3 ms·
So by definition your password manager master key is weak? That's an interesting paradox!
by simias 9y ago
So by definition your password manager master key is weak? That's an interesting paradox!
- BoorishBears 9y agoIt's remembering one password vs X, and it is pretty hard to remember in my case, almost 4 months into using this password and I still struggle to type it in correctly sometimes
- simias 9y agoYeah I was just kidding, I see what the parent meant. Now I use a hardware token (yubikey) to store my PGP key so I can use a relatively weak PIN code on it (since you need to have physical access to the device to use it and you only have 3 attempts before it locks up). It's a pretty good quality of life improvement.
- majewsky 9y ago> you only have 3 attempts before it locks up Then you better don't use it when you're fatigued or drunk. I nearly locked my SIM card once by not realizing until the third attempt that my phone was asking for the SIM card PIN rather than my lockscreen PIN.
- simias 9y agoThere's also an "admin PIN" that can be used to unlock the key if something goes wrong. It's more complicated than my regular PIN and I didn't memorize it so that should be enough as a defensive measure against drunk me. Well, unless I'm silly enough to try and bruteforce that PIN as well, after 3 failures I'd be left with an expensive piece of plastic... Fortunately I'm rarely that drunk. EDIT: Actually as the sibling comment points out you can still reset the token even if you mess up the admin PIN. So at least you won't "brick" your token completely.
- tokenizerrr 9y agoEven if you mess that up, you can reset it, but it'll wipe. Then you restore from cold backup.
- deleted 9y ago[deleted]
- 0xfeba 9y agoMy password? Sure it's weak I guess. The keyfile? No.
- zeveb 9y agoWell, the password manager master key encrypts a local file, so an attacker must have access to your machine first. And it's only one password to remember, as opposed to a high-strength password for every single site one uses.
- rkeene2 9y agoI don't even have the ability to read my password manager's master key, since all passwords are encrypted with different AES keys, which is then encrypted with a private key I have no ability to read (only ask my smartcard to perform RSA on, if I can authenticate to it). hunter2 is the password manager I wrote for this: https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/
- moosingin3space 9y agoThis is an interesting concept for storing keys. I may end up using something similar in a proof-of-concept I've been thinking about.
- palunon 9y agoWhat if you loose your smartcard ?
- mazamats 9y agoHe could have an encrypted digital copy somewhere else
- rkeene2 9y agoI don't keep my private key, in any format, accessible -- usually the private keys are generated on the card and never revealed.
- rkeene2 9y agohunter2 supports the concept of users, which are named public keys so I can share individual passwords with other users. One of those other users can be a different smartcard or a different person who can then authorized my new card.