3 ms·

This was brought up last time - but even having something like the path "./Banking/bankofamerica.com" visible on the filesystem is a disclosure of sensitive inf

This was brought up last time - but even having something like the path "./Banking/bankofamerica.com" visible on the filesystem is a disclosure of sensitive information, even if the password is encrypted at-rest. Otherwise I love the idea of *nix based philosophy for password management =)

tanderson92 8y ago
This is why pass-tomb was invented.
- folkhack 8y ago
  Excellent - thanks for the heads up =) Will be looking into this to replace a KeePass DB!
nickjj 8y ago
The path does leak some information but in that case the bad actor would also need to know the username along with the password (both of which would be encrypted). But you have to ask yourself. Who are you protecting against here? Are people browsing around your laptop / workstation without you monitoring what they're doing? If someone has your machine without your consent, then you're pretty much screwed because 99.99999% of people will leave themselves logged into things like gmail which requires no password to access it once the machine is powered on. It's basically this xkcd scenario: https://xkcd.com/1200/ https://xkcd.com/1200/
- folkhack 8y ago
  > Are people browsing around your laptop / workstation without you monitoring what they're doing? Nope - but the industry that I work in constantly assumes "bad actors" are present. Although it's not perfect - everything is 2FA, all disks on laptops encrypted, there are strict rules in dealing with secrets/sensitive information, etc. My main concern is if someone were able to do a rip of my home directory. Trust me - there's a TON of room for improvement, but doing some general protection against someone with "shell" access is something I'm in the practice of... it's the same reason I carefully manage what ends up in my .zsh_history or .bash_history =) > If someone has your machine without your consent, then you're pretty much screwed Agreed. Encrypt the disk (I trust LUKS), lock your machine when not in-use, ensure it shuts itself down if a password is "fat-fingered" more than twice, use solid passwords with good complexity, use 2FA when you can/should, etc.

tanderson92 8y ago

This is why pass-tomb was invented.

folkhack 8y ago
Excellent - thanks for the heads up =) Will be looking into this to replace a KeePass DB!

nickjj 8y ago

The path does leak some information but in that case the bad actor would also need to know the username along with the password (both of which would be encrypted). But you have to ask yourself. Who are you protecting against here? Are people browsing around your laptop / workstation without you monitoring what they're doing? If someone has your machine without your consent, then you're pretty much screwed because 99.99999% of people will leave themselves logged into things like gmail which requires no password to access it once the machine is powered on. It's basically this xkcd scenario: https://xkcd.com/1200/ https://xkcd.com/1200/

folkhack 8y ago
> Are people browsing around your laptop / workstation without you monitoring what they're doing? Nope - but the industry that I work in constantly assumes "bad actors" are present. Although it's not perfect - everything is 2FA, all disks on laptops encrypted, there are strict rules in dealing with secrets/sensitive information, etc. My main concern is if someone were able to do a rip of my home directory. Trust me - there's a TON of room for improvement, but doing some general protection against someone with "shell" access is something I'm in the practice of... it's the same reason I carefully manage what ends up in my .zsh_history or .bash_history =) > If someone has your machine without your consent, then you're pretty much screwed Agreed. Encrypt the disk (I trust LUKS), lock your machine when not in-use, ensure it shuts itself down if a password is "fat-fingered" more than twice, use solid passwords with good complexity, use 2FA when you can/should, etc.