41–50 of 111 posts
DO NOT USE 1Password. If you care about security, there's absolutely no reason to use 1Password over an open source solution like KeePass. Even if 1Password doesn't have a backdoor now, nothing would stop NSA from inserting one and keep the owners quiet about it with a gag order. AgileBits is a US company, and so you cannot trust their security. Thank the US government for that.
DO NOT USE 1Password. If you care about security, there's absolutely no reason to use 1Password over an open source solution like KeePass. Even if 1Password doesn't have a backdoor now, nothing would stop NSA from inserting one and keep the owners quiet about it with a gag order. AgileBits is a US company, and so you cannot trust their security. Thank the US government for that.
... reading comprehension …
There are good password managers, then there's KeyPass. :/
Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780…
Any good cross multi-device alternatives?
Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780…
Any good cross multi-device alternatives?
In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
I used Keypass for a couple of months. It was very unstable, regularly crashed my browser, and I lost all of my passwords at one point. I switched over to 1Password and never ran into these issues.
There are other good password managers (e.g. LastPass), but KeyPass is not one of them.
In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
Until we solve "the password problem", what I'd really like is a small dedicated hardware password manager. Like Trezor ( http://www.bitcointrezor.com/ ) but for passwords. But there are a number of problems: 1. How do you authenticate yourself with it? If you lose it you don't want the thief to be able to extract your passwords. You need to reintroduce the "something you know" factor (hard to enter passwords in keyc…
In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
I used Keypass for a couple of months. It was very unstable, regularly crashed my browser, and I lost all of my passwords at one point. I switched over to 1Password and never ran into these issues.
The only downer is that the Linux / mac builds don't support automatically locking, which is a pain. If I get time I'll look at submitting a patch
Until we solve "the password problem", what I'd really like is a small dedicated hardware password manager. Like Trezor ( http://www.bitcointrezor.com/ ) but for passwords. But there are a number of problems: 1. How do you authenticate yourself with it? If you lose it you don't want the thief to be able to extract your passwords. You need to reintroduce the "something you know" factor (hard to enter passwords in keyc…
Assuming a device similar to that:
1. You can protect the device with a simple pin, and have it self-destruct or similar after a number of failed attempts.
2. There are a lot of great ways to handle backups. On first thought, I would lean towards the following model. When initializing the device, you enter a master password. This password is fed into a ridiculously expensive KDF to create an entropy pool. By expensive, I mean the device will spend an hour or longer deriving the entropy pool. Since you only need to do this when first using the device, or restoring from backup, the inconvenience is minor. The entropy pool is used to derive any and all site-specific passwords. It is also used to derive your backup key. From now on, as you use the device, creating new logins, etc, it can frequently and automatically create encrypted backups of this metadata and shove it to your PC/cloud. The entropy pool is stored securely inside the device, and possibly encrypted with a pin number (see answer to #1 above).
Now, if you lose/damage this device, you just grab a new one, initialize it with your master password to re-create the entropy pool, and then it can sync to a backup.
Thanks to the ridiculously expensive KDF, a malicious attacker would need to spend one CPU hour (or more) per brute-force attempt. Good luck!
Problems with this model: The master password must _still_ be a good password. None of this dog's name nonsense. Otherwise, anyone who gets hold of your backup(s) could chew through the top 100 passwords or something like that. One way to help mitigate this is to mix personal information into the master KDF's input. e.g. ask the user for their driver's license number. Doing this, however, exposes the user to privacy issues; should a hacker successfully crack their backup they have strong evidence who owns the now exposed logins.
Also, backups are still mandatory, or else you'll be unable to re-derive your passwords and other metadata. Since the backups are quite secure, one might feel confident storing them in the cloud. I would prefer a fully deterministic solution, where one can just enter a website name into the device and get their password out ... but due to the varying password requirements of each site this isn't feasible.
Finally, since the master password is rarely ever used, it may be difficult for the user to memorize it. This could be mitigated by also using the master password as the device's pin (a weak KDF can be used here), but then the user has to enter a password instead of a pin, which takes longer, every time they wish to use the device.
3. It can act as a bluetooth and USB keyboard.
The thought of such a device certainly tickles _my_ fancy. Heck, I could build one right now, since I already have the hardware platform to do it. But there is one fatal flaw ... you _have_ to use the device. Suppose you're travelling, forgot to bring it with you, and have no way to get another one. Now you're screwed. The only alternative at that point is to use a software emulation of the device on a PC/phone, at which point you've exposed your master password to the PC and thus potential theft. You get to look forward to coming home and cycling all your passwords later.
Until we solve "the password problem", what I'd really like is a small dedicated hardware password manager. Like Trezor ( http://www.bitcointrezor.com/ ) but for passwords. But there are a number of problems: 1. How do you authenticate yourself with it? If you lose it you don't want the thief to be able to extract your passwords. You need to reintroduce the "something you know" factor (hard to enter passwords in keyc…
I am actively developing a Bitcoin hardware wallet (like the Trezor), which has a nice color touch screen. This allows it to have an on-screen keyboard and such. It's about half the overall size of a phone, and could easily be made smaller. Assuming a device similar to that: 1. You can protect the device with a simple pin, and have it self-destruct or similar after a number of failed attempts. 2. There are a lot of g…
Now, to use it, you whip out your phone, launch the related app, and this causes the main processor to pass control to the secure processor where you are greeted by your password manager.
Better yet, the phone's browser could trigger it, and even tell the secure processor what website we wish to log into. Now the user just has to hit confirm/enter a pin, and the rest is handled automatically.
Not amazing enough yet? When plugged into your PC by USB/Bluetooth, if you've got the right software installed, even the PC's browser could trigger this.
Now you have all the benefits of a hardware based password manager, but you don't need a "second device."