521–530 of 557 posts
Earlier quoted context omitted.
IIRC encryption and decryption is done on the client side and the server only stores encrypted data. Dropbox was not encrypting passwords they were hashing them. If you stored already encrypted files on Dropbox nobody can decrypt those files provided your encryption key is good.
> Dropbox was not encrypting passwords they were hashing them. Incorrect.
Earlier quoted context omitted.
how so? when a card is fraudulently used to make purchases, AmEx is not refunding you from their own pockets. they take back the money from the merchant it was fraudulently spent with (a chargeback). no loss at all on their side.
Which is then passed on to customers through slightly higher prices for goods.
whatever the theoretical rise in price would be (due to the fraud), don't you think the merchant would price things at that level in the first place to make extra profit, if they could?
Earlier quoted context omitted.
Except the one to your password manager :)
I've been pretty happy not even knowing that. (YubiKey OpenPGP smart card + pass) It feels natural for my password manager to be just another thing I have to unlock with a physical key. The security concerns in practice are similar to that of my house keys, so there's pleasantly little mental overhead.
Earlier quoted context omitted.
If you're on a Mac, 1Password is a monumentally better experience.
Why not just use keychain?
Earlier quoted context omitted.
Use an algorithmic password. Pick some easy to remember keyword, then work some of the letters of the website into the password so each site is unique. For example, your seed could be "horse", and your gmail password would be something like "hgomrasiel". I've been doing this for ten years and haven't forgotten a password yet. :)
I would like to do this, and I thought about using an algorithm that uses the domain name as the seed, however different sites have different password policies, and expiration times which would make this very difficult to manage in practice. I wish all sites support things like OpenID so I can have one central place to sign in with 3-factor authentication.
Earlier quoted context omitted.
You'll get over that little hurdle once you realize that you can dump the anxiety of remembering a hundred password variants for different sites. And realistically speaking, you're probably not even using a hundred variants...or possibly even 10. If you're memorizing passwords, chances are your re-use frequency is nonzero. What's important is to keep a backup of your password database in a few places. I use KeePass b…
And trade it for the anxiety of your manager getting pwned.
As a full disclaimer, there are some issues with KeePass [1], but known issues are detailed in full by the project and are available for review.
Earlier quoted context omitted.
I've been pretty happy not even knowing that. (YubiKey OpenPGP smart card + pass) It feels natural for my password manager to be just another thing I have to unlock with a physical key. The security concerns in practice are similar to that of my house keys, so there's pleasantly little mental overhead.
What happens to your password vault when the key suffers a malfunction? Or you lose or physically break it?
Make sure you sign yourself up for something like https://haveibeenpwned.com if you haven't already. Sometimes being timely in responding to leaks can make a big difference on any further leaks.
Fun fact: Have I Been Pwned neither salts nor hashes the creds which it stores on its website, potentially making itself an interesting target for hackers[0] [0]: http://risky.biz/RB388
Earlier quoted context omitted.
It absolutely blows my mind that people are okay with giving their passwords (encrypted or not, see this very breach for why that's not always enough) to a 3rd party, but are not okay reusing a password somewhere. If 1Password ever got owned, the Internet would be severely fucked. And to stem the potential flood a bit, I realize there are plenty of good counterargument built up over the years to try and combat this g…
That isn't how 1Password works. Passwords are encrypted clientside, in a standalone native application.
To be more direct, I'm suggesting the standalone native application may not completely correctly implement the encryption algorithms. I have no evidence of this, but the concept still concerns me.
Earlier quoted context omitted.
> Dropbox was not encrypting passwords they were hashing them. Incorrect.
That's a really unhelpful comment. Please specify what encryption you think Dropbox is doing on the passwords and what knowledge you have on the topic. I'm pretty sure you're going to say "they do TLS" and then the person you're talking to can go ahead and explain that the encryption LastPass/1Password does protects an entirely different threat model, but unless you have a conversation here no one is going to be able…
That said, I was wrong. I recalled what bcrypt does incorrectly.