My favourite is that the Tweet has be come some standard of measure "fit inside less than half a tweet".
Not less than 70 characters; "less than half a tweet".
MiniLock – File encryption software that does more with less
81–85 of 85 posts
Re: MiniLock – File encryption software that does more with less
#82Earlier quoted context omitted.
I think so you can use it from any computer anywhere with just the passphrase to derive the key and don't need to carry and secure a file.
If you're entering your passphrase on systems you don't control, it's already game over for that passphrase.
This comment is a perfect example of why encryption is mostly not used at all. (Which is far worse than any given vuln). There's kind of a perverse all-or-nothing attitude where the goal is to poke at any possible flaw in a system as proof that it is completely worthless. What's wrong with there being different tradeoffs between security and convenience? The insistence on all-or-nothing solutions has resulted in the powers that be knowing almost everything about almost everyone in our society, because almost no one wants to deal with the trouble of "completely secure" encryption.
Re: MiniLock – File encryption software that does more with less
#83Earlier quoted context omitted.
The algorithm is [898, 537, 321, 205, 361] -> tidlotexidaifol -> "tidy lot existence daily following". The phrase is generated deterministically from the password, so it's no more secure than the previous steps. It's just a mnemonic to help remember the password. If by trigram you mean "3-letter word prefix", then yes, they are all equally likely. If you mean "group of 3 words", then no, they're very biased. "raccows…
Just to add to why you would or would not want to use the passphrase vs. the abbreviation - I've personally found that I find it much easier to actually type a password that consists of words, names or "nonsense words" generated by Markov chains (though not usually ones generated by letter frequencies). I am often comfortable entering in a given password on a device on which I am not comfortable unlocking my password…
You could use the phrase if you liked, but each word is only 10 bits of entropy.
One nice thing about having a mnemonic for the password is that you don't have to remember the words precisely -- you can modify the mnemonic to suit your tastes as long as the prefix remains. I originally wrote it to generate passwords that I have to enter frequently (e.g. sudo), so being short was a goal.
I'm working on making actual passphrases with more entropy per word.
Re: MiniLock – File encryption software that does more with less
#84Earlier quoted context omitted.
Just to add to why you would or would not want to use the passphrase vs. the abbreviation - I've personally found that I find it much easier to actually type a password that consists of words, names or "nonsense words" generated by Markov chains (though not usually ones generated by letter frequencies). I am often comfortable entering in a given password on a device on which I am not comfortable unlocking my password…
You could use the phrase if you liked, but each word is only 10 bits of entropy. One nice thing about having a mnemonic for the password is that you don't have to remember the words precisely -- you can modify the mnemonic to suit your tastes as long as the prefix remains. I originally wrote it to generate passwords that I have to enter frequently (e.g. sudo), so being short was a goal. I'm working on making actual p…
Yeah, I assume that you can just have a non-deterministic expansion which will add some entropy per word to increase the entropy of the passphrase over the abbreviated version, but my point was just that even if there's no increase in security by using the full passphrase, counter-intuitively, using the full phrase would likely be more convenient for me (and probably for many others).
Re: MiniLock – File encryption software that does more with less
#85Earlier quoted context omitted.
It is in a "a feedback period", exactly so they can get the feedback like you just gave. So get off your high horse about taking things down.
Not really. The feedback period is for things like UX etc - this essentially makes the software (as usual for these homebrew efforts) much less secure than you think it is. When the primary reason that this software is at all secure is that it enforces a minimum entropy, if there's a bug in that then no one should use the software.
I don't see any evidence of the feedback being "for things like UX"
I also don't think the word homebrew is appropriate. Afaik homebrew means, 1 making beer at home. 2 apple package manager. 3. Term generally for endeavours connected to corporate products/projects but themselves small and independent.