Disordered Cogitations

I received an unsolicited promotion of a company that runs a password storage service--Agatra. Considering that I have several score passwords in a file folder in my cabinet, this could be very useful. I am not sure what the word 'Agatra' means, but something like www.passwordvault.com would be a little more user friendly. Remember, it's about the end user remembering the site in easy to understand plain English, not how cool a company's name is.

The most important aspect of a password service is the trust the end user has in the service. This depends in part on how well the service encrypts the passwords. Unfortunately, the description they give--that they use "cipher block" encryption--is not self-evident for the average user and it sounds like they are trying to hide something from the technical user.

I suggest they give a better description for the average user--only use the word 'encryption' and then talk about how passwords are accepted, encrypted, stored, retrieved, decrypted, and presented to 3rd party websites in a secure way--include a diagram that a 6th grader would understand. I would also suggest including a more technical description of which type/mode of cipher block encryption being used (ECB, CBC, OFB, CFB, CCM, EAX, OCB, or one of their own making). We want to know that you know what you are doing.

Finally, some metrics would also add to the confidence factor: "15,392 passwords secured and counting" "368 websites safely accessed in the last 24 hours," etc.

Good luck, Agatra.