Intel Security (formerly McAfee) has been promoting their coming service to “remove the hassle of passwords” for a while. Earlier, I received my invitation to download the software and create a profile in its preview state.
A little context
I use KeePass to manage my passwords. It’s an open-source product which creates a secure database for tracking your accounts and related passwords and other details. I then use SpiderOak to encrypt the file and synchronize it between a few devices.
I have over 500 accounts in my KeePass, each with a unique, secure password. Despite the volume, I do not find passwords to be a hassle and this setup gives me peace of mind. If a site is compromised, I can simply change the password with the site and update the entry in my password database.
Intel’s True Key
True Key is Intel’s take on the password manager. It was announced in early January and I’ve been on the waiting list shortly after it opened.
True Key uses a profile to track your account and allow you to access your password list from multiple devices including Windows computers, Android devices, iOS devices, and Chrome on OS X. The typical password database uses a really strong password to protect access to the password list. This allows you to remember a single password to get into all of your other passwords. The only other passwords you might need to remember are to get into your computers and other devices to access your account. Differentiating itself from other password databases, True Key touts facial recognition and other possible biometrics used to access your account.
The following screenshots walk through the process of setting up Intel Security’s True Key.
The elusive True Key download page is sent with your email invite. It details compatibility with Windows, Android, and Mac versions.
Once downloaded, you can install the True Key App. Watch for the checkbox there to change your IE home page and new tab page.
You can review the EULA and Privacy Notice, which is particularly important since this is dealing with a lot of your information.
After you complete the install, you will need to create a True Key profile unless you already have one.
You can pick a popular site or add an entry at this point to enter your account credentials. It offers Facebook, Twitter, Linkedin, Netflix, and Dropbox by default. Alternatively, you can skip this step.
When you finally reach your account, it will give you a tour through the interface. Like the previous steps, this felt like it was in the wrong order or too much on rails that it was not giving a good first impression.
You can add a favorite to any site that you would like to record an account entry for. The suggestions were… nice but felt forced.
The funny thing was I tried the suggested favorite, Hulu, and received the notice that True Key does not work with the site yet. “Oops. True Key doesn’t support this site yet.” It sounds like Intel is over-complicating this if they have to add sites manually and one of their suggestions doesn’t work. Is the user name label different than what they were anticipating?
True Key is accessed through apps or browser add-ons/extensions. The latter allows convenient interaction with the browser, where you probably need most passwords, but also makes for it to be rather intrusive. For example, it has a built-in search to make it easier to find your accounts. If it doesn’t find a match though, it will take you to a Bing search for that term. This can be annoying if you made a typo or are not sure if you have an account already.
Along with the Browser Helper Object or add-on for Internet Explorer, there is also an extension for Google Chrome.
You can configure each entry to have its own specific settings such as requiring the master password, not logging you on automatically when you reach the page, or subdomain specific accounts.
If your account has timed out, your profile will lock automatically. A nice security feature but annoying interference in your browsing. As you can see with the image above, even though the Amazon account is saved in the browser, True Key presents its “lightbulb” icon in each field and requires logging in to True Key to unlock while blocking the sign-in button.
Conclusions
True Key is not for me. It feels very much on rails and does not allow a lot of customization to the workflow, instead it interrupts the browsing experience even more than authentication challenges. I have been using KeePass for years and had some hope that True Key could be an upgrade.
From the EULA, you can gather that Intel Security plans to charge for the True Key service. It makes sense that it needs to be profitable and it has commercial competition like LastPass. However, it is falling short on the feature list to compete (granted this is an early preview release). Another concerning point is that Intel also intends to sell out these customers assuming they are getting a kick back from Microsoft for sending search traffic their way to Bing.
If you get the chance to try it out, you can provide feedback to Intel through the True Key feedback site or on Twitter @TrueKeyFeedback.