Said the company who didn't update their software for many months.
You have secrets; we don’t. Why our data format is public
11–20 of 42 posts
Re: You have secrets; we don’t. Why our data format is public
#12What password manager would you recommend for Linux? I use KeePassX but I wish I didn't have to copy-paste passwords onto website login forms.
None. Zero. Zilch. Nada.
Will people never learn? Do you realize what happens when your password manager itself gets compromised?
Using a password manager is trading security for conveniency. This is simply not acceptable.
I fully expect all the people using insecure security practice and all the people selling snake oil to downvote this.
The problem, however, is that you can't argue with facts. And the fact is that trading security for conveniency is a very stupid thing to do.
Re: You have secrets; we don’t. Why our data format is public
#13What password manager would you recommend for Linux? I use KeePassX but I wish I didn't have to copy-paste passwords onto website login forms.
I think Keepass2 requires Mono but if you're OK with installing that, then xdotools can be installed to autotype for you.
Re: You have secrets; we don’t. Why our data format is public
#14I love and use 1Password, but bear in mind that passwords are all it encrypts: the rest of the account details, such as URL, are stored in plaintext for an attacker to harvest. :(
Do you have a reference for this? I ask because when you drag an attachment to a entry, it states: "The file has been added as a secure attachment." Leading me to believe it's encrypted (along with everything else in the entry...).
~/Library/Application Support/1Password/1Password.agilekeychain/data/default/
~/Library/Application Support/1Password/1Password.agilekeychain/a/default/files
Re: You have secrets; we don’t. Why our data format is public
#15What password manager would you recommend for Linux? I use KeePassX but I wish I didn't have to copy-paste passwords onto website login forms.
None. Zero. Zilch. Nada. Will people never learn? Do you realize what happens when your password manager itself gets compromised? Using a password manager is trading security for conveniency. This is simply not acceptable. I fully expect all the people using insecure security practice and all the people selling snake oil to downvote this. The problem, however, is that you can't argue with facts. And the fact is that…
What would you recommend instead? If you insist people remember all of their passwords in their head, you'll end up with them using the same password for everything.
Re: You have secrets; we don’t. Why our data format is public
#16What password manager would you recommend for Linux? I use KeePassX but I wish I didn't have to copy-paste passwords onto website login forms.
None. Zero. Zilch. Nada. Will people never learn? Do you realize what happens when your password manager itself gets compromised? Using a password manager is trading security for conveniency. This is simply not acceptable. I fully expect all the people using insecure security practice and all the people selling snake oil to downvote this. The problem, however, is that you can't argue with facts. And the fact is that…
Using a password manager allows me to assign a different random password to every site I use. This means that, if a site that uses weak hashing gets hacked (a relatively common occurrence), none of my other accounts are compromised. Do you have another practical way to achieve this level of security?
Also, note that if my password manager is compromised, it means that the attacker has some level of access to my machine, since that is where my passwords are stored. In that case it is reasonably likely the attacker can also install a keylogger. This will reveal my often-used passwords even if I do not use a password manager.
Re: You have secrets; we don’t. Why our data format is public
#17Earlier quoted context omitted.
Do you have a reference for this? I ask because when you drag an attachment to a entry, it states: "The file has been added as a secure attachment." Leading me to believe it's encrypted (along with everything else in the entry...).
~/Library/Application Support/1Password/1Password.agilekeychain/data/default/ Only the password itself is encrypted. Everything else is just sitting there in JSON. ~/Library/Application Support/1Password/1Password.agilekeychain/a/default/files The attached files do appear to be encrypted, but I don't know how well. The names of the files aren't however, and they may be enough to expose or incriminate you.
Thanks for the paths. I've made some entries and checked what gets encrypted and seems some items in addition to the password are encrypted.
I'm seeing the 'Username' and 'Note' fields for example, for Login items as encrypted.
I found a summary[1] of why/what gets encrypted under "Individual Entry Contents".
[1]: http://help.agilebits.com/1Password3/agile_keychain_design.h...
Re: You have secrets; we don’t. Why our data format is public
#18What password manager would you recommend for Linux? I use KeePassX but I wish I didn't have to copy-paste passwords onto website login forms.
None. Zero. Zilch. Nada. Will people never learn? Do you realize what happens when your password manager itself gets compromised? Using a password manager is trading security for conveniency. This is simply not acceptable. I fully expect all the people using insecure security practice and all the people selling snake oil to downvote this. The problem, however, is that you can't argue with facts. And the fact is that…
Feel like providing a workable alternative, or are you just content to stay in your cloud of idealism with other thoughts like "everyone should change passwords for everything every 90 days"?
Re: You have secrets; we don’t. Why our data format is public
#19Earlier quoted context omitted.
None. Zero. Zilch. Nada. Will people never learn? Do you realize what happens when your password manager itself gets compromised? Using a password manager is trading security for conveniency. This is simply not acceptable. I fully expect all the people using insecure security practice and all the people selling snake oil to downvote this. The problem, however, is that you can't argue with facts. And the fact is that…
What would you recommend instead? If you insist people remember all of their passwords in their head, you'll end up with them using the same password for everything.
I think the most common is you have a single password, but you hash it with the name of the service you're logging into.
For example, if you're password is "puppy" and you're signing-up for HN, your password would be:
pHuApCpKy
And, if you wanted to make it stronger, salt it with some special characters.
p~Hu!Ap@Cp#Ky$
... which is just the shift-characters on a number row in order.
This way, you only have to remember one password, and it is service specific, and pretty strong. No password manager needed.
Of course, I don't do this. I use a 1Password and KeepassX.
Re: You have secrets; we don’t. Why our data format is public
#20I love and use 1Password, but bear in mind that passwords are all it encrypts: the rest of the account details, such as URL, are stored in plaintext for an attacker to harvest. :(
Do you have a reference for this? I ask because when you drag an attachment to a entry, it states: "The file has been added as a secure attachment." Leading me to believe it's encrypted (along with everything else in the entry...).
See this discussion [1] for example where they say this explicitly. Passwords and logins and other sensitive details are encrypted, but item titles (including note titles) and URLs are not.
They have a new keychain design [2] in which most metadata (including item titles) is encrypted. This is currently used for iCloud syncing, and they plan to roll it out for other sync methods and perhaps local storage as well [1]. I am guessing this will happen in the new OS X version.
[1] http://discussions.agilebits.com/discussion/12237/metadata-i...
[2] http://learn.agilebits.com/1Password4/Security/keychain-desi...