Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Master password in Firefox or Thunderbird? Do not bother

palant.de

Post reply on HN
Print view View original

61–70 of 94 posts

Re: Master password in Firefox or Thunderbird? Do not bother

#61

Post by Buge »

kzrdude wrote: post #24
gweinberg wrote: post #20

Earlier quoted context omitted.

That would be true if the password were 16 random ascii characters. But of course it's not. It's almost certainly only using printable characters, and probably has something a lot like words in it.

Just to chip another little piece off, ascii is a 7-bit encoding, and the 8th bit is clear, so that makes 16 × 7 = 112 bits if we use any ascii byte (0..=128). I'd count 6 bits per letter (64 different characters) as a rough estimate for realistic passwords.

English text has 1.46 bits of entropy per character.

https://www.gwern.net/docs/statistics/1996-teahan.pdf

Re: Master password in Firefox or Thunderbird? Do not bother

#62

Post by Buge »

kuschku wrote: post #28
user15128 wrote: post #23

Earlier quoted context omitted.

maybe i am wrong, but i think you did not read the full article? "This article estimates that the average password is merely 40 bits strong, and that estimate is already higher than some of the others. In order to guess a 40 bit password you will need to test 2^39 guesses on average. If you do the math, cracking a password will take merely a minute on average then. Sure, you could choose a stronger password. But find…

I did, but that assumes the average person. This is HN, not Facebook, so we can make different assumptions. E.g., we can assume that everyone has read the famous XKCD on passwords, and is using passwords that are a bunch of words after another, in lowercase ascii, which would get us somewhere around 80 bits of security, and still keep it memorable.

That xkcd comic recommends a password that by its own estimate is 44 bits of entropy. Why do you assume a HN user would choose something stronger than that?

Re: Master password in Firefox or Thunderbird? Do not bother

#63

Post by eridius »

acdha wrote: post #21
eikenberry wrote: post #3

I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.

There’s a long running ticket to do this on OS X which started out as NIH/apathy but gained a good reason not to as Apple restricted iCloud password support to App Store applications. https://bugzilla.mozilla.org/show_bug.cgi?id=152485

That ticket is marked as resolved and the last update is 16 years ago.

Also this is the first I've heard that iCloud keychain sync only syncs keychain items created from App Store applications, and color me quite skeptical on that. Apple previously restricted the iCloud file and Key-Value Store functionality to App Store apps, but for keychain syncing it's just a single flag given to the item when creating it. Also I just checked the documentation for kSecAttrSynchronizable and there's no mention whatsoever of it being restricted to App Store apps.

Re: Master password in Firefox or Thunderbird? Do not bother

#64

Post by Dylan16807 »

Buge wrote: post #60
stouset wrote: post #52

Earlier quoted context omitted.

For what it’s worth, assuming an alphabet of 72 characters (52 letters, 10 digits, 10 symbols), this is ridiculously higher entropy than a 128-bit encryption key. There is no absolutely no need for your password to be this long. Even just twenty characters is within spitting distance of 2^128.

>For what it’s worth, assuming an alphabet of 72 characters (52 letters, 10 digits, 10 symbols), this is ridiculously higher entropy than a 128-bit encryption key. No it's not. User-chosen data is rarely random, so it's safe to say that Santosh83's password is not random. This article claims English has 1.46 bits of entropy per character[1]. If Santosh83's password is regular English, then it would have ~105 bits of…

If we take the post at face value, it's strong overkill. Face value means that "46 characters from the full set" is even vaguely descriptive of the password.

Sure, perhaps it's just a phrase or something, but once you start calling part of a post a lie where do you stop? I'd rather not get into such a mess.

Re: Master password in Firefox or Thunderbird? Do not bother

#66

Post by Buge »

Dylan16807 wrote: post #64
Buge wrote: post #60

Earlier quoted context omitted.

>For what it’s worth, assuming an alphabet of 72 characters (52 letters, 10 digits, 10 symbols), this is ridiculously higher entropy than a 128-bit encryption key. No it's not. User-chosen data is rarely random, so it's safe to say that Santosh83's password is not random. This article claims English has 1.46 bits of entropy per character[1]. If Santosh83's password is regular English, then it would have ~105 bits of…

If we take the post at face value, it's strong overkill. Face value means that "46 characters from the full set" is even vaguely descriptive of the password. Sure, perhaps it's just a phrase or something, but once you start calling part of a post a lie where do you stop? I'd rather not get into such a mess.

I never said any part of the post was a lie. Most people's passwords are not random. The word "password" doesn't mean random. So there isn't a reason to assume that the password is random. xkcd's recommended password is 25 characters, and 44 bits of entropy. Extrapolating that out would mean a 46 character password would be 81 bits of entropy.

Yes, "from the full set" likely means that it's higher than 1.46 bits/character. But it doesn't mean it's much more.

Re: Master password in Firefox or Thunderbird? Do not bother

#67

Post by singularity2001 »

Santosh83 wrote: post #42

Everyone suggesting to use a bigger and/or more random string are missing the point that your average user won't do that. As a sort of computer nerd, my master password is 46 characters from the full set of letters, numbers, symbols and in both cases. It took me a week to memorise it flawlessly. Do we really think a regular user will take this effort? Instead they will continue using their simple, short passwords (if…

also you can your save your one long master password on a yubi key so you never have to type it.

Re: Master password in Firefox or Thunderbird? Do not bother

#68

Post by fyfy18 »

zitterbewegung wrote: post #59
pzxc wrote: post #47

Earlier quoted context omitted.

The alternative is not to give up on password management completely, but to use a proper password manager like KeePass.

What if you took Firefox or chrome and replaced the password manager with a keepass compatible system by default and kept the usability?

If password managers are going to become popular for end users it needs to be something that’s built into the browser and interopable. I’d love to see this turned into a standard that all browser and device manufacturers (when I log into an app on my phone the password manager should be integrated) can implement.

Re: Master password in Firefox or Thunderbird? Do not bother

#69

Post by fauigerzigerk »

Too wrote: post #65

Related interesting read: Why pidgin doesn't store passwords encrypted https://developer.pidgin.im/wiki/PlainTextPasswords I guess the moral of both stories are, if you want your passwords really encrypted, lock your OS user account and use full drive encryption.

And never run any programs that you don't trust with all of your passwords? That doesn't seem realistic.

Re: Master password in Firefox or Thunderbird? Do not bother

#70

Post by Santosh83 »

stouset wrote: post #52
Santosh83 wrote: post #42

Everyone suggesting to use a bigger and/or more random string are missing the point that your average user won't do that. As a sort of computer nerd, my master password is 46 characters from the full set of letters, numbers, symbols and in both cases. It took me a week to memorise it flawlessly. Do we really think a regular user will take this effort? Instead they will continue using their simple, short passwords (if…

For what it’s worth, assuming an alphabet of 72 characters (52 letters, 10 digits, 10 symbols), this is ridiculously higher entropy than a 128-bit encryption key. There is no absolutely no need for your password to be this long. Even just twenty characters is within spitting distance of 2^128.

Perhaps, but it is not completely random. It is composed of the first letters from the words making up a phrase (which by the way is not from a poem/prose or any existing writing; entirely my own), some upper & some lowercase, prefixed and suffixed with a sequence of numbers and symbols. So it has much more order than a random sequence of 46 symbols, but unless you keylog/phish me or something like that, I don't believe it can be brute-forced anytime soon, which is why I went for a (over?)long, unique phrase.

KeePass reports it as having 222 bits entropy although I don't know how accurate an analysis that is.

Post reply on HN