3 ms·
>You'd never encrypt a password but leave all the filenames/directories viewable without the password... I'm still not convinced that it isn't acceptable to le
by rrego 11y ago
>You'd never encrypt a password but leave all the filenames/directories viewable without the password...
I'm still not convinced that it isn't acceptable to leave your filenames/usernames still visible without the password for ANY password manager.
The first point is a valid concern, but minor. His second point is really only relevant to this 1password service.
Reason I ask is because I use pass + remote git server. Pass doesn't encrypt the filenames so the files are easily searchable. Are there any risks to this method?
- FatalBaboon 11y agoI have the same setup (pass [0] + private git repository via Gitlab). Password-wise it is as safe as my ssh key + gpp key, so pretty strong. Metadata wise it is as safe as my ssh key + gitlab account (still pretty strong), or my linux session (WEAK). Then again the same goes for any password utility I guess, since you can view passwords stored in browsers in clear text anyway. [0]: http://www.passwordstore.org/ http://www.passwordstore.org/
- icebraining 11y agoThey're not exactly in clear text: Chrome and IE encrypt them with the Windows session key (meaning only software running as the same user can decrypt them); Firefox on the other hand encrypts them with 3DES-CBC using a master password, if you set one, which is supposedly secure even against software running as the same user.