Password Manager XP - Store Your Data with Confidence

Password Manager XP is not digitally signed. As a result, I received a security warning in Windows Vista when I attempted to install it. There is no way to verify that the installation package has not been altered, nor any way to verify where it came from.  As it's a security product, I would expect the installation package to be signed. 
 
During installation, Password Manager asks about setting up certain details (such as "allow hotkeys" or "notify on start"). I would prefer to first become familiar with how the product works before making decisions on these sorts of details.

Finally, uninstalling aborts if Password Manager XP is running, instead of shutting it down for me. When my browser was open, the uninstall process would not continue without further input, and the choices I was given didn’t indicate what the impact of proceeding would be. I went through each of the different options, but they all seemed to give the desired result in the end--an uninstalled product. In one case I had files left over after uninstall was finished, though the uninstall did warn me they could not be removed. The uninstall even gave me a warning and asked me to close all browser windows before it could complete--this is not typical behavior.

Overall, these are relatively minor complaints, but they can be potentially irritating or confusing to non-savvy computer users.

The user interface and user experience as a whole is poor.  When you start the program, you are faced with an empty database, for which you must define records to manage accounts and other kinds of data. 
[pwmxp-new_db]
 
Finding what you need to do from the UI is difficult and requires experimentation, in part because everything is named with general terms.  Instead of creating an "Account," you create a "Record" in the part of the database that holds accounts (and has the correct sets of fields for an account).  
As described earlier, even those entries that are predefined can be confusing, such as the preconfigured record type containing both "Account" and "Username."
[pwmxp-new_db]

In the configuration UI, there are several options that are technical in nature and are poorly documented, such as “Concurrent write access,” “Remember data sort order,” and “Override Global Auto Closure Timeout.”

The UI that you interact with while working in the browser is contained in a system tray icon, instead of in the browser itself. This means that to interact with Password Manager XP, you must drag your mouse all the way down into the corner and target the small Password Manager XP icon, instead of working with a toolbar in the browser. The overall experience did not feel well integrated.

Password Manager XP offers plenty of encryption options to choose from, and they can be used concurrently. The application does not claim to, nor does it appear to, collect information from the user's computer or activities. The store must be protected with a password. 

There is functionality to allow multiple users to access a single database; each user can be given different access rights.

For businesses, Password Manager XP can be controlled through Group Policy, ensuring that configuration is consistent throughout your company.

The multi-user functionality is bad from a security perspective in that when a user first opens the database, it opens with full functionality, and then, when a user is logged on, that functionality is reduced to the user's level. This means that Password Manager XP fundamentally has full rights to the database, and as such, any user has access to the database as well. This in turn means that while the program does provide the ability to restrict functionality, it can be bypassed by accessing the file directly. This is likely not a concern for a home user who will not use this functionality; it is of concern for any business relying on user permissions to control access to the records.

Overall, I get the feeling that the authors make use of security technology without thinking about security holistically: using accepted security practices such as those documented in the Security Development Lifecycle (http://msdn2.microsoft.com/en-us/library/ms995349.aspx) would force changes in many of the security features in this product. Again, this is probably not a concern for a home user, but if you're running a business, you may want to consider a product with a better overall security design.