Speaking of, why is there still no standard protocol for changing passwords? That's 90% of the barrier to managing passwords.
Horcrux: A Password Manager for Paranoids
111–120 of 168 posts
Re: Horcrux: A Password Manager for Paranoids
#112Earlier quoted context omitted.
If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)
What do you mean by "treat it as code you authored"?
For purposes of security paranoia, if you can perform a security audit on open source code it is just as good as any other code you've written.
Idk about other people but I find anything I don't find security holes in myself "as good" as anything I've written. I've got the same set of assumptions/blinders/competence either way.
Re: Horcrux: A Password Manager for Paranoids
#113Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…
Side note; I thought Yubikey was not open source. Am I mistaken? https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
NEO has open source OpenPGP applet (in contrast of 4) but if you read the link carefully they provide rather strong points why it doesn't matter and closed hardware can even be more secure.
Re: Horcrux: A Password Manager for Paranoids
#114Earlier quoted context omitted.
If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)
Relevant: https://en.wikipedia.org/wiki/Underhanded_C_Contest
Valid point.
https://github.com/HainaLi/horcrux_password_manager
It is in JS at least. Underhanded C is likely an easier trick to manage.
Re: Horcrux: A Password Manager for Paranoids
#115Earlier quoted context omitted.
If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)
True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.
> True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.
Then they aren't paranoid but normal folks, eh?
Re: Horcrux: A Password Manager for Paranoids
#116Earlier quoted context omitted.
This sounds pretty cool! What I'm wondering, is how they are intercepting the POST request and at what level?
FYI Service workers can intercept and modify requests.
Only for the same origin they were installed on. So a generic solution like this one wouldn't really work as a service worker.
Re: Horcrux: A Password Manager for Paranoids
#117Earlier quoted context omitted.
That's only true for very specific threat models. For most people, the limit in entropy for your passwords implied by keeping them all in your head makes them more vulnerable than writing them down in a place with imperfect security.
I recently wrote a thing for myself to let me remember one password and generate different passwords for each of my accounts. https://github.com/kybernetikos/sinkless I like it because there isn't any third party or service for me to trust, but I can still have unique complex passwords for each purpose. It feels pretty much the same as having them all in my head.
Similar: https://webpass.rkeene.org/
Though it does syncing
Re: Horcrux: A Password Manager for Paranoids
#118I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…
How could you generate passwords that satisfy arbitrary password constraints? Say example.com has a 20 character limit, must contain a capital letter and symbol (but not certain symbols), and can't contain a dictionary word. It seems to me like your generator would have to have an option for each constraint to satisfy, and you'd have to remember them at the time of retrieval (unless you store the settings). Is there…
I solved it in WebPass[0] by encoding the constraints for special (i.e., not generic) sites into rules associated with a unique ID, then only valid password are considered.
Re: Horcrux: A Password Manager for Paranoids
#119Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…
What is it with banks and their annoyingly terrible "security" requirements? My old bank once sent me an email saying I had to reset my password. The email seemed legit, but upon following the link therein something didn't seem quite right. So I use another device to visit my bank's site directly. Upon trying to login, I get redirected to the same form I reached from the email link and had a sinking realization that…
My bank requires a number in the password and in the username, but doesn't seem to do any validation that the two inputs contain different numbers before storing them.
I imagine a lot of customers are using the same number in each.
Re: Horcrux: A Password Manager for Paranoids
#120Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…
What is it with banks and their annoyingly terrible "security" requirements? My old bank once sent me an email saying I had to reset my password. The email seemed legit, but upon following the link therein something didn't seem quite right. So I use another device to visit my bank's site directly. Upon trying to login, I get redirected to the same form I reached from the email link and had a sinking realization that…
I've known banks that don't let you change the PIN on their cards - for "security" reasons. And banks with 5-digit maximum password lengths - "oh, it's strong enough, you need to use a token to get money out anyway" ... but not to login.