21–30 of 94 posts
I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.
i thought everyone knew that every browser saving password was completely insecure and only good for throw away accounts (e.g. hackernews :) I honestly assumed the warning dialog i saw all those years was to tell me that, not that i needed to set a make believe password. that's is the only bad part, the make believe part. the suggestion on the article of using a slighter less-easy to crack schema for the make believe…
I’m sure my napkin math is off, but: 1. A 16-character password has 128 bits. 2. A 128-bit password takes 2^128 guesses. 3. The GTX 1080Ti does 8.5 billion guesses per second. 4. WolframAlpha tells me that $ \frac{2^128}{8.5 \cdot 10^9} $ seconds are $ 1.269 \cdot 10^21 $ years. So, am I wrong, or did Palant, when he said passwords would take seconds to crack, assume passwords would be significantly shorter? EDIT: As…
"This article estimates that the average password is merely 40 bits strong, and that estimate is already higher than some of the others. In order to guess a 40 bit password you will need to test 2^39 guesses on average. If you do the math, cracking a password will take merely a minute on average then. Sure, you could choose a stronger password. But finding a considerably stronger password that you can still remember will be awfully hard."
I’m sure my napkin math is off, but: 1. A 16-character password has 128 bits. 2. A 128-bit password takes 2^128 guesses. 3. The GTX 1080Ti does 8.5 billion guesses per second. 4. WolframAlpha tells me that $ \frac{2^128}{8.5 \cdot 10^9} $ seconds are $ 1.269 \cdot 10^21 $ years. So, am I wrong, or did Palant, when he said passwords would take seconds to crack, assume passwords would be significantly shorter? EDIT: As…
That would be true if the password were 16 random ascii characters. But of course it's not. It's almost certainly only using printable characters, and probably has something a lot like words in it.
I'd count 6 bits per letter (64 different characters) as a rough estimate for realistic passwords.
Earlier quoted context omitted.
Seconding KeepassXC recommendation. Here's an intro to it, and to password managers in general: https://leclan.ch/password-managers/ PS: KeepassXC has an open issue to work on integrating itself as the system keyring (eg. providing the system keyring). If anyone is interested in working on it, check out https://github.com/keepassxreboot/keepassxc/issues/1403 !
I fear to know the answer already, but let me ask anyway: does exist any strong password manager that is integrated with Firefox sync?
This means that any government Mozilla must obey can do the same thing.
Mozilla Accounts are thus fundamentally insecure and must not be used. It breaks my heart: they went from having the world's best password-sync security to having its worst. Even Google's system is quite so blatantly security-hostile. When your concern for your users is less than Google's, you really are doing something wrong.
Earlier quoted context omitted.
As someone who has been through probably every popular password manager at this point, make sure to decide what you might need in the future. Honestly, it really boils down to "Do you want to use Linux and not have a half broken client running in Wine". Either way, 1Password is nice :) I use KeepassXC myself which I can recommend.
Should check on password-store. Uses gpg encryption and git for syncing. Can't recommend it enough!
Leaving filenames unencrypted means that anyone who can view your encrypted data (e.g. GitHub, GitLab, your local admin — whomever) knows which sites you frequent & care to protect.
I’m sure my napkin math is off, but: 1. A 16-character password has 128 bits. 2. A 128-bit password takes 2^128 guesses. 3. The GTX 1080Ti does 8.5 billion guesses per second. 4. WolframAlpha tells me that $ \frac{2^128}{8.5 \cdot 10^9} $ seconds are $ 1.269 \cdot 10^21 $ years. So, am I wrong, or did Palant, when he said passwords would take seconds to crack, assume passwords would be significantly shorter? EDIT: As…
That would be true if the password were 16 random ascii characters. But of course it's not. It's almost certainly only using printable characters, and probably has something a lot like words in it.
That’d still be 80 bits, and still secure enough.
I’m sure my napkin math is off, but: 1. A 16-character password has 128 bits. 2. A 128-bit password takes 2^128 guesses. 3. The GTX 1080Ti does 8.5 billion guesses per second. 4. WolframAlpha tells me that $ \frac{2^128}{8.5 \cdot 10^9} $ seconds are $ 1.269 \cdot 10^21 $ years. So, am I wrong, or did Palant, when he said passwords would take seconds to crack, assume passwords would be significantly shorter? EDIT: As…
maybe i am wrong, but i think you did not read the full article? "This article estimates that the average password is merely 40 bits strong, and that estimate is already higher than some of the others. In order to guess a 40 bit password you will need to test 2^39 guesses on average. If you do the math, cracking a password will take merely a minute on average then. Sure, you could choose a stronger password. But find…
E.g., we can assume that everyone has read the famous XKCD on passwords, and is using passwords that are a bunch of words after another, in lowercase ascii, which would get us somewhere around 80 bits of security, and still keep it memorable.
I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.
I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.