync between my Firefox installations (bookmarks, passwords, etc.), but using Xmarks to keep bookmarks non-Firefox browsers synced, and also to share a few bookmarks folders.

As noted on the Xmarks shutdown page, there isn't a good replacement for inter-browser sync out there.  The closest I can think of is Delicious, but that site is built around sharing, not synchronization.

On the other hand, Delicious does an excellent job sharing bookmarks.  Since I was only really sharing one folder on the web with Xmarks, I installed the Delicious add-on for Firefox and imported that folder's bookmarks.  I made them public and gave them a unique tag, so that they could be shared as a collection. 

I've used Delicious for a while, mostly to collect links that I consider share-worthy.  I did this using the bookmarklet.  For a while, I was importing them into Facebook.  This appears not to be working anymore.

The Delicious add-on didn't work in Firefox 4 beta (which is what I'm running on my laptop).  I installed it, and (after banishing the toolbar and other annoying features) attempted to "import" the folder in question according to this guide.  It simply didn't work.  Literally nothing happened.  The "Import to Delicious" button was in black text on a mostly black toolbar at the top of the window, so they clearly haven't started integrating with Firefox 4.

I still have Firefox 3.6 installed, so I loaded it up, selected the folder, and clicked the button.  Nothing appeared to happen, but this time the bookmarks were uploaded.  Annoyingly, the "imported" column still shows nothing for those bookmarks, but at least it worked.  Well, sort of.  It didn't upload any of the tags I have assigned to the bookmarks locally to the cloud.  It just tagged them "imported".  Maybe this is expected behavior.  If so, there should be an option to upload the tags as well. 

Clearly, I'm not going to be using the Delicious extension for a while, but I don't know that I'll ever use it to keep all of my bookmarks in sync.  Delicious wants you to adopt their system of organization and interaction, and I'm not ready to do that.

At this point without Xmarks, I'm without a good solution to the following problems:

• Cross-browser syncing - Google will sync Chrome; Firefox Sync will sync Firefox; Windows Live Mesh will sync MSIE; but only Xmarks syncs between all three.Bookmarks profiles - Some bookmarks only need to be on certain computers.  Profiles allow you to selectively unsync the ones you don't need on computer A and B, while still keeping them on computers C and D.
• Bookmarks history - Xmarks allowed you to restore bookmarks from any point in your account history.  This came in very handy when I deleted more than I thought I had while cleaning up and only found out about it months later.
• Bookmarks sharing - Yeah, Delicious will let me share collections of bookmarks, but, at least currently, it's a pain to do so.  I've disabled the Delicious add-on.  I intend to keep the list up-to-date, but I will have to do so on the Delicious website, not from my bookmarks collection in the browser, and the two versions of the list will become out of sync.  The Delicious bookmarks also aren't sorted, and there's no way to store an introduction to them: the tag is just a tag, and contains no meta-data.
• Bookmarks favicons - It seems nit-picky, but it's a huge inconvenience if you re-install operating systems a lot.  Hopefully, the Firefox Sync developers will solve this one.  It's most annoying for toolbar bookmarks, because for me those are icon-only.  With Xmarks, all favicons are synced along with the bookmarks.  When you first sync with Firefox Sync, the toolbar icons all look the same.  In order to get the favicons to load, you have to visit each link.
• Bookmarks browsing from non-synced machines - I don't sync my bookmarks at work.  I can't access my bookmarks from other people's browser installations with Firefox Sync.  Xmarks gives me access to all of my bookmarks on the web, and I can even make changes and re-organize using the web interface.

Firefox Sync vs. Xmarks

The "Mozilla Weave" extension was recently brought out of beta testing and renamed Firefox Sync.  I decided to try it out, and compare it to the add-in that I currently use for browser sync, Xmarks. 

First, the similarities:  Both Xmarks and Firefox Sync work basically the same.  You install a browser extension, and your bookmarks, passwords, and open tabs are kept in sync across all your browser instances (each browser on each computer that you use).  This is accomplished by keeping a master copy on a server.  Both Xmarks and Firefox Sync will host your data, or, for advanced users, will allow you to set up and use your own server.

There are a number of differences between the services, however:
First off, Firefox Sync doesn't work with Chrome, MSIE, Safari, or Opera, at least not yet.  Xmarks works in pretty much any browser.   I don't anticipate that this will be the case for too much longer, but it is worth mentioning at this stage.

The major difference between the two services is encryption.  Both services encrypt the data that you send to their servers so that no one can snoop in on the traffic as it's sent over the Internet.  The difference is that Xmarks can read your data on their server, and Firefox Sync cannot.

Firefox Sync encrypts your data on the client side (before it leaves the browser), and therefore its servers have no access to the data that it stores.  The obvious advantage to this approach for the user is that you don't need to worry that they will sell your data, or analyze it, or do anything with it other than store it for you and allow you to retrieve it.  If the servers get hacked, there won't be anything usable on them.  If Mozilla turns evil and wants to snoop on you, they can't: they don't have the decryption key.  You do, and it was never sent to them.

This is not to say that Xmarks' approach is a bad one.  Yes, Xmarks can read your data.  Therefore they can enable you to easily share portions of it.  They can also provide you with easy access to your bookmarks on their website, for those instances when you don't control the browser you're using. They also keep a history of changes, so you can restore from back before you shortsightedly deleted that folder a few months (or even years) ago.

Xmarks also lets you create profiles and manage them from their website, which can contain a subset of your bookmarks, so it's possible to sync certain bookmarks with one group of browsers, but not with others.  This is useful if you have a folder or two that you only need on certain computers, or if you want to have a stripped-down set of bookmarks on your media PC or netbook.

The Xmarks approach isn't all good, though.  They have "discovery" features that I prefer to turn off, since their business model relies on "recommending" links, their extension will alter search results pages by default in order to show you their recommendations.  Still, you can turn them off, which prevents it from being a real negative in my book.

So, what am I going to use going forward?  Both, at least for now.  As you can see from the screenshots above, I have disabled password and tab syncing with Xmarks, and only use that for bookmarks.  This enables me to easily share certain content, use profiles, and manage my bookmarks from the web interface.  There's no reason for me to have my passwords on anyone else's server in an accessible form, or my currently open tabs, for that matter, so I'm using Firefox Sync for that.  Firefox Sync is also set up to sync my History, Preferences, and Settings, which is something that Xmarks can't do.

I'm syncing my bookmarks to Xmarks on my Linux box only (which is always on, and usually has Firefox open), that way it will keep up-to-date with changes that happen over Firefox Sync which is enabled and syncing everything on all of my Firefox browsers.  I'm currently not doing much with Xmarks profiles, but if I want to use them in the future, I can have Xmarks handle bookmarks sync on the browsers with non-default profiles.  I use Firefox by default, but I also occasionally use other browsers, so I have Xmarks set up on non-Mozilla browsers as well.

Firefox Extensions Collection

A while ago, I wrote a post in which I create a list of software to install on a new Windows box.  I did this mostly for my own reference, but it might be useful to others.

The first item on my list is Firefox, but (until now) I didn't include any extensions.  Firefox is all about customizations, and extensions are the most powerful way to customize it.  But who wants to go through the trouble of sorting through the thousands of extensions to find the useful ones?  Well, it's more a matter of keeping your ear to the ground and trying out the ones that sound good and/or come recommended.

After years of research, I've created a collection of extensions!  I didn't write any of them, I just bunched them together because they were all useful to me.

I plan on updating the collection as time goes on, so here's the link:

• burndive's essential extensions

You can choose to install them individually, or as a group.  I hope you find them as useful as I have.

Google Wave (Preview)

I just posted my initial thoughts on the Google Wave preview over at my tuxbox blog.

I See Penguins

Okay, okay, you've all been clamoring for a post. I give. So here goes.

I am going to build a computer. I've wanted to do this for quite some time, but lately, it's all been coming together, and I've gathered enough momentum to see it through. The first event on the chain was my acquisition of a monitor. Slickdeals had a 17" flat screen CRT for $30 after rebates and I bit. I wasn't exactly sure what I wanted to do with the monitor at the time, but I figured I could always find a good use for it. It's a pretty good monitor⁰, and I've thought of a use for it.

This all fits into my larger scheme of building a Linux¹ box that provides all the good functionality of a TiVo, but without the annoying parts (like the ads, the fact that they disabled the 30-second skip and don't delete commercials, and the fact that your recorded shows are stuck on your TiVo, and you can't really do anything useful with them). I don't just want a TiVo replacement or a Media Center PC. I want a server. I want to play with utilize Linux (because it will help me in my career/hobby), which brings me to the next event on the chain.

I spoke with my sister Sazzly on the phone the other day and I mentioned that I was considering building a Linux box. I remembered that her roommate had one, and I asked what distro she was running. I use Red Hat at work, but really I didn't know that much about what the different distrobutions had to offer, or for that matter how to go about setting up a system. I know and use a lot of the every-day commands, but I don't know the ins and outs of administrating a Linux system. She said her roommate ran Gentoo², and then mentioned that it was really easy to install programs "because there's this one command that you type followed by the name of the program, and it installs automagically [paraphrase]." So naturally I had to do some research. Among other distro sites, I went to gentoo.org and looked around a bit. Apparently, Gentoo is the ultimate roll-your-own distro. And get this: when you install a program, you do it by downloading the source code and compiling it yourself! Oh, sure, this is possible on every Linux distro, and sure, you don't have to do it this way: you can also install from binaries, but the minute I read this, my jaw hit the floor and I began to salavate. Okay, not literally, but I was instantly hooked. This, you see, my young grashopper, is the path to ultimate optimization and customization.

Processors can only be as efficient as the compiler that built the programs they're running tell them to be (this isn't 100% true, but bear with me), so if I bought a 64-bit processor and ran programs compiled for a 32-bit perocessor, it would still work, (because the 64-bit processor is backwards compatible) but aside from a few optimizations built into the processor, there wouldn't be nearly as much of a jump in performance as if the program were compiled for a 64-bit system.

It gets even better than that. Suppose you had a Pentium 4, in fact, you probably do have a Pentium 4 if you bought your computer in the last couple of years. Most of the software that you run on your computer does not take advantage of all the bells and whistles that come with the P4 processor. This is because not everyone has one, and when you distribute your program in binary form, you don't want to tell everyone without a particular processor that they can't use your software unless they upgrade your system, so you go with the lowest common denominator, which is x86 (Remember those 386 machines? Running DOS? Yeah, I didn't think so. That's how old this technology is.), or you stipulate a set of system requirements for a more recent processor (The Pentium II is common nowadays), but you can't use the latest hardware enhancements, because you want your product to be useable for "most people" on their current system.

You see, this is even better than having my operating system and most of my programs compiled for my "generation" of processors. They will be optimized to take advantage of features and optimizations unique to my specific processor (and even system configuration).

Then he got an idea!
An aweful idea!
THE GEEK
GOT A WONDERFUL, AWEFUL IDEA!

"I know just what I'll do!" The Geek laughed in his throat.
And he made a quick download, and boot disc he wrote.
And he chuckled and chuckled, "What a great Geeky trick!
With this chip and this board, my system'll be slick!"


My plan, naturally, is to buy an AMD64 processor and build a system, piece by piece, around it. I'll need a motherboard, video card, memory, and a case, as well as all the other usual stuff. I also plan on getting a TV tuner and running MythTV. My goal is to configure it to run MythTV on my projector as a second monitor, while using my CRT as a primary monitor. That's why the keyboard I got is wireless, with an integrated pointing device (ideally suited for sitting on a couch, not at a desk). This is all subject to change, but I've already ordered a keyboard, so I'm pretty much committed.

Lately I've been running lots of Open Source software on my laptop (Firefox, Gaim, Azurus, Vim, OOo, GIMP), and it's partially because of this that I've had enough faith in the quality of Linux to do this.

---

⁰ I recently paid a visit to my company's surplus outlet, of which I was previously unaware. If anyone wants a used 15" - 19" CRT (non-flat) for about $10, let me know. The flat-screens are $50. Actually, it's open to the public, but as an employee I get a discount.
¹ If you're wondering what Linux is, it's an operating system. "Umm..., what exactly is that?" you were probably going to ask. Windows XP is an operating system. You may have heard of OSX, which is an operating system that runs on Macs. Linux is just another way to run a computer. If you don't know all about it, it's because you're probably not geeky enough.
² In case you're wondering what it looks like (or rather, a few of the ways it can look), here are some screen shots.

One Long String of Links

...because it's my prerogative to abuse a little pulpit to the world when I have one, and because you have nothing better to do than to sit there and read it.

First, a couple of sweet /. sigs:

• I prefer the "u" in honour as it seems to be missing these days. ~ WindBourne
• Support bacteria! It's the only culture some people have. ~ melted

I found this while playing with this Firefox extension. I also hacked a couple of extensions so that they would work on version 1.0.⁰ I just (finally) upgraded Firefox from 1.0PR to 1.0, mostly because I discovered that Flashblock was available for this version. On 1.0PR I had Flash Click to view and was unwilling to upgrade from the preview release to the full release if I had to see a bunch of flash ads all over the place.

Other cool extensions: Adblock, CuteMenus, FoxyTunes, Gcache, Image Zoom, Add Bookmark Here, Image-Show-Hide, Nuke Anything, Download Sort, Favicon Picker¹, FlagFox¹, Work Offline¹.

And yes, I am plugging Firefox, if you hadn't noticed. I'm sorry if it's uncreative. If you want something more Tim-ish, beck just sicked me like a pit bull on this blog.

---

⁰ One of them has a typo in it that makes it good for versions 0.9 - .10, so I merely corrected that one to 1.0. The other, I just arbitrarily changed from 0.9 to 1.0. A pretty simple hack, actually. I ended up disabling them, though, because the sound events don't correspond to the ones I want. Oh, well. It was fun and I got to brag about it.
¹ If you want these, you'll have to whitelist the server the first time you click the install link. They're Dutch, so they're cool.