4 ms·

Google has actually made it even less of a hassle by instead trusting a computer forever instead of having the session last 30 days [1]. This can be seen two w

Google has actually made it even less of a hassle by instead trusting a computer forever instead of having the session last 30 days [1]. This can be seen two ways though: less of a hassle for the user, and less secure. I wonder why Google doesn't give the option for the session lasting 30 days or forever. [1] http://i.imgur.com/A9Wu5.png http://i.imgur.com/A9Wu5.png

graeme 14y ago
That's horrible. It was already very easy, I don't see the need.
- rdl 14y ago
  You don't have as many computers as I do, or as long a password as I do, I suspect. Having to type a random long passphrase with special characters on the weird keyboards of multiple devices every month was a pain. Even worse, for devices I infrequently use, I ended up basically having to do this every single time I wanted to use the device.
  - evanmoran 14y ago
    http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines
    - zalew 14y ago
      so if someone wants access to all your passwords, he just needs to compromise your dropbox.
      - halostatue 14y ago
        If it works at all like 1Password…no. Not if you have even a half-decent master password.
      - mkenyon 14y ago
        Something that has happened in the past on more than one occasion.
      - rdl 14y ago
        dropbox plus either passphrase brute force (or guessing), or one of (keylogger, compelled disclosure, shoulder surfing, ...) + dropbox. I consider the 1Password file sensitive enough that it shouldn't be online, especially not with dropbox. I'd prefer if there were physical protection for it somehow, too (like a smartcard or FIPS module, which wouldn't allow bulk-export normally, and which might impose other rules on use like 5 passwords per hour when outside my home network, etc.) Same way you handle high-security private keys. (Ultimately I'm not going to be happy until I have a trusted tablet of some kind, but building that either requires being Apple or waiting for WP8 hardware to come out and investing about $5mm in some serious security upgrades. Maybe worthwhile, though, since it solves the general problem of trusting client devices.)
        dchest 14y ago
        Now sure if PasswordSafe allows using key file, as sbov mentioned above for Keepass, but if it's properly implemented, and you didn't put the key file into Dropbox, it would be pretty much impossible to brute force.
    - fpgeek 14y ago
      While I appreciate the concept, I don't think Dropbox is the company to trust for this kind of thing: http://arstechnica.com/security/2012/07/dropbox-confirms-it-got-hacked-will-offer-two-factor-authentication/ http://arstechnica.com/security/2012/07/dropbox-confirms-it-...
    - sbov 14y ago
      I like to use keepass with a long, memorable password and key file that I need to manually copy across machines. So even if they get my password database and my password they don't have the key file. And if they can get the key file, they could have gotten the password database anyways.

graeme 14y ago

That's horrible. It was already very easy, I don't see the need.

rdl 14y ago
You don't have as many computers as I do, or as long a password as I do, I suspect. Having to type a random long passphrase with special characters on the weird keyboards of multiple devices every month was a pain. Even worse, for devices I infrequently use, I ended up basically having to do this every single time I wanted to use the device.
- evanmoran 14y ago
  http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines
  - zalew 14y ago
    so if someone wants access to all your passwords, he just needs to compromise your dropbox.
    - halostatue 14y ago
      If it works at all like 1Password…no. Not if you have even a half-decent master password.
    - mkenyon 14y ago
      Something that has happened in the past on more than one occasion.
    - rdl 14y ago
      dropbox plus either passphrase brute force (or guessing), or one of (keylogger, compelled disclosure, shoulder surfing, ...) + dropbox. I consider the 1Password file sensitive enough that it shouldn't be online, especially not with dropbox. I'd prefer if there were physical protection for it somehow, too (like a smartcard or FIPS module, which wouldn't allow bulk-export normally, and which might impose other rules on use like 5 passwords per hour when outside my home network, etc.) Same way you handle high-security private keys. (Ultimately I'm not going to be happy until I have a trusted tablet of some kind, but building that either requires being Apple or waiting for WP8 hardware to come out and investing about $5mm in some serious security upgrades. Maybe worthwhile, though, since it solves the general problem of trusting client devices.)
      - dchest 14y ago
        Now sure if PasswordSafe allows using key file, as sbov mentioned above for Keepass, but if it's properly implemented, and you didn't put the key file into Dropbox, it would be pretty much impossible to brute force.
  - fpgeek 14y ago
    While I appreciate the concept, I don't think Dropbox is the company to trust for this kind of thing: http://arstechnica.com/security/2012/07/dropbox-confirms-it-got-hacked-will-offer-two-factor-authentication/ http://arstechnica.com/security/2012/07/dropbox-confirms-it-...
  - sbov 14y ago
    I like to use keepass with a long, memorable password and key file that I need to manually copy across machines. So even if they get my password database and my password they don't have the key file. And if they can get the key file, they could have gotten the password database anyways.