4 ms·

At which point I call the company that makes the dongle and request another one. At the same time, they log into every site I use and create a new random passw

At which point I call the company that makes the dongle and request another one. At the same time, they log into every site I use and create a new random password for that site. The hardware key is just a token... it doesn't even need to be hardware. There just needs to be some trusted third party who can vouch that user U is at machine M at time T, and field all login requests on U's behalf without a lot of manual labor or memory work on U's part. For those cases where I don't want persistent representation, the service could be configured to ask me to enter a password when I first try to access any of the sites they handle for me, and every half-hour thereafter, or whatever. Facebook will be in a good position to do something like this before long, if they aren't already. I don't want to use Facebook logins for this because the company has far too much baggage in other areas. It needs to be a Verisign-type company that does nothing but logins and stores nothing but username/password pairs.

bigiain 15y ago
This is _so_ close to existing already - if I could hook Google's Authenticator app into 1Password with it's Dropbox integration, I'd have pretty much exactly what you're describing. Having said that, 1Password and Dropbox sync running on my phone, iPad, laptop, and desktop is actually a _very_ useable "single strong passphrase" multiple password management solution. Does anyone know how secure my iPassword database is when stored on the key-shared-with-anyone-Dropbox-allows encrypted S3 buckets? (or in my not-all-that-unlikely-to-get-lost-or-stolen phone/ipad/laptop.) Their page says they use openssl with 128bit keys, and I use an 18 character password (upper & lower case, spaces and punctuation, but with 3 dictionary words separated with punc/spaces). I'm reasonably happy that's "secure enough" for me - if anyone's going to get my passwords it'll most likely be by court order (or rubber hose cryptography) Of course, it's a closed-source app, so it'd take a fair bit of work to _prove_ to yourself that they're actually "doing the right thing" with the password database crypto.
bartl 15y ago
>At the same time, they log into every site I use and create a new random password for that site. Uh, wait. This means they can log in into every account of yours. How secure you think that is?
- CamperBob 15y ago
  It had better be very damned secure, obviously. There should be a process in place for ensuring (not to mention insuring) that. If not, well, that's part of the problem to be solved, isn't it?
billybob 15y ago
Call the company? Why can't you just log into their site and request a new one? :) Maybe you have to actually show up physically and give a DNA sample. Oh dang, you have an evil identical twin?
CamperBob 15y ago
Curious for the reason behind the downvotes. Questions: - Do you guys actually think the current situation is OK, with respect to the way Joe Sixpack and Jane Boxwine manage their security credentials? - Do you think the situation will magically get better on its own without some significant centralization? - Do you think social networking companies like Facebook or advertising companies like Google -- neither of whom consider end users to be their actual customers -- are the right ones to assume such a role?

bigiain 15y ago

This is _so_ close to existing already - if I could hook Google's Authenticator app into 1Password with it's Dropbox integration, I'd have pretty much exactly what you're describing. Having said that, 1Password and Dropbox sync running on my phone, iPad, laptop, and desktop is actually a _very_ useable "single strong passphrase" multiple password management solution. Does anyone know how secure my iPassword database is when stored on the key-shared-with-anyone-Dropbox-allows encrypted S3 buckets? (or in my not-all-that-unlikely-to-get-lost-or-stolen phone/ipad/laptop.) Their page says they use openssl with 128bit keys, and I use an 18 character password (upper & lower case, spaces and punctuation, but with 3 dictionary words separated with punc/spaces). I'm reasonably happy that's "secure enough" for me - if anyone's going to get my passwords it'll most likely be by court order (or rubber hose cryptography) Of course, it's a closed-source app, so it'd take a fair bit of work to _prove_ to yourself that they're actually "doing the right thing" with the password database crypto.

bartl 15y ago

>At the same time, they log into every site I use and create a new random password for that site. Uh, wait. This means they can log in into every account of yours. How secure you think that is?

CamperBob 15y ago
It had better be very damned secure, obviously. There should be a process in place for ensuring (not to mention insuring) that. If not, well, that's part of the problem to be solved, isn't it?

billybob 15y ago

Call the company? Why can't you just log into their site and request a new one? :) Maybe you have to actually show up physically and give a DNA sample. Oh dang, you have an evil identical twin?

CamperBob 15y ago

Curious for the reason behind the downvotes. Questions: - Do you guys actually think the current situation is OK, with respect to the way Joe Sixpack and Jane Boxwine manage their security credentials? - Do you think the situation will magically get better on its own without some significant centralization? - Do you think social networking companies like Facebook or advertising companies like Google -- neither of whom consider end users to be their actual customers -- are the right ones to assume such a role?