11–20 of 94 posts
Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
As someone who has been through probably every popular password manager at this point, make sure to decide what you might need in the future. Honestly, it really boils down to "Do you want to use Linux and not have a half broken client running in Wine". Either way, 1Password is nice :) I use KeepassXC myself which I can recommend.
PS: KeepassXC has an open issue to work on integrating itself as the system keyring (eg. providing the system keyring). If anyone is interested in working on it, check out https://github.com/keepassxreboot/keepassxc/issues/1403 !
Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
What attack vector would be mitigated by switching to a stronger hashing scheme for this specific use case? And are there other mitigations that exist for this attack vector that would be more appropriate? To me is seems that this feature of browsers is really only meant as a protection against non-advanced attackers accessing an unlocked computer. For this scenario, having a stronger hash would do nothing. Having a…
Earlier quoted context omitted.
As someone who has been through probably every popular password manager at this point, make sure to decide what you might need in the future. Honestly, it really boils down to "Do you want to use Linux and not have a half broken client running in Wine". Either way, 1Password is nice :) I use KeepassXC myself which I can recommend.
Seconding KeepassXC recommendation. Here's an intro to it, and to password managers in general: https://leclan.ch/password-managers/ PS: KeepassXC has an open issue to work on integrating itself as the system keyring (eg. providing the system keyring). If anyone is interested in working on it, check out https://github.com/keepassxreboot/keepassxc/issues/1403 !
Earlier quoted context omitted.
Seconding KeepassXC recommendation. Here's an intro to it, and to password managers in general: https://leclan.ch/password-managers/ PS: KeepassXC has an open issue to work on integrating itself as the system keyring (eg. providing the system keyring). If anyone is interested in working on it, check out https://github.com/keepassxreboot/keepassxc/issues/1403 !
I fear to know the answer already, but let me ask anyway: does exist any strong password manager that is integrated with Firefox sync?
There's a reason the master password was removed for a while while rolling out the new synchronisation infrastructure; the assumption is that the data is protected by the key stored and generated locally - and that that key is protected by full disk encryption.
If you can read the key, it is assumed you already can read everything the key protects.
I do agree with the poster that this isn't always a great set of assumptions.
But still; one strong master passphrase generated through diceware or similar will allow you to use the password manager; and then you can use secure, high entropy "pass keys" for everything else (random passwords with ~128 bit entropy).
1. A 16-character password has 128 bits.
2. A 128-bit password takes 2^128 guesses.
3. The GTX 1080Ti does 8.5 billion guesses per second.
4. WolframAlpha tells me that $ \frac{2^128}{8.5 \cdot 10^9} $ seconds are $ 1.269 \cdot 10^21 $ years.
So, am I wrong, or did Palant, when he said passwords would take seconds to crack, assume passwords would be significantly shorter?
EDIT: Assuming a 16-bit all ascii lower case password, it’d still be 80 bits, which, given assumption 3, would still result in 4.51 million years, according to WolframAlpha.
I honestly assumed the warning dialog i saw all those years was to tell me that, not that i needed to set a make believe password. that's is the only bad part, the make believe part. the suggestion on the article of using a slighter less-easy to crack schema for the make believe part is equally bad.
Edit: apparently Chrome's head of security also used to think so, and even called people that thought what the article suggest a "novice" https://news.ycombinator.com/item?id=6166886 seems that somebody lost a political battle at some point.
Earlier quoted context omitted.
What attack vector would be mitigated by switching to a stronger hashing scheme for this specific use case? And are there other mitigations that exist for this attack vector that would be more appropriate? To me is seems that this feature of browsers is really only meant as a protection against non-advanced attackers accessing an unlocked computer. For this scenario, having a stronger hash would do nothing. Having a…
The argument that "security is pointless unless it can prevent from obtaining the data" is a really tiresome strawman. If you force an adversary to have to keylog for data of interest you already have substantially increased the complexity of bulk attacks, which is the real threat for most users - mass password farming sweeps that can provide easy access to people's entire digital presence in one go.
I’m sure my napkin math is off, but: 1. A 16-character password has 128 bits. 2. A 128-bit password takes 2^128 guesses. 3. The GTX 1080Ti does 8.5 billion guesses per second. 4. WolframAlpha tells me that $ \frac{2^128}{8.5 \cdot 10^9} $ seconds are $ 1.269 \cdot 10^21 $ years. So, am I wrong, or did Palant, when he said passwords would take seconds to crack, assume passwords would be significantly shorter? EDIT: As…