Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Master password in Firefox or Thunderbird? Do not bother

palant.de

Post reply on HN
Print view View original

71–80 of 94 posts

Re: Master password in Firefox or Thunderbird? Do not bother

#71

Post by stouset »

Buge wrote: post #66
Dylan16807 wrote: post #64

Earlier quoted context omitted.

If we take the post at face value, it's strong overkill. Face value means that "46 characters from the full set" is even vaguely descriptive of the password. Sure, perhaps it's just a phrase or something, but once you start calling part of a post a lie where do you stop? I'd rather not get into such a mess.

I never said any part of the post was a lie. Most people's passwords are not random. The word "password" doesn't mean random. So there isn't a reason to assume that the password is random. xkcd's recommended password is 25 characters, and 44 bits of entropy. Extrapolating that out would mean a 46 character password would be 81 bits of entropy. Yes, "from the full set" likely means that it's higher than 1.46 bits/char…

At the point where someone has a 46-character password consisting of uppercase, lowercase, digits, and symbols that takes a week to memorize, I think it’s a fair guess that it’s random.

The average password isn’t random. But GP was not describing anything remotely close to an average password in the first place.

Turns out (according to GP) it isn’t random. But I stand by my point that it was a reasonable assumption given the available data.

Re: Master password in Firefox or Thunderbird? Do not bother

#72

Post by stouset »

Santosh83 wrote: post #70
stouset wrote: post #52

Earlier quoted context omitted.

For what it’s worth, assuming an alphabet of 72 characters (52 letters, 10 digits, 10 symbols), this is ridiculously higher entropy than a 128-bit encryption key. There is no absolutely no need for your password to be this long. Even just twenty characters is within spitting distance of 2^128.

Perhaps, but it is not completely random. It is composed of the first letters from the words making up a phrase (which by the way is not from a poem/prose or any existing writing; entirely my own), some upper & some lowercase, prefixed and suffixed with a sequence of numbers and symbols. So it has much more order than a random sequence of 46 symbols, but unless you keylog/phish me or something like that, I don't beli…

That’s fair. My assumption was that it was random.

Re: Master password in Firefox or Thunderbird? Do not bother

#73

Post by cdancette »

unsignedint wrote: post #53
pzxc wrote: post #47

Earlier quoted context omitted.

The alternative is not to give up on password management completely, but to use a proper password manager like KeePass.

I agree with you on this one, KeePass is way to go compared to relying on browser's password manager. Only wish these password management functionalities (not tool itself, but whole mess switching back and forth between target app/password manager) are more pleasing than the way it is now on mobile...

Android 8 provides an autofill API for this purpose! But it's only working in apps, not in the browser

Re: Master password in Firefox or Thunderbird? Do not bother

#74

Post by ailox »

zitterbewegung wrote: post #59
pzxc wrote: post #47

Earlier quoted context omitted.

The alternative is not to give up on password management completely, but to use a proper password manager like KeePass.

What if you took Firefox or chrome and replaced the password manager with a keepass compatible system by default and kept the usability?

As long as there is no default support for keepass, maybe kee/keefox will fit the bill?

https://addons.mozilla.org/de/firefox/addon/keefox/

Re: Master password in Firefox or Thunderbird? Do not bother

#75

Post by omnifischer »

eadmund wrote: post #25
muxator wrote: post #14

Earlier quoted context omitted.

I fear to know the answer already, but let me ask anyway: does exist any strong password manager that is integrated with Firefox sync?

Firefox Sync is insecure and should not be used. This didn't used to be the case — it used to be world-class — but the engineers decided to utterly destroy its security. All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Worse, they use dynamically-downloaded JavaScript to hand…

'This means that any government Mozilla must obey can do the same thing.'

Please do not spread FUD. This is hn. Mozilla cannot see your passwords.

See the latest security audit: https://blog.mozilla.org/security/2017/07/18/web-service-aud...

https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-...

Re: Master password in Firefox or Thunderbird? Do not bother

#76

Post by omnifischer »

eadmund wrote: post #57
staticassertion wrote: post #32

Earlier quoted context omitted.

> All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? It makes it sound like they aren't key stretching, which seems unlikely. Can you provide a source here? > Worse, they use dynamically-download…

> Can you elaborate on this? bscphil did a good job of it. They stretch the password into a key, but a 24-bits-of-entropy key still has only 24 bits of entropy, no matter how much you stretch it. Their previous system actually used properly-secure encryption keys. > I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system. There's a dif…

>As for the why — I explained why afterwards. Not just Mozilla has the ability to steal your passwords: any government which can force it to comply can also snarf your passwords. As for precedent, court orders require third parties to do things all the time.

I would love to see if you can prove this. Please see their latest audit:

https://blog.mozilla.org/security/2017/07/18/web-service-aud...

https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-...

When you enter your Firefox Account password, we first strengthen it by applying some cryptographic hashing, and then derive two separate keys: an authentication key, and an encryption key. The authentication key is transmitted to the server to prove that you own the account. A bug in TLS might cause this key to be leaked, and someone who intercepts this key could use it to authenticate to your account. But they cannot use it to access your sync data, because: The encryption key is used to encrypt your sync data before it leaves your machine. Since this key is never transmitted to the server, it cannot be leaked by a bug in TLS like the one that affected Cloudflare.

Re: Master password in Firefox or Thunderbird? Do not bother

#77

Post by kzrdude »

Buge wrote: post #61
kzrdude wrote: post #24

Earlier quoted context omitted.

Just to chip another little piece off, ascii is a 7-bit encoding, and the 8th bit is clear, so that makes 16 × 7 = 112 bits if we use any ascii byte (0..=128). I'd count 6 bits per letter (64 different characters) as a rough estimate for realistic passwords.

English text has 1.46 bits of entropy per character. https://www.gwern.net/docs/statistics/1996-teahan.pdf

You wouldn't use english text for the password, for this reason.

Re: Master password in Firefox or Thunderbird? Do not bother

#78

Post by claudius »

fauigerzigerk wrote: post #69
Too wrote: post #65

Related interesting read: Why pidgin doesn't store passwords encrypted https://developer.pidgin.im/wiki/PlainTextPasswords I guess the moral of both stories are, if you want your passwords really encrypted, lock your OS user account and use full drive encryption.

And never run any programs that you don't trust with all of your passwords? That doesn't seem realistic.

Why would you run untrusted programs? And if you do, why are passwords so much more sensitive than your entire browsing history, all your emails and e.g. all your not-passphrase-protected SSH keys?

Re: Master password in Firefox or Thunderbird? Do not bother

#79

Post by fauigerzigerk »

claudius wrote: post #78
fauigerzigerk wrote: post #69

Earlier quoted context omitted.

And never run any programs that you don't trust with all of your passwords? That doesn't seem realistic.

Why would you run untrusted programs? And if you do, why are passwords so much more sensitive than your entire browsing history, all your emails and e.g. all your not-passphrase-protected SSH keys?

>Why would you run untrusted programs?

Because I don't have time to read the source code of every version of every open source library/tool, or make sure the deployment process of all software I use is secure, or keep track of who controls these projects.

>And if you do, why are passwords so much more sensitive than your entire browsing history, all your emails

Because none of that allows anyone to take over my important accounts, steal my money or take my backups hostage. It's also much more difficult and inefficient to upload or parse gigabytes of documents and emails or keep a keylogger running undetected than it is to upload one small password file to the attacker's server.

>not-passphrase-protected SSH keys?

I don't have any of those.

Re: Master password in Firefox or Thunderbird? Do not bother

#80

Post by acdha »

eridius wrote: post #63
acdha wrote: post #21

Earlier quoted context omitted.

There’s a long running ticket to do this on OS X which started out as NIH/apathy but gained a good reason not to as Apple restricted iCloud password support to App Store applications. https://bugzilla.mozilla.org/show_bug.cgi?id=152485

That ticket is marked as resolved and the last update is 16 years ago. Also this is the first I've heard that iCloud keychain sync only syncs keychain items created from App Store applications, and color me quite skeptical on that. Apple previously restricted the iCloud file and Key-Value Store functionality to App Store apps, but for keychain syncing it's just a single flag given to the item when creating it. Also I…

Ack, sorry: that link should have been https://bugzilla.mozilla.org/show_bug.cgi?id=106400 – I was hastily searching bugzilla on a phone.

The iCloud issue is discussed towards the bottom and references the Chrome ticket to remove support:

https://bugs.chromium.org/p/chromium/issues/detail?id=466638

Post reply on HN