171–180 of 185 posts
Earlier quoted context omitted.
Honest question: If you send it on the email without storing (just sending appending the $password variable to the email body), what would be the problem?
Some email is still sent unencrypted over the web so people snooping on traffic could see it.
If you can trust X enough to not allow social engineering for password resets then it provides at least as much security as a memorized passphrase. Google provides Advanced Account Protection for people who really need it.
Hopefully most sites start allowing multiple federated identities per account so that anyone worried about keeping all their eggs in one basket can maintain and attach more than one identity.
For any X meeting the above criteria they're going to be a much harder target than any random online service accepting the federated credentials (this applies to insider threats and external attackers alike).
X doesn't exist for you? Help build it. There's no specific reason that Facebook, Apple, and Google should be the only trusted identity providers on the web, but they do invest significant effort in minimizing account theft and hardening their infrastructure, and most eat their own dogfood to protect their corporate assets. The big advantage that Apple and Google have is that they can tie identity to biometric and physical factors in a way that's hard for anyone else to achieve.
Once computing implants are widely in use identity can move to that but until then we have cell phones that, paired with U2F hardware, can be the root of trusted identity and (with a passphrase and lock screen timeouts) are practically immune to anything below state-level actors. 0-day exploits exist but they're sold to state actors and held in reserve.
Note: This only applies to online services. Memorize your device encryption keys for local data security; there's no way around that.
Earlier quoted context omitted.
I thought that algorithm was crazy magic when I first heard of it. The method behind it is pretty fascinating. A nth degree polynomial is uniquely identified by n+1 points. So the algorithm interprets your secret to a binary numeric value, sets that as the value at x=0 (i.e. the constant term of the polynomial), picks random coefficients for all the polynomial degrees, then computes coordinate pairs for however many…
While it's a clever method, it's also worth noting that for moderately-sized groups you can achieve the same thing with a much simpler method and almost no math. Let's say you have a 256 bit key as the secret, and you want any 5 out of 15 people to have access. For each combination of 5 people, pick 4 random 256 bit numbers. 4 people get those and 1 gets the key encrypted with those numbers as a one time pad. Once yo…
Or just use federated authentication ala log-in-with-X with non-SMS 2FA protecting the identity account. SAML, OIDC, and friends are immune to dictionary attacks, leaks, rainbow tables, cross-site re-use, and all the other password problems. If you can trust X enough to not allow social engineering for password resets then it provides at least as much security as a memorized passphrase. Google provides Advanced Accou…
Earlier quoted context omitted.
Around 5 years ago I wrote something very similar, for the same reasons as you. It was never intended to be more than a proof of concept, but I've ended up using it most every day. Mine is web based, but all implemented in the front-end; no data is ever sent to the server. I was debating whether to post the URL, because I don't really want a bunch of people to start depending on it the way I do (I have zero plans to…
> Your verification code is 120179. You can use it to verify your seed password in the future. What does this mean? And how is it used to verify a password?
If there's generic malware that's targeting your password manager, then yes this provides protection against that. But it doesn't provide protection against a targeted attack, because the malware can just keylog your horcrux. Another weakness that doesn't require a keylogger, is the attacker might be able to find some stolen database of a website that stored passwords in plaintext, then deduce your horcrux from the d…
I wrote a program to generate passwords based on user input about 10 years ago. I still use it today and a few teams I have worked with still use it. I called it DPG. Deterministic Password Generator. It is a similar concept. I have implemented it in Go, C++, Java and Python. I wish the idea of generating passwords when needed rather than storing and retrieving them was more popular. Traditional password Managers are…
Around 5 years ago I wrote something very similar, for the same reasons as you. It was never intended to be more than a proof of concept, but I've ended up using it most every day. Mine is web based, but all implemented in the front-end; no data is ever sent to the server. I was debating whether to post the URL, because I don't really want a bunch of people to start depending on it the way I do (I have zero plans to…
So if I need to change my 'amazon' password, I press 'generate different codes'. Then when I need to use my amazon password, I come back and click the 'generate different codes' to retrieve the new password?
What is the best way to use this for a service where the password frequently changes?
Earlier quoted context omitted.
Around 5 years ago I wrote something very similar, for the same reasons as you. It was never intended to be more than a proof of concept, but I've ended up using it most every day. Mine is web based, but all implemented in the front-end; no data is ever sent to the server. I was debating whether to post the URL, because I don't really want a bunch of people to start depending on it the way I do (I have zero plans to…
Thank you for this. So if I need to change my 'amazon' password, I press 'generate different codes'. Then when I need to use my amazon password, I come back and click the 'generate different codes' to retrieve the new password? What is the best way to use this for a service where the password frequently changes?
But if you come from a different browser, you'll need to click 'generate different codes' again to advance to the correct password.
For services where the password frequently changes, I don't think there's a very practical way to use this. At least not across several different browsers.
In what world is my social media account more important than bank account?