21–30 of 111 posts
If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you.
I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
But there are a number of problems:
1. How do you authenticate yourself with it? If you lose it you don't want the thief to be able to extract your passwords. You need to reintroduce the "something you know" factor (hard to enter passwords in keychain sized devices), or maybe "something you are" factor (fingerprint? RFID implant? only half joking, I'd consider it)
2. How do you perform backups without exposing the whole database to your hosts?
3. How do you interface with mobile devices? Public computers?
Until we solve "the password problem", what I'd really like is a small dedicated hardware password manager. Like Trezor ( http://www.bitcointrezor.com/ ) but for passwords. But there are a number of problems: 1. How do you authenticate yourself with it? If you lose it you don't want the thief to be able to extract your passwords. You need to reintroduce the "something you know" factor (hard to enter passwords in keyc…
The unknown thing is whether it should communicate directly to the computer, or have all communications mediated by the user. I'd be more comfortable if it only had one-way communications capability (user enters something on a device-local keypad, it sends data transmit-cable-only back to the computer), but that's not going to work with mobile, probably.
In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
Until we solve "the password problem", what I'd really like is a small dedicated hardware password manager. Like Trezor ( http://www.bitcointrezor.com/ ) but for passwords. But there are a number of problems: 1. How do you authenticate yourself with it? If you lose it you don't want the thief to be able to extract your passwords. You need to reintroduce the "something you know" factor (hard to enter passwords in keyc…
I'd like it to actually be hardware with tamper evidence (or response, even better), unlike trezor. That makes it a lot easier to use a weaker password or biometric to authenticate with it, safely. The unknown thing is whether it should communicate directly to the computer, or have all communications mediated by the user. I'd be more comfortable if it only had one-way communications capability (user enters something…
But it's pretty nice to be able to hit a keyboard shortcut and have it figure out which password to fill rather than scrolling through a list. It would be pain to enter all the site names without management software too.
As always, convenience vs security.
In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.
In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.
Earlier quoted context omitted.
What if you put release procedures in place that make it so your foreign offices will detect if a compromised release goes out? For instance, require code review from the foreign offices to approve building a new release, and require that the foreign offices build copies of the new release from the code they reviewed and that they verify that their builds match the release candidate binary before the release can go l…
An interesting thing for an open source project might be to put code-signing keys (for a reviewer) out with pseudonymous people on the Internet -- real identities unknown to the developers. I'd be happy to only use releases of 1Password which were signed by both AgileBits and a few nyms with a long history of being awesome (e.g. Satoshi).
Nicely done. I appreciate the stand they are taking here. That said, gag orders are gag orders. You can decide not to play as Lavabits did but you cannot reasonably tell some non-US employee to blab about your NSL since you will go to jail anyway and Federal Prison is Federal Prison.
In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.