4 ms·

I... what?

richard_rainbow 3y ago
Think of it this way: there is no reason to have any faith that encryption works anymore and no reason to believe that if you are interesting enough that some how enough determination will fail to reveal a secret. And also, it is complete foolishness to have a third party in possession of passwords. At least use a different one for every site for the kids who grab the rando plain text keystore on rando site. No detail about me is secret. I always am assured that God knows all. And Angels probably hate it when I look at dirty pictures and worse.
- ggm 3y ago
  So far you've indicated you don't use a second factor and you have a file. So, I'm going with you've chosen long passwords with good randomness which don't match the rainbow tables and exceed some brute force cost in time you impute the bad actors use as a "move on" threshold, and your second observation is avoid reuse so there's no cheap uplift into other services. I have no problem with your choices assuming I'm not wrong and I merely observe 2fa doesn't detract from this, and that bitwarden can be run as a server on your own hardware should you chose, or you can hand distribute the keys. The only advantage is prefilling and you may not care enough.
  - richard_rainbow 3y ago
    Rando site with rando signup has a non zero chance of being stupid enough to store the passwords in clear text. And I've had quite a few letters in the mail about disclosure that our accounts were hacked, were sorry, boo hoo for us, nuttin for you. But unless the site is completely bonk, I always make rando passwords with my special secret rando key maker which is called pwgen. I sleep easy knowing that all my secrets and my os is made by all organic free range programmers who never get mad they are being taken for a ride. But for a good cause you see. Software freedom is very important. Until that day bills need to be paid and you see, sometimes ingredients to computer food are not on the box. Oh hopefully I can tack on one last thing I think is just hard to ignore. Secret passwords in plain text are horrible I think people can agree. But people store many life details in clear files open at least to daemons and lots of little codes see even if on an encrypted drive. Think of things like tax returns, insurance forms, records for all kinds of things. Come to think of it, I never really safe guarded any of that stuff more than my plain text file that was actually encrypted and everything at one time. But no longer. And then finally, in my system dirs I have over 500,000 files. If open source is secure like a bazaar is, there couldn't be Ali Baba and 40 thieves in there someplace? Really? Sometimes ignorance is bliss. Until it isn't any more.
- eternityforest 3y ago
  I'm using passwords to hide from random scammers, not from the NSA. Also, password managers are just easier than copy and paste.
  - richard_rainbow 3y ago
    Not to mention that clipboards can be read in rando tab. I didn't say my way is perfect it is just that I've not been ruined yet by it. But now my secret is no longer a secret, its just a matter of time that <EOL>
- nabogh 3y ago
  Honestly this comes across as paranoid yet defeatist. You don't believe encryption works? Really? All encryption? Do you think cryptography researchers are all in collusion or just inept?
  - richard_rainbow 3y ago
    Paranoia is pretty common but I think in this case it is more realism than defeatism. After all I feel no defeat at all about this particular issue as I don't have much hope in the internet really. But don't you think quantum computers are mature somewhere by now? If you had one and you had secrets to maintain, would you be the one to spill the beans even if a VIP planning a war? I doubt the news will come as a result of a bank heist or a 51% attack. This is a Jinn that will never go back to the bottle it came from. RSA was passed on a long time ago and AES is pretty old. I don't think people can really grasp how much progress has been made. Most people I encounter have no idea that video can be completely faked. Recently I heard an old lady explain that video evidence is basically truth. Notice how easy the eyes are fooled. For those who have ears, may they hear. Hopefully my parent post doesn't vanish. I realize this is a tough pill to swallow. I am pretty sure we will all have to swallow it soon.
    - smoldesu 3y ago
      > But don't you think quantum computers are mature somewhere by now? Nope. No I don't. The amount of compute required to actually operate on Shor's algorithm is immense, to the point that it's probably smarter, faster and cheaper to bruteforce with traditional HPC these days.
      - richard_rainbow 3y ago
        Of course! It is a secret after all.
        deleted 3y ago
        [deleted]
    - 3y ago

I... what?

Think of it this way: there is no reason to have any faith that encryption works anymore and no reason to believe that if you are interesting enough that some how enough determination will fail to reveal a secret. And also, it is complete foolishness to have a third party in possession of passwords. At least use a different one for every site for the kids who grab the rando plain text keystore on rando site. No detail about me is secret. I always am assured that God knows all. And Angels probably hate it when I look at dirty pictures and worse.

ggm 3y ago
So far you've indicated you don't use a second factor and you have a file. So, I'm going with you've chosen long passwords with good randomness which don't match the rainbow tables and exceed some brute force cost in time you impute the bad actors use as a "move on" threshold, and your second observation is avoid reuse so there's no cheap uplift into other services. I have no problem with your choices assuming I'm not wrong and I merely observe 2fa doesn't detract from this, and that bitwarden can be run as a server on your own hardware should you chose, or you can hand distribute the keys. The only advantage is prefilling and you may not care enough.
- richard_rainbow 3y ago
  Rando site with rando signup has a non zero chance of being stupid enough to store the passwords in clear text. And I've had quite a few letters in the mail about disclosure that our accounts were hacked, were sorry, boo hoo for us, nuttin for you. But unless the site is completely bonk, I always make rando passwords with my special secret rando key maker which is called pwgen. I sleep easy knowing that all my secrets and my os is made by all organic free range programmers who never get mad they are being taken for a ride. But for a good cause you see. Software freedom is very important. Until that day bills need to be paid and you see, sometimes ingredients to computer food are not on the box. Oh hopefully I can tack on one last thing I think is just hard to ignore. Secret passwords in plain text are horrible I think people can agree. But people store many life details in clear files open at least to daemons and lots of little codes see even if on an encrypted drive. Think of things like tax returns, insurance forms, records for all kinds of things. Come to think of it, I never really safe guarded any of that stuff more than my plain text file that was actually encrypted and everything at one time. But no longer. And then finally, in my system dirs I have over 500,000 files. If open source is secure like a bazaar is, there couldn't be Ali Baba and 40 thieves in there someplace? Really? Sometimes ignorance is bliss. Until it isn't any more.
eternityforest 3y ago
I'm using passwords to hide from random scammers, not from the NSA. Also, password managers are just easier than copy and paste.
- richard_rainbow 3y ago
  Not to mention that clipboards can be read in rando tab. I didn't say my way is perfect it is just that I've not been ruined yet by it. But now my secret is no longer a secret, its just a matter of time that <EOL>
nabogh 3y ago
Honestly this comes across as paranoid yet defeatist. You don't believe encryption works? Really? All encryption? Do you think cryptography researchers are all in collusion or just inept?
- richard_rainbow 3y ago
  Paranoia is pretty common but I think in this case it is more realism than defeatism. After all I feel no defeat at all about this particular issue as I don't have much hope in the internet really. But don't you think quantum computers are mature somewhere by now? If you had one and you had secrets to maintain, would you be the one to spill the beans even if a VIP planning a war? I doubt the news will come as a result of a bank heist or a 51% attack. This is a Jinn that will never go back to the bottle it came from. RSA was passed on a long time ago and AES is pretty old. I don't think people can really grasp how much progress has been made. Most people I encounter have no idea that video can be completely faked. Recently I heard an old lady explain that video evidence is basically truth. Notice how easy the eyes are fooled. For those who have ears, may they hear. Hopefully my parent post doesn't vanish. I realize this is a tough pill to swallow. I am pretty sure we will all have to swallow it soon.
  - smoldesu 3y ago
    > But don't you think quantum computers are mature somewhere by now? Nope. No I don't. The amount of compute required to actually operate on Shor's algorithm is immense, to the point that it's probably smarter, faster and cheaper to bruteforce with traditional HPC these days.
    - richard_rainbow 3y ago
      Of course! It is a secret after all.
      - deleted 3y ago
        [deleted]
  - 3y ago