7 ms·
how do you login
by crummy 10y ago
how do you login
- herbst 10y agoIt's a huge difference to use system specific passwords on that specific system or to trust a properitary buggy system with passwords to other, potentially critical, services and infrastructure. Which IMO is purely negligently
- pilif 10y agoWhenever you click any "Save my password" option offered by any application on any OS, that password will need to be stored in some reversible encryption somehwere - there is just no way around it. And unless you want to type in a password every time you need to access any of these stored passwords (which would nearly defeat the purpose), then the application or OS needs to keep that password and/or key in memory somewhere. At that point, I would trust an application that runs with privileges that not even root can get (thanks to 10.11's rootless mode) much more than any other application, even given the eventual security flaw. This severely reduces the attack surface to only the keychain application itself and to the component that enforces the privileges, whereas in other cases any root-exploit will cause you to lose your passwords. In the year of 10.11's existence, no security flaw has been found in either system integrity protection (= rootless mode) nor in keychain (the bug listed here isn't a bug. if you ask keychain to give you the password, it will have to give you the password or there would be zero point in even storing it in the first place)
- herbst 10y agoi dont even know which version i run, so no idea if i have to be scared or not. updates are way to painful to do regulary on a working dev machine. (lazy linux user here) anyway i never saved a password, thats exactly my point. There is not a single reason to believe that the apple keychain can be fully trusted, its that simple.
- pilif 10y agoSo how do you manage your passwords you have for multiple sites?
- herbst 10y agoi use a password sheme, and if possible 2fa. A sheme is not perfect ether, but would require to attacker to fetch multiple of my passwords until he can recreate it.
- jrochkind1 10y ago> There is not a single reason to believe that the apple keychain can be fully trusted, its that simple. How do you believe that differs from any other cloud manager, local or cloud-hosted? What reason(s) do you have to believe they can be fully trusted? Or do you not use password managers at all? I assume you don't re-use passwords from site to site (because there's also no single reason to believe any particular site you log into can be fully trusted with a password you've used accross sites), I assume you use secure passwords (because you clearly prioritize security)... how do you remember them all?
- herbst 10y agoI dont use any of these but use the gnome keyring at home. Its OS, based on industrie standards and afaik never had serious issues. (It sure helps that linux has more restrictive user rights) On other places i use a password sheme, and if possible 2fa. A sheme is not perfect ether, but would require to attacker to fetch multiple of my passwords until he can recreate it.
- jrochkind1 10y agoWhat's a password sheme?
- herbst 10y agoEssentially something like this: Base Passwort: 123456, Rules: a = A, e = #, Platform: Hacker News, Connector: Social _, Money - Password: HAck#rN#ws_123456