Any suggestions of migration paths to more security conscious alternatives?
I'd even be happy with an encrypted disk image on Dropbox if there's a good way to OCR scanned docs, then be able to search them.
Evernote hacked
171–180 of 220 posts
Re: Evernote hacked
#172Earlier quoted context omitted.
Thanks for igniting this discussion, Niten. While digging around, I stumbled onto this tool which others might find helpful: https://github.com/lowe/zxcvbn zxcvbn, named after a crappy password, is a JavaScript password strength estimation library. Use it to implement a custom strength bar on a signup form near you! zxcvbn attempts to give sound password advice through pattern matching and conservative entropy calcul…
Pretty cool tool! My passphrases (omitting spaces between words) get a score of 2. But if I drop the vowels, the score goes to 4 and crack time to 'centuries'. I wonder if this is a good way to create passphrases. Anybody want to chime in?
[deleted]
Re: Evernote hacked
#173Earlier quoted context omitted.
Your blog post says: > "Avoid using simple passwords based on dictionary words" And yet your password algorithm rejects highly secure pass phrases: > "New passwords can contain letters, numbers and punctuation." Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation dem…
Anyone using this comic to imply that a passphrase is more secure than a short random password hasn't done the math. This is comparing a passphrase drawn from four of the 2048 most common words against not a random password, but one based on a mutated version of one of the 65536 most common words. The example passphrase does have the equivalent of 44 bits of entropy: log_2 (2048^4) = 4 * 11 = 44 However, if we take a…
>"I have since seen an infuriating number of people point to it to claim that passphrases are more secure than random passwords. They are not."
It appears you have assumed all passphrases must take the same methodological route as outlined in the xkcd comic.
However, 'noozle stroodle' has an entropy of 69.303 [1]
The above quotation, is a passphrase, and it's more secure than any 7char printable ASCII password.
While I accept your argument that not all pass phrases are necessarily more secure than seven lettered passwords, one cannot rightly make the antithetical claim either.
The correct judgement is: It depends
[1] According to the JS tester, http://dl.dropbox.com/u/209/zxcvbn/test/index.html
Re: Evernote hacked
#174Anyone know a good Skitch replacement?
You can actually download Skitch 1.XX here: http://update.skitch.com/skitch.html I have been using it since they completely messed up Skitch with the 2.XX update. It requires absolutely no connection to evernote and works great.
Re: Evernote hacked
#175Earlier quoted context omitted.
Thanks for igniting this discussion, Niten. While digging around, I stumbled onto this tool which others might find helpful: https://github.com/lowe/zxcvbn zxcvbn, named after a crappy password, is a JavaScript password strength estimation library. Use it to implement a custom strength bar on a signup form near you! zxcvbn attempts to give sound password advice through pattern matching and conservative entropy calcul…
Pretty cool tool! My passphrases (omitting spaces between words) get a score of 2. But if I drop the vowels, the score goes to 4 and crack time to 'centuries'. I wonder if this is a good way to create passphrases. Anybody want to chime in?
Originally was going to chastise you for typing your actual passwords into a random demo version that could have been modified in whatever way. But since it's all js I guess it's a simple matter to verify it's not transmitting anything. Although I guess it could be some really devious thing where it saves the info in a cookie to be snagged later or some such. Did you check the JS code? ;)
Re: Evernote hacked
#176Earlier quoted context omitted.
> "Never use the same password on multiple sites or services" As long as we're stuck with passwords, this is the single best practice for protecting your accounts. Services WILL be compromised, again and again, and attackers have made a pattern of compromising a poorly-secured service as a side channel to get credentials for a more critical service. Props to Evernote - it seems like they've done the right thing with…
As long as we're stuck with passwords, this is the single best practice for protecting your accounts. This would be easier if non-critical password cookies didn't expire. Why does my Slashdot or HN password cookie need to expire? Answer: it doesn't, but the fact that it does means that I have to write down dozens of different passwords... and carry them with me if I expect to use those services on a mobile basis. Lif…
My HN cookie is scheduled to expire in 2038.
I'm comfortable with that level of forced inconvenience.
Re: Evernote hacked
#177Earlier quoted context omitted.
As long as we're stuck with passwords, this is the single best practice for protecting your accounts. This would be easier if non-critical password cookies didn't expire. Why does my Slashdot or HN password cookie need to expire? Answer: it doesn't, but the fact that it does means that I have to write down dozens of different passwords... and carry them with me if I expect to use those services on a mobile basis. Lif…
My HN cookie is scheduled to expire in 2038. I'm comfortable with that level of forced inconvenience.
Yeah, I wonder if I'm blaming the HN case on a Safari oddity. It never seems to expire on my desktop PC running Firefox, yet I have to log in almost every time I access HN on my iPhone.
Re: Evernote hacked
#178Frustrating, I thought they would have done security better than most given the type of information stored here.
Does anyone know a decent password keeper? I have a list of logins/passwords for my key sites in a word .doc file stored locally, but given I have a work mac, home mac, tablet and iPhone it really is a pain to access the locally stored file.
I thought about saving this file on google drive, but their 2-factor auth doesn't seem to apply for drive (only gmail).
How do others do this - is there a way to store an encrypted file somewhere online, then typing in a known password to unencrypt / open it when I need to access it?
Re: Evernote hacked
#179[deleted]
Re: Evernote hacked
#180I'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error. Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...
[deleted]