Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Practicing privacy: Encryption

matt.might.net

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Practicing privacy: Encryption

#11

Post by rotnewson »

dllthomas wrote: post #7
rotnewson wrote: post #3

Earlier quoted context omitted.

If you can't remember 1 password over 20 characters that you will use a lot with a password manager you probably need to change what kind of passwords you make. Instead of "E=E Set the password manager to make you enter the password if you haven't used it for 30 seconds (for a few days so you remember your password). You're using a password manager with a good password that is easy to remember but the you do use the…

Do not give password advice without looking at the entropy. Estimates of the entropy of English text place it below 1.5 bits per character. "The brown cow jumps over the moon." would, generously, have about 34 * 1.5 = 51 bits of entropy, plus a few more for the simplistic substitutions - say 70 bits total? This is assuming the sentence was, in fact, chosen uniformly across English sentences, which is obviously not go…

Thanks for taking 1 tiny part of my point and trying to destroy it.

I chose the passphrase "The Brown cow jumps over the m00n!" as an example not "The brown cow jumps over the moon." which is a significantly worse passphrase, especially considering every word is available in a dictionary.

The OP had trouble memorizing more than 16 characters for a passphrase so I suggested something easier yet still solid yet you seemed to think I suggested just a plain english sentence of words.

Re: Practicing privacy: Encryption

#12

Post by dllthomas »

rotnewson wrote: post #11
dllthomas wrote: post #7

Earlier quoted context omitted.

Do not give password advice without looking at the entropy. Estimates of the entropy of English text place it below 1.5 bits per character. "The brown cow jumps over the moon." would, generously, have about 34 * 1.5 = 51 bits of entropy, plus a few more for the simplistic substitutions - say 70 bits total? This is assuming the sentence was, in fact, chosen uniformly across English sentences, which is obviously not go…

Thanks for taking 1 tiny part of my point and trying to destroy it. I chose the passphrase "The Brown cow jumps over the m00n!" as an example not "The brown cow jumps over the moon." which is a significantly worse passphrase, especially considering every word is available in a dictionary. The OP had trouble memorizing more than 16 characters for a passphrase so I suggested something easier yet still solid yet you see…

Again, you're not looking at the entropy.

Anything you can generate without much more unpredictability from a plain English sentence is not a significantly better passphrase than a plain English sentence. Better? Yes. And I credited you for that.

Re: Practicing privacy: Encryption

#13

Post by geal »

dllthomas wrote: post #6

"Encryption makes privacy a right that can be claimed rather than granted." Not really, or at least not alone. There will always be points at which information must be encrypted. Encryption just pushes the need for the right to be granted to those points. This is not at all a bad idea, of course; just that government recognition of a right to privacy is still important.

Encryption provides a good way to keep secrets. This has nothing to do with privacy. Privacy is minding my own business without anyone watching me or judging me.

If you need to rely on encryption to protect your privacy, then you have very little privacy, because everything that is not encrypted can be snooped on: where you are, who you talk to and about what (because GPG doesn't protect the username and subject), who are your friends (because you can't trust them to encrypt properly).

If you want to escape surveillance, encryption is just one tool. What you really need is good opsec habits. See for examples http://fr.slideshare.net/grugq/opsec-for-hackers

Re: Practicing privacy: Encryption

#14

Post by pampa »

mike-cardwell wrote: post #8
dmix wrote: post #5

For cloud services I'd recommend Lastpass (works with Yubikey 2 factor) for password management and Tarsnap for backups.

Worth pointing out that if you use LastPass and the US government wants a list of all of the accounts you use, a history of when you logged in to them, the IPs you were using when you logged in, and your usernames and passwords, they can get it. All they need is a court order to compell LastPass to target your account with some modified backdoored JS. They have done this before to force Hushmail to send backdoored ja…

PGP encrypted text file is not very convenient. Give keepass a try http://keepass.info/. Its open source, cross platform and has a nice random password generator. Can't live without it.

I never understood why people would want to use a cloud-based password manager. I find the whole idea of giving your passwords to a 3rd party ridiculous, and doesn't matter if they are encrypted or not. Wasn't there a security breach with one of these services a few months ago?

Re: Practicing privacy: Encryption

#15

Post by newman314 »

pampa wrote: post #14
mike-cardwell wrote: post #8

Earlier quoted context omitted.

Worth pointing out that if you use LastPass and the US government wants a list of all of the accounts you use, a history of when you logged in to them, the IPs you were using when you logged in, and your usernames and passwords, they can get it. All they need is a court order to compell LastPass to target your account with some modified backdoored JS. They have done this before to force Hushmail to send backdoored ja…

PGP encrypted text file is not very convenient. Give keepass a try http://keepass.info/ . Its open source, cross platform and has a nice random password generator. Can't live without it. I never understood why people would want to use a cloud-based password manager. I find the whole idea of giving your passwords to a 3rd party ridiculous, and doesn't matter if they are encrypted or not. Wasn't there a security breach…

Yes, LastPass which is why I use 1Password + DropBox. As soon as a non-Dropbox cloud (eg. aerofs) share becomes available that works for 1Password, I'm switching to that.

Re: Practicing privacy: Encryption

#16

Post by Zigurd »

dllthomas wrote: post #6

"Encryption makes privacy a right that can be claimed rather than granted." Not really, or at least not alone. There will always be points at which information must be encrypted. Encryption just pushes the need for the right to be granted to those points. This is not at all a bad idea, of course; just that government recognition of a right to privacy is still important.

That recognition will no doubt come sooner the less value can be extracted from snooping.

Re: Practicing privacy: Encryption

#17

Post by dllthomas »

Zigurd wrote: post #16
dllthomas wrote: post #6

"Encryption makes privacy a right that can be claimed rather than granted." Not really, or at least not alone. There will always be points at which information must be encrypted. Encryption just pushes the need for the right to be granted to those points. This is not at all a bad idea, of course; just that government recognition of a right to privacy is still important.

That recognition will no doubt come sooner the less value can be extracted from snooping.

Agreed. Both using encryption and pushing for better privacy protections are important and complementary.

Re: Practicing privacy: Encryption

#18

Post by croikle »

elehack wrote: post #9
dllthomas wrote: post #7

Earlier quoted context omitted.

Do not give password advice without looking at the entropy. Estimates of the entropy of English text place it below 1.5 bits per character. "The brown cow jumps over the moon." would, generously, have about 34 * 1.5 = 51 bits of entropy, plus a few more for the simplistic substitutions - say 70 bits total? This is assuming the sentence was, in fact, chosen uniformly across English sentences, which is obviously not go…

There is also the excellent Diceware: http://world.std.com/~reinhold/diceware.html

I'm a fan of Diceware. Strong entropy guarantees and memorable passwords.

Re: Practicing privacy: Encryption

#19

Post by thirsteh »

rotnewson wrote: post #11
dllthomas wrote: post #7

Earlier quoted context omitted.

Do not give password advice without looking at the entropy. Estimates of the entropy of English text place it below 1.5 bits per character. "The brown cow jumps over the moon." would, generously, have about 34 * 1.5 = 51 bits of entropy, plus a few more for the simplistic substitutions - say 70 bits total? This is assuming the sentence was, in fact, chosen uniformly across English sentences, which is obviously not go…

Thanks for taking 1 tiny part of my point and trying to destroy it. I chose the passphrase "The Brown cow jumps over the m00n!" as an example not "The brown cow jumps over the moon." which is a significantly worse passphrase, especially considering every word is available in a dictionary. The OP had trouble memorizing more than 16 characters for a passphrase so I suggested something easier yet still solid yet you see…

If you think "m00n" vs. "moon" or "The" vs. "the" matters, you're not paying attention. A memorizable, but randomly composed string of words all in lower-case ASCII is significantly stronger than anything "complex" (for you, hardly for the cracker--common substitutions are basically worthless: they provide no entropy) you can concoct and remember.

Re: Practicing privacy: Encryption

#20

Post by dllthomas »

geal wrote: post #13
dllthomas wrote: post #6

"Encryption makes privacy a right that can be claimed rather than granted." Not really, or at least not alone. There will always be points at which information must be encrypted. Encryption just pushes the need for the right to be granted to those points. This is not at all a bad idea, of course; just that government recognition of a right to privacy is still important.

Encryption provides a good way to keep secrets. This has nothing to do with privacy. Privacy is minding my own business without anyone watching me or judging me. If you need to rely on encryption to protect your privacy, then you have very little privacy, because everything that is not encrypted can be snooped on: where you are, who you talk to and about what (because GPG doesn't protect the username and subject), wh…

Excellent resource, thank you for sharing it. I think we're agreed, though, that we shouldn't be needing to practice opsec to have some basic privacy.
Post reply on HN