221–230 of 347 posts
Earlier quoted context omitted.
How do you feel about in-browser password managers--Chrome in particular?
The Chrome people, who I respect, recommend it. But Steve Thomas, who I also respect, has a lot of specific bad things to say about it. I don't think it will destroy you. But it is not my first choice.
Earlier quoted context omitted.
> Additionally, managing your own password vault is a lot like managing your own email server. As someone who actually does both, this is IMHO backwards. My "password vault" is a GPG file I open in emacs and cut and paste from. It's trivially copied and maintained, extends cleanly to "non-password" secret info (e.g. credit cards, my kids' SSNs), involves no third party systems beyond the operation of the software, is…
Read what you wrote one more time, and imagine some manager working in a bank, or a 17 year old business student. It's hard enough to convince people not to use the same e-mail and password combo, and instead use something like 1password or last pass, making them use your proposed "solution" would be a massive step back.
Why can't the existing solutions in the market retain that triviality when translating to the consumer? Why must we be inflicted with bad crypto, cloudification, pervasive over-integration, lack of just-edit-the-text extensibility, etc...?
The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…
I don't mind a recurring fee, its just that I want a native (cloud-free) password manager.
I'm a 1Password user, and have synced my vault between devices through both Dropbox and iCloud at various points. I can't help but feel like either there's something I'm missing or something everyone else is missing, which statistically means that it's most likely me. But: When I sync with iCloud, Apple can't read my vault--even though it's on their servers, it's strongly encrypted with my passphrase, and the encrypt…
Any password manager recommendations such that people don't need to deal with 1Password's cloud-based storage?
https://www.passwordstore.org/ command-line, encrypts passwords with gpg, synchronises using git and by default only copies the password to the clipboard and automatically wipes the clipboard after a minute
"2. Install a camera anywhere I work and focus it on my hands" I feel like we need to be talking about this more. For all the hullabaloo concerning password strength and encryption key length, MANY of our secret key entry methods would be quite easily defeated by a common webcam and a pair of human eyeballs. That's kind of scary! It's not about to make me stop using passwords, but it is going to make me stop and…
[1] https://en.wikipedia.org/wiki/Acoustic_cryptanalysis [2] https://www.sigmobile.org/mobicom/2015/papers/p90-aliA.pdf
Earlier quoted context omitted.
And you can use other Sync methods, like iCloud or move the files around yourself.
I recently moved to using SyncThing for syncing my keepass database. I realised that syncing it with Dropbox was not that much better than using a Web-based service.
Earlier quoted context omitted.
Given the change to their business model I am concerned they can push an update, where the next time I unlock my vault it syncs my master password and/or decrypted vault to their cloud. Maybe time for an open source password manager?
There are lots of them out there to choose from. And being able to audit the secure portions is great, but a password manager is the perfect example of what free solutions often don't do well— you need to have a seamless experience across multiple platforms including mobile, and you need to have fairly deep integrations into multiple web browsers, which are notoriously fickle and need to be tracked closely. The kille…
[1]: https://play.google.com/store/apps/details?id=com.hanhuy.and...
Why is the 1password login the same as the encryption password for all my other passwords? There is absolutely no reason why I should ever send them my encryption password. If they would make these two passwords separate and handle all encryption/decryption locally, I think that would solve the issue for me.
Authentication is not done by sending them your encryption password, but instead the derivation of an SRP static secret (https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...) from your password (PBKDF, XOR'd with HKDF of the entropy-boosting pepper that they call the "Secret Key"), and performing a session key exchange handshake, basically like a (non-ephemeral) Diffie Hellman. They then encrypt all future communications (inside of TLS) with the transient session key.
This gets you three things in one swoop:
- Authentication of user
- Authentication of the server (if the remote server doesn't have the stored RSA counterpart of your derived SRP static secret, the exchange can't complete)
- An additional encrypted tunnel independent of TLS, so transport security isn't reliant solely on TLS (Cloudbleed, etc). (The contents being moved around are encrypted yet again)
And:
- User doesn't have to remember a separate password.
- The password and pepper never touch the network, only (non-reversible) session tokens do.
- Having access to traffic inside of TLS (corporate or malicious TLS endpoint interception, for example) still gets you nothing.
There are valid criticisms of 1Password, but you're literally criticizing them for something they've gone out of the way explicitly spent engineering hours solving in a way that not many services have even bothered thinking about.