4 ms·

So you have a paper on your wallet, which can be used to obtain every password you use, using an intricate and very specific "algorithm". Then you publish the

by samuel 16y ago

So you have a paper on your wallet, which can be used to obtain every password you use, using an intricate and very specific "algorithm". Then you publish the fact itself and the algorithm in your blog(real name), which, besides, doesn't depend on a passphrase (which could turn your method in a sort of dual factor authenticator). The paper could be photocopied and returned to your wallet and you'd never know. Please, don't talk me about how many bits of entropy your passwords have. They aren't secure.

lukeschlather 16y ago
Why do you believe he gave you the real algorithm?
- sophacles 16y ago
  Access to the piece of paper severely reduces the attack space, even if it isn't "go diagonal from (letter2, letter3) of domain name". Heck, it is not much different if it is a trivial transform on the characters themselves. Anything that a person could easily do (making the thing convenient enough to actually use) is not going significantly alter the number of permutations. Of course, this is making a big assumption that a targeted attack will go after the paper rather than say, the keyboard (which is generally much less secure than a wallet.). However, this being said, it is much more secure against untargeted attacks than the standard "i have an algorithms in my head" or "i use the same password" approach a lot of people use.
  - flogic 16y ago
    Once you're in the realm of targeted attacks you're in a whole different ball game. You have to consider who the attacker is likely to be and what they have access to. If your wallet isn't secure enough you can upgrade to a fire safe or some such. That narrows it do to people who you let in your home or are willing to break in. Beyond that though you're starting to enter into the realm of James Bond shit.
    - callahad 16y ago
      Or into the realm of two-factor auth. Sometimes I wonder why my roommate can get a security token for his World of Warcraft account, and I can't get one for my bank...

by samuel 16y ago

lukeschlather 16y ago

Why do you believe he gave you the real algorithm?

sophacles 16y ago
Access to the piece of paper severely reduces the attack space, even if it isn't "go diagonal from (letter2, letter3) of domain name". Heck, it is not much different if it is a trivial transform on the characters themselves. Anything that a person could easily do (making the thing convenient enough to actually use) is not going significantly alter the number of permutations. Of course, this is making a big assumption that a targeted attack will go after the paper rather than say, the keyboard (which is generally much less secure than a wallet.). However, this being said, it is much more secure against untargeted attacks than the standard "i have an algorithms in my head" or "i use the same password" approach a lot of people use.
- flogic 16y ago
  Once you're in the realm of targeted attacks you're in a whole different ball game. You have to consider who the attacker is likely to be and what they have access to. If your wallet isn't secure enough you can upgrade to a fire safe or some such. That narrows it do to people who you let in your home or are willing to break in. Beyond that though you're starting to enter into the realm of James Bond shit.
  - callahad 16y ago
    Or into the realm of two-factor auth. Sometimes I wonder why my roommate can get a security token for his World of Warcraft account, and I can't get one for my bank...