4 ms·

I don't think this criticism is that valid. LastPass et al are the same. After years of use I have no idea how someone would do that. It's like saying about cr

I don't think this criticism is that valid. LastPass et al are the same. After years of use I have no idea how someone would do that. It's like saying about credit cards - " but what if I randomly read the card number and pin out loud". I'm sure it could happen but it seems silly to bother criticising.

notatoad 9y ago
>but what if I randomly read the card number and pin out loud Except that's a reasonable scenario with an easy answer: If you compromise your credit card information, you call the issuer and you cancel the card.
- homakov 9y ago
  (That comes with associated risks of bank stealing your money, i.e. don't own them. Just an analogy, not a bitcoin zealot.)
IanCal 9y ago
I can change my master password with lastpass, is the same possible with securelogin?
notzorbo3 9y ago
I've typed my most sensitive password on public IRC once. I assumed my screen was locked while my display came back to life after sleep mode. For some reason, my screen wasn't locked and the IRC window had the focus instead. The great thing was that, even though that was my most sensitive password (the only that unlocks my desktop and encrypted folders), it didn't matter because all I had to do was immediately change the password in the only two places it was used. I will never trust generation of site-specific passwords from a single master password. Too many things could go wrong. There could be a bug in the derivation algorithm, crypto might become brute-forcable, etc.
- homakov 9y ago
  You can use get it here too: first part is truly random (store it locally) second is memorable. It gives you freedom to do it your way, unlike traditional approach where you have to backup a wallet no matter what.
- ezfe 9y ago
  Yeah, I've done this as well. Texted someone my laptop password because the macOS beta I was using had a delayed auto-unlock bug and I thought it had failed.
zwily 9y ago
No, it's not the same with 1password, etc. (I'm assuming LastPass works the same way as 1Password - a master password protecting a local database of passwords). My 1Password master password is useless without my database. If I accidentally typed it into Slack, I'd just change it in 1Password. This criticism does apply to all methods that use one master password to derive all other passwords. They necessarily have the master password as a single breaking point.

notatoad 9y ago

>but what if I randomly read the card number and pin out loud Except that's a reasonable scenario with an easy answer: If you compromise your credit card information, you call the issuer and you cancel the card.

homakov 9y ago
(That comes with associated risks of bank stealing your money, i.e. don't own them. Just an analogy, not a bitcoin zealot.)

IanCal 9y ago

I can change my master password with lastpass, is the same possible with securelogin?

notzorbo3 9y ago

I've typed my most sensitive password on public IRC once. I assumed my screen was locked while my display came back to life after sleep mode. For some reason, my screen wasn't locked and the IRC window had the focus instead. The great thing was that, even though that was my most sensitive password (the only that unlocks my desktop and encrypted folders), it didn't matter because all I had to do was immediately change the password in the only two places it was used. I will never trust generation of site-specific passwords from a single master password. Too many things could go wrong. There could be a bug in the derivation algorithm, crypto might become brute-forcable, etc.

homakov 9y ago
You can use get it here too: first part is truly random (store it locally) second is memorable. It gives you freedom to do it your way, unlike traditional approach where you have to backup a wallet no matter what.
ezfe 9y ago
Yeah, I've done this as well. Texted someone my laptop password because the macOS beta I was using had a delayed auto-unlock bug and I thought it had failed.

zwily 9y ago

No, it's not the same with 1password, etc. (I'm assuming LastPass works the same way as 1Password - a master password protecting a local database of passwords). My 1Password master password is useless without my database. If I accidentally typed it into Slack, I'd just change it in 1Password. This criticism does apply to all methods that use one master password to derive all other passwords. They necessarily have the master password as a single breaking point.