Thanks for pointing that out. So there is a place to delete all passwords in Opera (under the Tools menu).

can it be any simpler than that?

Errr… Yes. It could also appear under the Password Management dialog that appears under Tools | Preferences | Wand Passwords and also under Tools | Delete Private Data... | Advanced >> | Manage Wand passwords...

Wand Passwords… to delete by site. No ability to delete all?

Try:
Delete private data-> advanced -> mark only “clear all wand passwords” -> press Delete

… all “private data” clear-management in one single place … can it be any simpler than that?

Serious Mac Keychain shortcoming:

Passwords are stored by domain. So, for Google, where I have adsense, adwords, and gmail accounts, the Mac totally screws up which password goes where. I have to choose one to store (the one I use most often) and hand-type in the others. Because this problem is based upon the keychain, this problem exists in OmniWeb (my preferred browser), Safaria, and Camino. There is definitely still room for improvement.

The idea that there could only ever be one password per domain is… just shortsighted.

While I set out to defend the non-Opera browsers, I have been forced to eat my words. So here is my response, as promised.

Firefox does not support OS X’s keychain. I poo-poo Firefox on the Mac on general principles.

IE does not support OS X’s keychain. I poo-poo IE on the Mac on general principles. I understand it is because they haven’t made a release for a while, and I tut-tut the decision not to keep updating IE on the Mac to keep track with the OS improvements.

But, I don’t stop there, with my harsh, no-holds-barred criticism. I wag my finger and shake my head, at the Windows development team that hasn’t yet provided a general purpose Keychain-like solution – especially one that meets the needs of being portable across machines, as Alastair points out.

Alastair also writes:

I think you’re being a bit generous for crediting Microsoft with providing stored password portability through the F&S Wizard.

The F&S Wizard offers the ability to (only) backup the IE security settings, which I assume (without testing) will copy these details. I concede that it is clumsy to use. I thought that there might also be a secret file somewhere like Firefox’s signons.txt – I haven’t found such a file to date, but my track record of reading the manual leaves something to be desired.

As for FF passwords and the master password. I believe either FF or mozilla had the master password set as a default (it actually asked me one update to set it, and even had it so you couldn’t have a null master password). Secure or whatever, it was annoying. I think it was the very next release they allowed you to not have a master password. I don’t think it should be set by default, since you shouldn’t be saving passwords on a machine you don’t trust.

Secondly, it was not the case until recently that you could display the passwords in plain text (either that or it was done in a wierd way that I couldn’t do it, because I forgot a password and a site URL changed). Conclusion: Plain-text passwords = useful

I move my entire profile between Windows and Linux (which was mostly for the bookmarks, but meh). I’ve even tarred it up at times and it saves everything, extensions, search-tools and all. I believe Galeon (gnome’s firefox) would use gnome’s keychain thingamabob. Incidently, Sunbird uses the same password manager as FF.

The open question I have is: Do Internet Explorer and Firefox, when running on OS X, also use it?

No, neither of them do. IE has the excuse that it is old and crufty (the about box is dated 2001) and may well predate the Keychain, I’m not sure. Firefox has no such excuse but after all it’s limitations like this that resulted in Camino.

Interestingly, Jon Udell unearthed the Windows XP equivalent of Keychain, called the Credentials Manager. Finding it wasn’t as easy as Udell describes, I had to go: Control Panel > Change An Account > (me) > Manage My Network Passwords (in the related tasks pane). There doesn’t seem to be another way to get there, but maybe I’m missing something.

It seems to me that if you are going to criticise Firefox for not using Keychain you should also criticise IE for not using Credentials Manager. (Or perhaps Windows for providing such a half-arsed implementation?)

Also: I think you’re being a bit generous for crediting Microsoft with providing stored password portability through the F&S Wizard. Extending this argument to its logical (?) conclusion, you could say that all browsers provide stored password portability through disk imaging software!

Lastly, Firefox passwords are stored in the “signons.txt” file inside the profile directory, and can be moved from profile to profile (even from one OS to another, an argument against using the OS-native facilities for password management).

I’ll start with a correction: While writing this comment, I found that Firefox has the ability to set a “Master Password” to hide all your stored credentials. Every time you connect to a site, Firefox pops up the request for the master password before offering a list of credentials for filling in the web form automatically. Unfortunately, it is not the default behaviour. If you do set this, you can probably safely let me use your machine for two minutes – with careful supervision!

From the sounds of it, Safari, Opera and Camino all benefit, when running on OS X, from the operating system support of Keychain. The open question I have is: Do Internet Explorer and Firefox, when running on OS X, also use it? Certainly, if they don’t work like Mac applications when running on a Mac, I will happily poo-poo them on general principles. When in Rome, look-and-feel like Romans do.

Chris wrote:

the little wand icon

Oh, I see it now! That toolbar icon is a wand! I thought it was a pen. My guess would have been that clicking on it opened the HTML for editing.

So, yes, there is a toolbar icon for Password Management in Opera. There’s another correction. I also should have mentioned the special border that is put around the username and password fields to highlight that the credentials are stored.

That said, I still would prefer that all valid actions have some representation in the main menu structure, so I can find them eventually. Despite knowing exactly what operation I was after, I was unable to get it to happen in Opera until reading Casey’s comment on the earlier article. (In hindsight, it is interesting that I gave up prior to reading the on-line help.)

Of course, between the advent of mouse gestures and the Imminent Death of the Main Menu Predicted, perhaps I am being old fashioned!

At least one server I use has two login options on the same pages (a secure (slow, https) and insecure (fast, http))

And the two authentication mechanisms at the same web page are against different user databases with the same username but different passwords? That is just weird! I don’t begrudge Internet Explorer and Firefox ignoring that scenario in return for a better usability in the typical case.

can you move your stored passwords from machine to machine? Opera – yes.

For the sounds of it – anything on OS X using Keychain, yes. Internet Explorer on Windows – yes, through the File And Settings Transfer Wizard, even if nothing else. Firefox on Windows – not sure – I couldn’t find anything in the menus, at least!

Casey writes:

there’s no real precedent for the behaviour.

I would consider there has been many precedents – form-filling is a pretty old user-interface paradigm, and editable combo-boxes with a list of default usernames (overridable by simply typing) seem to be the exact same concept to me.

In Opera 8.01 for Mac, I can access my Wand passwords by going to Tools > Advanced > Wand Passwords, where it displays them organised by domain. [...] The only things that you can do to saved passwords is delete them; from a security perspective, this seems to be the safest?

Yes, that is the way to see your password list, and, yes, I agree that is the safest. I was surprised that I couldn’t find a “Delete All” button. I was confused by the New button – and I couldn’t get the dialog box that pops up to do anything useful – not that I tried that hard

Not to turn this into some kind of Keychain gushing, but I think it’s a wonderful part of OS X. Other applications that keep passwords, such as the Fugu FTP client, and at least one of the VNC apps that I’ve used, also use Keychain. Looking through the passwords in Keychain Access, there’s even more! My instant messaging client, Adium, uses it too, as does the Wi-Fi tool for Apple, and Opera also. Comprehensive!

If done right (and for some reason I trust Apple / Unixy thingos to do things “the right way” more than Microsoft), it means more security across many applications, with less developer cost. And Keychain does seem to have been done “right” (uninformed opinion only) – you can configure passwords to be shared between applications, or locked so that you need to enter your Keychain password in order for the application/internet password to be used.