4 ms·
OK, I freely admit that I'm not an expert in this area, so I'll rescind my "silly" comment. But, "drastically weaker" than what? If the password is strong, JD
by sunchild 15y ago
OK, I freely admit that I'm not an expert in this area, so I'll rescind my "silly" comment.
But, "drastically weaker" than what? If the password is strong, JD doesn't make it weak. JD just doesn't make it as strong as it should/could? Is this correct?
- cperciva 15y agoBut, "drastically weaker" than what? If the password is strong, JD doesn't make it weak. JD just doesn't make it as strong as it should/could? Is this correct? Correct. The vast majority of people can't remember strong passwords, so it's necessary to "strengthen" them using a good key derivation function. Jungle Disk doesn't do this.
- sunchild 15y agoOK, well, I guess I don't see how that's fairly described as a "flaw" in JungleDisk. I can understand why a responsible developer should assume their users are simple-minded, mouth-breathers who can't be trusted to choose a proper password (and I'm sure there's plenty of evidence to support that assumption), but it just isn't right to characterize JungleDisk as compromised from a security perspective because it relies on the user to choose a strong password.
- cperciva 15y agoSaying that Jungle Disk is secure as long as users pick strong passwords is like saying that the Ford Pinto is safe as long as drivers don't get into rear-end collisions. In both cases you're asking for behaviour which we know perfectly well that users don't exhibit; and in both cases there is a simple fix for the problem. The Ford Pinto is an unsafe car, and Jungle Disk is an insecure backup service.
- sunchild 15y agoI'm trying to understand this. Again, I'm no expert. I can see why the data integrity issues may allow external factors to compromise the security of my buckets and/or local device. That's me in a Pinto, at the mercy of the bad driver behind me. I don't see how password strength is open to any external factor; it would seem to be purely a matter of user error. That part doesn't seem to fit the Pinto analogy. That's where I'm struggling to follow your article.
- cperciva 15y agoIf you're a good driver, you'll be paying attention to the traffic behind you and avoid being rear-ended. But ultimately what it comes down to is that if 99% of users make a particular error, it isn't useful to say "oh, that's user error".
- sunchild 15y agoOK. I think I understand now. I still don't think it's fair to call it defective design (and I'm not really certain that you ever did call JD's password privacy defective, BTW). More like a design that is unsafe in the hands of the typical driver, perhaps. Why do I care? I just want to understand the risks for someone like me, who has taken care to choose very strong passwords. My conclusions from all of this: (1) The data integrity issue is serious because it presents an opportunity for introduction of malicious code, creates a risk of data loss, and may lead to security breaches. (2) The local binary is opaque, and therefore presents a theoretical risk of compromising even the most "close to the vest" key management strategy. (3) The password protection issue is a serious shortcoming that can, and should, be mitigated by choosing strong passwords. Yes?!