181–190 of 289 posts
Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…
https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…
Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.
https://www.passwordstore.org/
This is the only one I use. I've used it for like 5 years and have hundreds of passwords stored. Everything is offline and encrypted with GPG along with being command line driven. It's the ultimate tool for someone who primarily uses a workstation or laptop.
Well, if one's using a Mac and iCloud one already trusts Apple. so no additional trust needed to use iCloud Keychain I guess.
Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…
Isn't this basically what HSTS + cert pinning does?
Earlier quoted context omitted.
> as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.
What sources do you have that indicate master pws in the pw manager context are getting leaked or reused?
It sounds like to me that there are three types of people: * Layman who reuses passwords unless a techie friend convinces them to use a PW manager. * HN user who either uses a SAAS password manager or sets up their own system to solve the issue of syncing a password store across devices. * Those who actually have state level secrets or living under an oppressive regime and thereby don't trust even the networks they c…
I sort of fall into the second category, except I don't sync passwords across devices or even store them at all. I generate them on the fly with [1]. [1] https://chrome.google.com/webstore/detail/hashpass/gkmegkoip...