21–30 of 42 posts
What password manager would you recommend for Linux? I use KeePassX but I wish I didn't have to copy-paste passwords onto website login forms.
LastPass?
Also: https://grepular.com/LastPass_Vulnerability_Exposes_Account_...
I love and use 1Password, but bear in mind that passwords are all it encrypts: the rest of the account details, such as URL, are stored in plaintext for an attacker to harvest. :(
It goes without saying that you'd want to keep all the fields of a secret encrypted but it's also important to note that the plaintext fields can offer clues about the nature of the encrypted parts.
Calling a secret "Bank account" (plaintext) and only encrypting the PIN code tells an intruder that what is encrypted is a 4 digit code ranging from 0000-9999. If instead you encrypt the entire record the nature of the contents is entirely unknown.
I have respect for the fine folks at AgileBits but I don't agree with their approach to security and took the more thorough approach I mention above in KEYBOX.
I love and use 1Password, but bear in mind that passwords are all it encrypts: the rest of the account details, such as URL, are stored in plaintext for an attacker to harvest. :(
It's true that in the Agile Keychain Format item title and URL are not encrypted, but it is a mistake to think that only passwords are encrypted. That's not how it works.
The details of exactly what is and what isn't encrypted in the Agile Keychain Format is documented in the first link in the article. (And has been since the day the Agile Keychain Format was introduced). The rationale for that design choice was spelled out later in http://help.agilebits.com/1Password3/cloud_storage_security....
among other places.
Attachments are encrypted. Other than some meta data (modify times and the like) the only things that aren't encrypted are the Location (URL) and the Title. Earlier versions of the AgileKeychain format also left password strength unencrypted, but that was changed (and announced) years ago.
And as we've promised, we are moving to a new format that encrypts everything (except some things such as modify time). The 1Password Cloud Keychain format is documented here:
http://learn.agilebits.com/1Password4/Security/keychain-desi...
When we first promised this, we weren't sure how we would achieve the three goals of having:
(1) Everything encrypted. (2) Only decrypting a single item at a time. (3) Efficient listing and matching of items to websites.
To understand how we've managed to achieve all three you need to take a look at the details of the Cloud Keychain Format.
Currently, the Cloud Keychain Format is only used for syncing data between 1Password 4 on iOS devices. But it will eventually replace the Agile Keychain Format everywhere.
Cheers,
-j
Earlier quoted context omitted.
What would you recommend instead? If you insist people remember all of their passwords in their head, you'll end up with them using the same password for everything.
I think the most common is you have a single password, but you hash it with the name of the service you're logging into. For example, if you're password is "puppy" and you're signing-up for HN, your password would be: pHuApCpKy And, if you wanted to make it stronger, salt it with some special characters. p~Hu!Ap@Cp#Ky$ ... which is just the shift-characters on a number row in order. This way, you only have to remembe…
To be honest, firefox has an encrypted database of site-passwords. What's wrong with that?
[deleted]
[deleted]
Do you keep the true crypt volume on your SD card too?
> Note that I don't have to worry about losing the cred files themselves, because I don't store them on me [on the SD card]; I only keep the keyfile [on the SD card].
You could keep a copy of the TrueCrypt volume there, but besides making the SD card more worthwhile as a theft target [they would only need it + your master password, not it + your master password + knowledge of and access to your Dropbox], it introduces versioning/sync difficulties when you add or change keys. You're almost unilaterally using these keys to speak to remote hosts anyway, so you're going to be online enough to get to your Dropbox whenever you need them.
Earlier quoted context omitted.
I'm wondering this also, only on OSX. I love Keepass on Windows, but the lack of auto-type on OSX is killing me. Bonus points for something which makes having a central repo of shared passwords possible, Keepass is terrible for this.
I'm working on something like this at the moment, which will be released within the next few months. I can email you when it's ready if you're interested?
I'd like to see a helluva lot of proof that you're a legit company before trusting you with this kind of information.
I say this not to discourage you, but just to explain how a business owner will think about your premise. Or at least me, don't know if this is representative of your actual audience or not.
In any case let me know when it's up, I'd love to take a look!
Earlier quoted context omitted.
I think the most common is you have a single password, but you hash it with the name of the service you're logging into. For example, if you're password is "puppy" and you're signing-up for HN, your password would be: pHuApCpKy And, if you wanted to make it stronger, salt it with some special characters. p~Hu!Ap@Cp#Ky$ ... which is just the shift-characters on a number row in order. This way, you only have to remembe…
I like the idea of hashing off a root word + site. I'd rather have the browser do it for me though, and I don't think there's anything on the page itself that I could depend on to hash with. Maybe the domain? To be honest, firefox has an encrypted database of site-passwords. What's wrong with that?