4 ms·

I am not familiar with Team Viewer but you’re correct: any software that allows you to “save passwords for later use” is writing your password to disk/cloud — m

I am not familiar with Team Viewer but you’re correct: any software that allows you to “save passwords for later use” is writing your password to disk/cloud — maybe reversibly encrypted but decipherable all the same, especially if the keys are held locally for offline use. IIRC Chrome used to do this until 2013, for example, and resisted fixing it saying your OS account should protect you[1]. I suspect these days it’s encrypted to your Google Account as it’s synced, and additionally requires you to re-enter your OS password. [1] https://news.ycombinator.com/item?id=6166793 https://news.ycombinator.com/item?id=6166793 PS. Does anyone know what Firefox does these days with their master password, especially now that they too ship a password manager? Their master password approach was similarly criticised [2]. [2] https://nakedsecurity.sophos.com/2018/03/20/nine-years-on-firefoxs-master-password-is-still-insecure/ https://nakedsecurity.sophos.com/2018/03/20/nine-years-on-fi...

nightcracker 7y ago
This is trivially solvable by salted hashing twice, once client side (which then can get saved post hash) and once server side.
- marcinzm 7y ago
  That doesn't help you since you authenticate using the client hash so knowing that lets you authenticate remotely anyway. It only protects you against a password that was reused for something else as well.
  - nightcracker 7y ago
    > It only protects you against a password that was reused for something else as well. That was the thing I was protecting against... Of course, no matter what form the access token takes when you press "Keep me logged in" allows you to authenticate remotely.
dx034 7y ago
Firefox encrypts passwords with your master password. The clear downside is that you lose all data if you forget your password. That's clearly good for security but I don't think it's an option for most services.

nightcracker 7y ago

This is trivially solvable by salted hashing twice, once client side (which then can get saved post hash) and once server side.

marcinzm 7y ago
That doesn't help you since you authenticate using the client hash so knowing that lets you authenticate remotely anyway. It only protects you against a password that was reused for something else as well.
- nightcracker 7y ago
  > It only protects you against a password that was reused for something else as well. That was the thing I was protecting against... Of course, no matter what form the access token takes when you press "Keep me logged in" allows you to authenticate remotely.

dx034 7y ago

Firefox encrypts passwords with your master password. The clear downside is that you lose all data if you forget your password. That's clearly good for security but I don't think it's an option for most services.