31–39 of 39 posts
My company makes this password manager: http://www.cloudentr.com/ Give it a try! You can secure all your passwords using your mobile phone as second factor of authentication.
"We encrypt your CloudEntr password with a cryptographic hash function – and make sure you’re the only one with the key. We also secure your web logins with AES-256 symmetric key encryption algorithm."
ISTR someone building a site out there that let you play with Google Authenticator on your own without messing with your Google account. Did I imagine that?
It used to generate a QR code for you to scan, but that's apparently broken.
I was completely shocked when I read this yesterday morning while drinking my morning coffee. The best outcome that could arise from the author disclosing his password is him receiving hundreds of texts that day. I understand the point he is making, but still a very risky move.
As long as his Twitter account was isolated[1], the only risk was losing control of his twitter account for a few days. And given the fact that he published an article previously saying that he was going to give away his password, I don't think that he would run into much trouble even if they used his twitter account for malicious purposes. [1]This is, the twitter account wasn't being used to log into other services.
I think two factor authentification is just an excuse to confirm your real identity, as it is much harder to obtain a fake phone number compared to a fake email address. I bet internally someone using two factor authentification is seen as more valuable to advertisers, since the phone number can probably be tied to a credit card record and other information collected by banks and other large real world companies. To…
And to the last 5% that use the "Log in with Twitter" buttons in order to avoid creating another (probably weak) password, 2-factor is invaluable since it protects not just our twitter network but any accounts that it has been linked to.
I think this is just illustrating precisely the point of two-factor authentication, which is defense in depth. Right now, you have one factor which means that anything that compromises that factor compromises you , and who knows what bizarre attacks someone can land once they've started penetrating your defenses. By publishing your password, you're going back down to a single factor (and in some ways it's worse than…
"a world where everyone carries around a cheap hardware authentication module" You mean you don't have ssh-agent and Google Authenticator on your mobile 'phone?
Also, Google Authenticator is similar to a really fancy password because it's a symmetric key system. It's nice because you only have to enter in one-time passwords on untrusted devices, but the downside is that both you and the service you're authenticating with has the same key, meaning that if either you or the service you're authenticating with is compromised, the attacker can authenticate as you. With SSL, the service being compromised doesn't actually get the attacker anything except your public key.
What about authenticating a logout? If someone is intercepting your communication, and you logout, how can you be sure that your logout has actually executed?
The "You have signed out" page could display a one-time code that should match a second set of seemingly randomly generated codes on your mobile phone.
Earlier quoted context omitted.
"a world where everyone carries around a cheap hardware authentication module" You mean you don't have ssh-agent and Google Authenticator on your mobile 'phone?
Well, what I mean is that we'd ideally have a situation where there are cheap dedicated hardware modules which contain your private key, so that you never have to trust your private key to a phone or a laptop. A phone can play that role and likely will at some point, but I'd still like something that is dumber than a phone, because I don't want the device itself to be able to harbor malware. Plus, the idea of such an…
Also a good point re GA - I'm not sure why it uses symmetric keys. When it first came out I'd have assumed it was for relative easy of data entry but now that even bash trivially displays QR codes it's due an update.
My company makes this password manager: http://www.cloudentr.com/ Give it a try! You can secure all your passwords using your mobile phone as second factor of authentication.
I could not find any technical details from Gemalto besides this blurb, which doesn't inspire confidence: "We encrypt your CloudEntr password with a cryptographic hash function – and make sure you’re the only one with the key. We also secure your web logins with AES-256 symmetric key encryption algorithm."
I met with the CloudEntr team to learn more about the technical implementation. They are working on a security page which will provide more details soon. In the meantime, I can share what I learned from them.
The CloudEntr password is stored hashed and salted on our servers, it is also used to encrypt and decrypt all the application passwords and notes within our web browser plug-in.
I will post the link to the security page once it is published! Thanks for your feedback.