Passwords Aren't As Secure As We Think - How to Fix That
lifehacker.com
Passwords Aren't As Secure As We Think - How to Fix That
1–10 of 17 posts
Re: Passwords Aren't As Secure As We Think - How to Fix That
#2"anyone with physical access to your PC" if that's the criterion, none of the proposed remedies really help. Someone with physical access to your machine or the ability to run privileged code will very likely get your passwords despite the quality of your Firefox master password.
Re: Passwords Aren't As Secure As We Think - How to Fix That
#3I would hope most people here would realize that if you click "save password" then your password is, well, saved...
Oh also, someone with physical access could just as well install a keylogger. It's a pretty difficult threat to guard against.
Re: Passwords Aren't As Secure As We Think - How to Fix That
#4I still prefer schemes without any kind of software for my passwords... Something like that:
http://blog.sucuri.net/2009/10/password-security-without-pas...
A javascript app for that would be good, btw :)
Re: Passwords Aren't As Secure As We Think - How to Fix That
#5"anyone with physical access to your PC" if that's the criterion, none of the proposed remedies really help. Someone with physical access to your machine or the ability to run privileged code will very likely get your passwords despite the quality of your Firefox master password.
Secure yourself by using secure habits (like locking your screen when you're away) and using strong passwords and then storing them somewhere.
A determined attacker with physical access to your system is basically impossible to stop. There are a myriad of ways they can figure out your password or log your keystrokes or memory to find it.
I feel that the real value in passwords is in securing network communications. In that case you simply need to be sure the protocol is secure and does not send the password over the wire (or air) in plain text or an easily extractable format.
The chance of someone trying to brute force your online accounts or sniffing your network traffic is much more likely than someone sneaking into your office and booting your desktop from a live CD. So I would rather have a very strong network password and a reasonably weak password manager passwords than not store my passwords and thus feel the pressure to make my online passwords easy to remember.
Re: Passwords Aren't As Secure As We Think - How to Fix That
#6"anyone with physical access to your PC" if that's the criterion, none of the proposed remedies really help. Someone with physical access to your machine or the ability to run privileged code will very likely get your passwords despite the quality of your Firefox master password.
And this is a solved problem: if you don't want people analyzing your preference files and/or caches, put at least one layer of encryption between the two. All modern OSes support encrypting your home directory, and most of them also support encrypting your hard drive in its entirety. In either case, physical access becomes pretty useless.
Re: Passwords Aren't As Secure As We Think - How to Fix That
#7I still prefer schemes without any kind of software for my passwords... Something like that: http://blog.sucuri.net/2009/10/password-security-without-pas... A javascript app for that would be good, btw :)
echo “qwerty http://www.facebook.com” | md5
You should never put any password or private key on a command line (any command line, not just in your terminal). Instead, use the unix-standard getpass function or it's equivalent in your language/library of choice.
Re: Passwords Aren't As Secure As We Think - How to Fix That
#8"Having our passwords in plaintext is more secure than obfuscating them precisely because, when a user is not misled by a false sense of security, he is likely to use the software in a more secure manner."
I'm sorry but this is bullshit. The reason for the (admittedly weak) obfuscation is to keep out the casual snooper, e.g. your little brother or sister who shares the family computer. It's not meant to keep out a skilled cracker, nor to protect those savvy enough to think about these issues.
Why do we geeks tend to only think about things from our perspective? I think we should coin a phrase for it. Maybe the myth of the "sufficiently smart user".
Re: Passwords Aren't As Secure As We Think - How to Fix That
#9I still prefer schemes without any kind of software for my passwords... Something like that: http://blog.sucuri.net/2009/10/password-security-without-pas... A javascript app for that would be good, btw :)
echo “qwerty http://www.facebook.com” | md5 That will appear in plain text in your terminal history file. And, if you are on a multi-user machine, even non-privileged users will be able to see your command line. You should never put any password or private key on a command line (any command line, not just in your terminal). Instead, use the unix-standard getpass function or it's equivalent in your language/library of…
I agree. What I said is that I do something similar to it, not exactly the same.. I have a little shell script that I run:
./pass-site.sh http://facebook.com
" #!/bin/sh
SITE=$1 stty -echo read UPASS stty echo PASS=`sha1 "$SITE $UPASS"` echo "PASS: $PASS" "
Re: Passwords Aren't As Secure As We Think - How to Fix That
#10"Having our passwords in plaintext is more secure than obfuscating them precisely because, when a user is not misled by a false sense of security, he is likely to use the software in a more secure manner." I'm sorry but this is bullshit. The reason for the (admittedly weak) obfuscation is to keep out the casual snooper, e.g. your little brother or sister who shares the family computer. It's not meant to keep out a sk…
It's a tradeoff. "dumb user and smart attacker" vs "start user and dumb attacker". Most users' assessment of security is "Could I break it?" which isn't a very good standard in terms of protecting against even a slightly savvy sibling who can download one of the programs mentioned.