2 ms·

> Why is saving the password in your web browser or any application on your machine - that can also be hacked - considered secure? So you consider SSH (which n

by FabHK 6y ago

> Why is saving the password in your web browser or any application on your machine - that can also be hacked - considered secure? So you consider SSH (which normally relies on a private key stored locally) insecure? (Sure, the SSH key can be further protected with a passphrase, but so can the browser database of passwords. On a modern Mac, it requires unlocking with touch ID.)

nottorp 6y ago
So we have complex secrets that you have to store digitally because you can't memorize. Where? In a secure store. That has access to it protected by a secret you have to store. Digitally because you can't memorize it. And the store where you store the secret for your secure store for your secrets... A touch id protected secret store may be secure, and you lose access to your secrets if your laptop/phone gets stolen or breaks down? Or do you back it up to another store protected by different authentication that you have to store? Looks like you cannot win to me. The only advantage of generated complex passwords is that they'd be harder to brute force if the server has their password database stolen.