3 ms·

Related interesting read: Why pidgin doesn't store passwords encrypted https://developer.pidgin.im/wiki/PlainTextPasswords https://developer.pidgin.im/wiki/Plai

by Too 9y ago

Related interesting read: Why pidgin doesn't store passwords encrypted https://developer.pidgin.im/wiki/PlainTextPasswords https://developer.pidgin.im/wiki/PlainTextPasswords I guess the moral of both stories are, if you want your passwords really encrypted, lock your OS user account and use full drive encryption.

fauigerzigerk 9y ago
And never run any programs that you don't trust with all of your passwords? That doesn't seem realistic.
- claudius 9y ago
  Why would you run untrusted programs? And if you do, why are passwords so much more sensitive than your entire browsing history, all your emails and e.g. all your not-passphrase-protected SSH keys?
  - fauigerzigerk 9y ago
    >Why would you run untrusted programs? Because I don't have time to read the source code of every version of every open source library/tool, or make sure the deployment process of all software I use is secure, or keep track of who controls these projects. >And if you do, why are passwords so much more sensitive than your entire browsing history, all your emails Because none of that allows anyone to take over my important accounts, steal my money or take my backups hostage. It's also much more difficult and inefficient to upload or parse gigabytes of documents and emails or keep a keylogger running undetected than it is to upload one small password file to the attacker's server. >not-passphrase-protected SSH keys? I don't have any of those.
- Too 9y ago
  Android and iOS provide sandboxes for applications so you can install less trustworthy apps with smaller risk. Desktop OS's should really catch up here. Maybe not to the extreme level as iOS where there isn't even a concept of file system but at least provide a separate safe storage location for each application. Every application shouldn't have to reinvent encryption of its storage just so other apps can't read the data.

by Too 9y ago

fauigerzigerk 9y ago

And never run any programs that you don't trust with all of your passwords? That doesn't seem realistic.

claudius 9y ago
Why would you run untrusted programs? And if you do, why are passwords so much more sensitive than your entire browsing history, all your emails and e.g. all your not-passphrase-protected SSH keys?
- fauigerzigerk 9y ago
  >Why would you run untrusted programs? Because I don't have time to read the source code of every version of every open source library/tool, or make sure the deployment process of all software I use is secure, or keep track of who controls these projects. >And if you do, why are passwords so much more sensitive than your entire browsing history, all your emails Because none of that allows anyone to take over my important accounts, steal my money or take my backups hostage. It's also much more difficult and inefficient to upload or parse gigabytes of documents and emails or keep a keylogger running undetected than it is to upload one small password file to the attacker's server. >not-passphrase-protected SSH keys? I don't have any of those.
Too 9y ago
Android and iOS provide sandboxes for applications so you can install less trustworthy apps with smaller risk. Desktop OS's should really catch up here. Maybe not to the extreme level as iOS where there isn't even a concept of file system but at least provide a separate safe storage location for each application. Every application shouldn't have to reinvent encryption of its storage just so other apps can't read the data.