61–70 of 185 posts
It seems to me that this does not add a lot of security if you use the same extra word for all passwords. It probably does add a lot of security if you use a different extra word for each password, but then you can't remember them anymore and you need to write them down somewhere.
If there's generic malware that's targeting your password manager, then yes this provides protection against that. But it doesn't provide protection against a targeted attack, because the malware can just keylog your horcrux. Another weakness that doesn't require a keylogger, is the attacker might be able to find some stolen database of a website that stored passwords in plaintext, then deduce your horcrux from the d…
>And if no password databases are available, the attacker can create a website and ask you to join it under the hope you'll reuse your horcrux on the attacker's site. Some sites email your password to you: https://plaintextoffenders.com/
1) A site that emails you your password might not be storing it in plain text. They're similar but separate problems.
2) A site that sends you a login link could be just as bad as the sites listed here, if that login link doesn't expire (and you used a unique password). It's a more subtle way of having the same problem.
If there's generic malware that's targeting your password manager, then yes this provides protection against that. But it doesn't provide protection against a targeted attack, because the malware can just keylog your horcrux. Another weakness that doesn't require a keylogger, is the attacker might be able to find some stolen database of a website that stored passwords in plaintext, then deduce your horcrux from the d…
> attacker can create a website and ask you to join it under the hope you'll reuse your horcrux on the attacker's site. I don't think that reusing the same pepper (horcrux string) for all sites would be best practice.
Joking aside, I don't see the point of this. It guards against exactly one attack (your password manager somehow revealing all your passwords) which is unlikely, but not against a whole lot of other (slightly more generic malware, phishing, ...) whilst making logging in harder (there's now a manual process).
If you're willing to go such lengths, enable 2FA on more accounts (which the articles mentions, points for that) or get a physical token for your password manager.
1. You have to copy/type the password manually, instead of relying on your password manager to recognize the website, leaving you more vulnerable to phishing.
2. More manual entry... I a world where I use passwords around a hundred times per day, I don't want to type them.
Also, it's easy to avoid the two risks he mentions:
1. Don't write your master password on a post-it, duh.
2. Don't leave your session open when getting a coffee.
I'll stick with the standard practice.
It seems to me that this does not add a lot of security if you use the same extra word for all passwords. It probably does add a lot of security if you use a different extra word for each password, but then you can't remember them anymore and you need to write them down somewhere.
But if your pw manager gets compromised then that’s a pretty big problem so probably best to focus efforts on that not happening.
It could make sense for sensitive accounts like email, valuable social media etc
I don't like raid-0 for passwords.
It is much better to use a password manager than trying to remember poorly crafted passwords in your head. But also really/truly remember not to really put all your eggs in one proverbial basket. Password managers are not without dangers: 1. If you forget your master password or secret key (you need both to setup a new device), you are screwed. 2. If the password manager cloud sync service (like 1password) decides to…
I somewhat recently made my personal disaster recovery plan, and the password manager features prominently into it. If I lose all of my electronic devices in a sudden accident, how can I recover my online life? To address your questions specifically: 1. I used Shamir's secret sharing to send out a copy of my secret key to a few loved ones. The master password is in my memory only. If I forget the master password, I l…
As a regular person, you have to consider these possible attacks on your money/data:
1. Attacker is a person in your life – friend/family/acquaintance – targeted you specifically. Attack may not be very sophisticated and maybe easy to defend against if basic hygiene is followed.
2. Attacker is a remote entity – people who you don't know personally – you were not targeted personally – but you became a target because you are part of a cohort they targeted – nothing personal. Attack of this form can be quite sophisticated.
3. Thief is a govt entity (foreign or domestic) – because you were targeted directly or because you are connected to someone who was targeted directly. More than technical mechanism there are legal mechanisms at play here.
#2 is a very big threat. A password manager service company is a very attractive target for them. Imagine the recent SolarWinds Orion supply chain attack being done by an underground cyber criminal group and being chained together to compromise your favorite password manager service stack.
Earlier quoted context omitted.
All security eventually relies on obscurity, it's a bad idea to disclose your security practices. Use hunter2 as password for junk sites.
Can you elaborate on why all security will eventually rely on obscurity?
I saw this post a while ago in a different forum. My note for it hasn't changed: This is called peppering[0]. It's a counterpart to salting, in that you add a random value to a password to make it harder to reverse the password hash, but unlike the salt, it's not stored in the password database. 0: https://en.wikipedia.org/wiki/Pepper_(cryptography)
It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.