3 ms·

"Having our passwords in plaintext is more secure than obfuscating them precisely because, when a user is not misled by a false sense of security, he is likely

by sjs 17y ago

"Having our passwords in plaintext is more secure than obfuscating them precisely because, when a user is not misled by a false sense of security, he is likely to use the software in a more secure manner." I'm sorry but this is bullshit. The reason for the (admittedly weak) obfuscation is to keep out the casual snooper, e.g. your little brother or sister who shares the family computer. It's not meant to keep out a skilled cracker, nor to protect those savvy enough to think about these issues. Why do we geeks tend to only think about things from our perspective? I think we should coin a phrase for it. Maybe the myth of the "sufficiently smart user".

tedunangst 17y ago
It's a tradeoff. "dumb user and smart attacker" vs "start user and dumb attacker". Most users' assessment of security is "Could I break it?" which isn't a very good standard in terms of protecting against even a slightly savvy sibling who can download one of the programs mentioned.
- sjs 17y ago
  You've missed an entire class of users. Believe it or not there are people who know nothing. Literally. They don't understand that when they save their password it's stored on their disk. They don't understand what a disk is, and they don't understand what a file is. They don't have the luxury of even thinking "could I break it", they are completely oblivious to the risks or how any part of the system works. A computer is like a television to these people. A black-box appliance. I was baffled but there are people out there - not senior citizens but 20 year olds - that really don't understand or care to understand any of that stuff. It's a magic box to them. They have no idea chat histories are stored on disk even though they see them in MSN. The fact that they have logged in makes them think no one else can see them. Likewise the fact that their saved password is stored is over their head unless someone explains it to them. Not everyone has someone to tell them these things.

by sjs 17y ago

tedunangst 17y ago

It's a tradeoff. "dumb user and smart attacker" vs "start user and dumb attacker". Most users' assessment of security is "Could I break it?" which isn't a very good standard in terms of protecting against even a slightly savvy sibling who can download one of the programs mentioned.

sjs 17y ago
You've missed an entire class of users. Believe it or not there are people who know nothing. Literally. They don't understand that when they save their password it's stored on their disk. They don't understand what a disk is, and they don't understand what a file is. They don't have the luxury of even thinking "could I break it", they are completely oblivious to the risks or how any part of the system works. A computer is like a television to these people. A black-box appliance. I was baffled but there are people out there - not senior citizens but 20 year olds - that really don't understand or care to understand any of that stuff. It's a magic box to them. They have no idea chat histories are stored on disk even though they see them in MSN. The fact that they have logged in makes them think no one else can see them. Likewise the fact that their saved password is stored is over their head unless someone explains it to them. Not everyone has someone to tell them these things.