13 ms·

1Password and the Crypto Wars

154 points by halostatue 13y ago

q_ 13y ago
req: lastpass's response
- jessedhillon 13y ago
  Could you link to it please?
  - deleted 13y ago
    [deleted]
  - Shank 13y ago
    LastPass has not made a direct statement. On their forums, however, a customer asked where data was hosted and this post was made by the CEO: LastPass is "host proof" hosted meaning that your sensitive data is encrypted with a key we at LastPass NEVER have, removing many of the concerns PRISM raises with most cloud service providers. LastPass can't be forced to give the encryption key to your data as it has never hit our servers! https://forums.lastpass.com/viewtopic.php?f=12&t=89195 https://forums.lastpass.com/viewtopic.php?f=12&t=89195
    - riquito 13y ago
      They could release a new binary that does register encryption keys, and you would never know it. They could even lie (not that I mean they do it, but if you need security, it can't be from a closed source application).
ChuckMcM 13y ago
Nicely done. I appreciate the stand they are taking here. That said, gag orders are gag orders. You can decide not to play as Lavabits did but you cannot reasonably tell some non-US employee to blab about your NSL since you will go to jail anyway and Federal Prison is Federal Prison.
- nwh 13y ago
  > But the very real possibility that we would shut ourselves down (which would be public) rather than sabotage what we do and love should act as some deterrent to those who might wish to compel us to introduce a backdoor. They've pretty much just said that they would shut down abruptly should an order ever come to them that they couldn't announce. Lavabit sets an interesting precedent really, I expect abrupt shutdowns to happen often this year.
  - unimpressive 13y ago
    >Lavabit sets an interesting precedent really "The office of La Batalla, the P.O.U.M. paper, which was not defended, had been raided and seized by the Civil Guards at about the same time as the Telephone Exchange, but the paper was being printed, and a few copies distributed, from another address... The Civil Guards were still occupying strategic points. Huge seizures of arms were being made from C.N.T. strongholds, though I have no doubt a good many escaped seizure. La Batalla was still appearing, but it was censored until the front page was almost completely blank. The P.S.U.C. papers were uncensored and were publishing inflammatory articles demanding the suppression of the P.O.U.M. The P.O.U.M. was declared to be a disguised Fascist organization, and a cartoon representing the P.O.U.M. as a figure slipping off a mask marked with the hammer and sickle and revealing a hideous, maniacal face marked with the swastika, was being circulated all over the town by P.S.U.C. agents... At various points in the town there were posts manned by Civil Guards of Carabineros who stopped passers-by and demanded their papers. Everyone warned me not to show my P.O.U.M. militiaman's card but merely to show my passport and my hospital ticket. Even to be known to have served in the P.O.U.M. militia was vaguely dangerous. P.O.U.M. militiamen who were wounded or on leave were penalized in petty ways--it was made difficult for them to draw their pay, for instance. La Batalla was still appearing, but it was censored almost out of existence, and Solidaridad and the other Anarchist papers were also heavily censored. There was a new rule that censored portions of a newspaper must not be left blank but filled up with other matter; as a result it was often impossible to tell when something had been cut out." - George Orwell, Homage to Catalonia (1938) I wouldn't expect that particular warning sign to persist for long.
    - 13y ago
tlrobinson 13y ago
Notable missing phrase: "open source"
- mwfunk 13y ago
  That's not a notably missing phrase, because it's not open source. Maybe it's notable because you don't trust closed source security products, but if so, you didn't say that. :) Not that I disagree with you. I use 1Password, but in my opinion the fact that it is closed source is definitely a mark against it. If there was anything built on top of, say, GPG that had remotely similar functionality, I would totally use that. Maybe there is and I don't know about it.
  - tlrobinson 13y ago
    "Maybe it's notable because you don't trust closed source security products, but if so, you didn't say that." Yes, that was my point :) That said, at least they document the format.
  - sk5t 13y ago
    You might be interested in STRIP[1] which is built on SQLite and SQLCipher, the latter being an open-source encryption codec for the former. It's up to the user to decide whether and how to use Dropbox, Google Drive, etc., for syncing. Disclosure: My employer makes STRIP. [1] http://getstrip.com/ http://getstrip.com/
  - SCdF 13y ago
    Does KeePass and derivatives count as remotely similar? They work well for me
mwfunk 13y ago
I use 1Password and have been really happy with it. It's not open source, but (I wasn't aware of this until I read this article) they do document the format used by their data file, and the encryption algorithms used: http://learn.agilebits.com/1Password4/Security/keychain-design.html http://learn.agilebits.com/1Password4/Security/keychain-desi...
rdl 13y ago
I love AgileBits (makers of 1Password). It's pretty clear that the highest risk is pure-cloud services. There, it's trivial to get a legal order or technical compromise to steal the data. A "hostproof", download-on-each-use app, like LastPass, is essentially the same risk as a cloud app. (this is the hushmail and lavabit vulnerability.) The safest is some kind of purely-client software, with local data, which operates online, and is never updated. Ideally open source, with a trustworthy build process. In between is software like 1Password. I wouldn't consider 1Password + Dropbox sync to be safe -- NSA has open-door access to Dropbox if they wish to get a single user's data (and possibly more). Tricking a user into download a compromised version of 1Password wouldn't be terribly difficult even without the cooperation of AgileBits. You can use 1Password more safely (local-only, infrequently updating, some kind of local-firewalling in the client, etc.). Without the client being open source, it's really difficult to do more. It's probably a hell of a lot safer on OSX than it is on iOS, since at least some OSX users are likely to do real network monitoring, or otherwise be on some kind of debugging enabled system, or something with just weird bugs, uncover a problem, and then dig into it and find a backdoor -- on mobile, there's little risk of that.
revelation 13y ago
Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780/which-products-use-cloud-keychain-and-which-use-agile-keychain http://discussions.agilebits.com/discussion/14780/which-prod...
- stayradiated 13y ago
  > To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. The Cloud Keychain format is currently used in 1Password 4 for iOS. 1Password 4 for Mac is also in public beta and will probably be released around the same time as OS X Mavericks.
  - leokun 13y ago
    Of coures useless to those using 1Password with Windows and Android.
  - teamgb 13y ago
    What comes first, security for users, or marketing a new release? If this new format is more secure and ready to roll out, why delay? What if Mavericks doesn't get released in October but gets pushed back to sometime next year?
- stock_toaster 13y ago
  Any good cross multi-device alternatives?
  - WA 13y ago
    Preferably with my own server (owncloud?) as a central keychain?
SCdF 13y ago
In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.
- laurent123456 13y ago
  Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.
  - lwhalen 13y ago
    Does 1Password have a Linux client? Looking at their page, they appear to only support Mac, Windows, iOS, and Android.
    - clebio 13y ago
      No, but it runs fine using Wine. I created a shell script to launch it with a key-stroke. If you want browser integration, you can run Firefox in Wine as well (or Chrome).
    - shawndumas 13y ago
      they create an HTML file in your Dropbox (when you sync) that you can hit with any browser.
      - jamesgeck0 13y ago
        Just opening the 1PasswordAnywhere html file in Firefox doesn't work. Something about Firefox's local file access policy. I serve the HTML file with `python -m SimpleHTTPServer` and visit localhost:8000 to use it.
tlrobinson 13y ago
Until we solve "the password problem", what I'd really like is a small dedicated hardware password manager. Like Trezor (http://www.bitcointrezor.com/ http://www.bitcointrezor.com/) but for passwords. But there are a number of problems: 1. How do you authenticate yourself with it? If you lose it you don't want the thief to be able to extract your passwords. You need to reintroduce the "something you know" factor (hard to enter passwords in keychain sized devices), or maybe "something you are" factor (fingerprint? RFID implant? only half joking, I'd consider it) 2. How do you perform backups without exposing the whole database to your hosts? 3. How do you interface with mobile devices? Public computers?
- rdl 13y ago
  I'd like it to actually be hardware with tamper evidence (or response, even better), unlike trezor. That makes it a lot easier to use a weaker password or biometric to authenticate with it, safely. The unknown thing is whether it should communicate directly to the computer, or have all communications mediated by the user. I'd be more comfortable if it only had one-way communications capability (user enters something on a device-local keypad, it sends data transmit-cable-only back to the computer), but that's not going to work with mobile, probably.
  - tlrobinson 13y ago
    You could emulate a keyboard, and have the Bluetooth/USB stacks implemented in dedicated chips, with a 1-way serial connection from the main MCU. But it's pretty nice to be able to hit a keyboard shortcut and have it figure out which password to fill rather than scrolling through a list. It would be pain to enter all the site names without management software too. As always, convenience vs security.
    - rdl 13y ago
      It would cost between 1/30th and 1/15th of a SCAR 17, though.
- devx 13y ago
  You can lose the USB key. I'd prefer an NFC ring, that unlocks everything as long as it's in my hand or close to my hand: http://www.kickstarter.com/projects/mclear/nfc-ring http://www.kickstarter.com/projects/mclear/nfc-ring
rorrr2 13y ago
DO NOT USE 1Password. If you care about security, there's absolutely no reason to use 1Password over an open source solution like KeePass. Even if 1Password doesn't have a backdoor now, nothing would stop NSA from inserting one and keep the owners quiet about it with a gag order. AgileBits is a US company, and so you cannot trust their security. Thank the US government for that.
- guygurari 13y ago
  AgileBits is a Canadian company, not a US company. This is also stated in the article.
- mannkind 13y ago
  From the linked article, "We have developers in four separate countries: Canada (AgileBits is a Canadian company), the United States, the United Kingdom, and the Netherlands." ... reading comprehension … There are good password managers, then there's KeyPass. :/
  - deleted 13y ago
    [deleted]
- Miyamoto 13y ago
  > If you care about security, there's absolutely no reason to use 1Password over an open source solution like KeePass. Uh, except it's Windows only? Sorry, I use 1Password only on my iPhone as if it were a hardware authenticator. No problems.
  - rorrr2 13y ago
    KeePass is open source. There are ports for every major OS. I used it on my android devices, for instance.
    - mannkind 13y ago
      KeePass basically only works well on Windows and you have to trust all the other implementations that make it pseudo-crossplatform. You mention "open-source" so much one would think its a weapon.
xiaomai 13y ago
I'm a huge fan of this command-line password manager: http://zx2c4.com/projects/password-store/ http://zx2c4.com/projects/password-store/ It's just a simple wrapper around gpg and (optionally) git. Makes it real easy to sync passwords between machines and you can be as confident as possible about the security.
- da_n 13y ago
  For someone who lives more and more on the command line Pass looks really nice. The only issue I have is that the lastpass importer is not working for me, tried it with 2 different version of Ruby but always get a NoMethodError. Adding 400+ passwords is going to be a huge pita.
logn 13y ago
AgileBits, if you're not not ok, then blink twice.
scrrr 13y ago
“I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” (Assuming being a Canadian company counts..)
- clebio 13y ago
  Is that a quote from the article, or do you just use quotes for emphasis of your own words?
  - riobard 13y ago
    It's from the Lavabit mail.
coldcode 13y ago
I think if your are building closed crypto products you need to be (1) not a US company (2) have multiple technical people in various different countries not likely to be politically compatible. Even better have no connections to the US at all other than selling products there. Then at least you have a chance to avoid the pressure to compromise.
jgalt212 13y ago
This is sort of funny: Back on June 6, 2013 David Pogue wrote a puff piece on Dashlane interesting quote: No system is foolproof. But Dashlane notes that it doesn’t ever see your passwords or your credit card information. They’re all stored on your own computer, encoded by the AES-256 encryption method, an open-source standard approved by the National Security Agency. http://www.nytimes.com/2013/06/06/technology/personaltech/too-many-passwords-and-no-way-to-remember-them-until-now.html?pagewanted=all&_r=0 http://www.nytimes.com/2013/06/06/technology/personaltech/to...

154 points by halostatue 13y ago

q_ 13y ago

req: lastpass's response

jessedhillon 13y ago
Could you link to it please?
- deleted 13y ago
  [deleted]
- Shank 13y ago
  LastPass has not made a direct statement. On their forums, however, a customer asked where data was hosted and this post was made by the CEO: LastPass is "host proof" hosted meaning that your sensitive data is encrypted with a key we at LastPass NEVER have, removing many of the concerns PRISM raises with most cloud service providers. LastPass can't be forced to give the encryption key to your data as it has never hit our servers! https://forums.lastpass.com/viewtopic.php?f=12&t=89195 https://forums.lastpass.com/viewtopic.php?f=12&t=89195
  - riquito 13y ago
    They could release a new binary that does register encryption keys, and you would never know it. They could even lie (not that I mean they do it, but if you need security, it can't be from a closed source application).

ChuckMcM 13y ago

Nicely done. I appreciate the stand they are taking here. That said, gag orders are gag orders. You can decide not to play as Lavabits did but you cannot reasonably tell some non-US employee to blab about your NSL since you will go to jail anyway and Federal Prison is Federal Prison.

nwh 13y ago
> But the very real possibility that we would shut ourselves down (which would be public) rather than sabotage what we do and love should act as some deterrent to those who might wish to compel us to introduce a backdoor. They've pretty much just said that they would shut down abruptly should an order ever come to them that they couldn't announce. Lavabit sets an interesting precedent really, I expect abrupt shutdowns to happen often this year.
- unimpressive 13y ago
  >Lavabit sets an interesting precedent really "The office of La Batalla, the P.O.U.M. paper, which was not defended, had been raided and seized by the Civil Guards at about the same time as the Telephone Exchange, but the paper was being printed, and a few copies distributed, from another address... The Civil Guards were still occupying strategic points. Huge seizures of arms were being made from C.N.T. strongholds, though I have no doubt a good many escaped seizure. La Batalla was still appearing, but it was censored until the front page was almost completely blank. The P.S.U.C. papers were uncensored and were publishing inflammatory articles demanding the suppression of the P.O.U.M. The P.O.U.M. was declared to be a disguised Fascist organization, and a cartoon representing the P.O.U.M. as a figure slipping off a mask marked with the hammer and sickle and revealing a hideous, maniacal face marked with the swastika, was being circulated all over the town by P.S.U.C. agents... At various points in the town there were posts manned by Civil Guards of Carabineros who stopped passers-by and demanded their papers. Everyone warned me not to show my P.O.U.M. militiaman's card but merely to show my passport and my hospital ticket. Even to be known to have served in the P.O.U.M. militia was vaguely dangerous. P.O.U.M. militiamen who were wounded or on leave were penalized in petty ways--it was made difficult for them to draw their pay, for instance. La Batalla was still appearing, but it was censored almost out of existence, and Solidaridad and the other Anarchist papers were also heavily censored. There was a new rule that censored portions of a newspaper must not be left blank but filled up with other matter; as a result it was often impossible to tell when something had been cut out." - George Orwell, Homage to Catalonia (1938) I wouldn't expect that particular warning sign to persist for long.
  - 13y ago

tlrobinson 13y ago

Notable missing phrase: "open source"

mwfunk 13y ago
That's not a notably missing phrase, because it's not open source. Maybe it's notable because you don't trust closed source security products, but if so, you didn't say that. :) Not that I disagree with you. I use 1Password, but in my opinion the fact that it is closed source is definitely a mark against it. If there was anything built on top of, say, GPG that had remotely similar functionality, I would totally use that. Maybe there is and I don't know about it.
- tlrobinson 13y ago
  "Maybe it's notable because you don't trust closed source security products, but if so, you didn't say that." Yes, that was my point :) That said, at least they document the format.
- sk5t 13y ago
  You might be interested in STRIP[1] which is built on SQLite and SQLCipher, the latter being an open-source encryption codec for the former. It's up to the user to decide whether and how to use Dropbox, Google Drive, etc., for syncing. Disclosure: My employer makes STRIP. [1] http://getstrip.com/ http://getstrip.com/
- SCdF 13y ago
  Does KeePass and derivatives count as remotely similar? They work well for me

mwfunk 13y ago

I use 1Password and have been really happy with it. It's not open source, but (I wasn't aware of this until I read this article) they do document the format used by their data file, and the encryption algorithms used: http://learn.agilebits.com/1Password4/Security/keychain-design.html http://learn.agilebits.com/1Password4/Security/keychain-desi...

rdl 13y ago

I love AgileBits (makers of 1Password). It's pretty clear that the highest risk is pure-cloud services. There, it's trivial to get a legal order or technical compromise to steal the data. A "hostproof", download-on-each-use app, like LastPass, is essentially the same risk as a cloud app. (this is the hushmail and lavabit vulnerability.) The safest is some kind of purely-client software, with local data, which operates online, and is never updated. Ideally open source, with a trustworthy build process. In between is software like 1Password. I wouldn't consider 1Password + Dropbox sync to be safe -- NSA has open-door access to Dropbox if they wish to get a single user's data (and possibly more). Tricking a user into download a compromised version of 1Password wouldn't be terribly difficult even without the cooperation of AgileBits. You can use 1Password more safely (local-only, infrequently updating, some kind of local-firewalling in the client, etc.). Without the client being open source, it's really difficult to do more. It's probably a hell of a lot safer on OSX than it is on iOS, since at least some OSX users are likely to do real network monitoring, or otherwise be on some kind of debugging enabled system, or something with just weird bugs, uncover a problem, and then dig into it and find a backdoor -- on mobile, there's little risk of that.

revelation 13y ago

Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780/which-products-use-cloud-keychain-and-which-use-agile-keychain http://discussions.agilebits.com/discussion/14780/which-prod...

stayradiated 13y ago
> To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. The Cloud Keychain format is currently used in 1Password 4 for iOS. 1Password 4 for Mac is also in public beta and will probably be released around the same time as OS X Mavericks.
- leokun 13y ago
  Of coures useless to those using 1Password with Windows and Android.
- teamgb 13y ago
  What comes first, security for users, or marketing a new release? If this new format is more secure and ready to roll out, why delay? What if Mavericks doesn't get released in October but gets pushed back to sometime next year?
stock_toaster 13y ago
Any good cross multi-device alternatives?
- WA 13y ago
  Preferably with my own server (owncloud?) as a central keychain?

SCdF 13y ago

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

laurent123456 13y ago
Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.
- lwhalen 13y ago
  Does 1Password have a Linux client? Looking at their page, they appear to only support Mac, Windows, iOS, and Android.
  - clebio 13y ago
    No, but it runs fine using Wine. I created a shell script to launch it with a key-stroke. If you want browser integration, you can run Firefox in Wine as well (or Chrome).
  - shawndumas 13y ago
    they create an HTML file in your Dropbox (when you sync) that you can hit with any browser.
    - jamesgeck0 13y ago
      Just opening the 1PasswordAnywhere html file in Firefox doesn't work. Something about Firefox's local file access policy. I serve the HTML file with `python -m SimpleHTTPServer` and visit localhost:8000 to use it.

tlrobinson 13y ago

Until we solve "the password problem", what I'd really like is a small dedicated hardware password manager. Like Trezor (http://www.bitcointrezor.com/ http://www.bitcointrezor.com/) but for passwords. But there are a number of problems: 1. How do you authenticate yourself with it? If you lose it you don't want the thief to be able to extract your passwords. You need to reintroduce the "something you know" factor (hard to enter passwords in keychain sized devices), or maybe "something you are" factor (fingerprint? RFID implant? only half joking, I'd consider it) 2. How do you perform backups without exposing the whole database to your hosts? 3. How do you interface with mobile devices? Public computers?

rdl 13y ago
I'd like it to actually be hardware with tamper evidence (or response, even better), unlike trezor. That makes it a lot easier to use a weaker password or biometric to authenticate with it, safely. The unknown thing is whether it should communicate directly to the computer, or have all communications mediated by the user. I'd be more comfortable if it only had one-way communications capability (user enters something on a device-local keypad, it sends data transmit-cable-only back to the computer), but that's not going to work with mobile, probably.
- tlrobinson 13y ago
  You could emulate a keyboard, and have the Bluetooth/USB stacks implemented in dedicated chips, with a 1-way serial connection from the main MCU. But it's pretty nice to be able to hit a keyboard shortcut and have it figure out which password to fill rather than scrolling through a list. It would be pain to enter all the site names without management software too. As always, convenience vs security.
  - rdl 13y ago
    It would cost between 1/30th and 1/15th of a SCAR 17, though.
devx 13y ago
You can lose the USB key. I'd prefer an NFC ring, that unlocks everything as long as it's in my hand or close to my hand: http://www.kickstarter.com/projects/mclear/nfc-ring http://www.kickstarter.com/projects/mclear/nfc-ring

rorrr2 13y ago

DO NOT USE 1Password. If you care about security, there's absolutely no reason to use 1Password over an open source solution like KeePass. Even if 1Password doesn't have a backdoor now, nothing would stop NSA from inserting one and keep the owners quiet about it with a gag order. AgileBits is a US company, and so you cannot trust their security. Thank the US government for that.

guygurari 13y ago
AgileBits is a Canadian company, not a US company. This is also stated in the article.
mannkind 13y ago
From the linked article, "We have developers in four separate countries: Canada (AgileBits is a Canadian company), the United States, the United Kingdom, and the Netherlands." ... reading comprehension … There are good password managers, then there's KeyPass. :/
- deleted 13y ago
  [deleted]
Miyamoto 13y ago
> If you care about security, there's absolutely no reason to use 1Password over an open source solution like KeePass. Uh, except it's Windows only? Sorry, I use 1Password only on my iPhone as if it were a hardware authenticator. No problems.
- rorrr2 13y ago
  KeePass is open source. There are ports for every major OS. I used it on my android devices, for instance.
  - mannkind 13y ago
    KeePass basically only works well on Windows and you have to trust all the other implementations that make it pseudo-crossplatform. You mention "open-source" so much one would think its a weapon.

xiaomai 13y ago

I'm a huge fan of this command-line password manager: http://zx2c4.com/projects/password-store/ http://zx2c4.com/projects/password-store/ It's just a simple wrapper around gpg and (optionally) git. Makes it real easy to sync passwords between machines and you can be as confident as possible about the security.

da_n 13y ago
For someone who lives more and more on the command line Pass looks really nice. The only issue I have is that the lastpass importer is not working for me, tried it with 2 different version of Ruby but always get a NoMethodError. Adding 400+ passwords is going to be a huge pita.

logn 13y ago

AgileBits, if you're not not ok, then blink twice.

scrrr 13y ago

“I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” (Assuming being a Canadian company counts..)

clebio 13y ago
Is that a quote from the article, or do you just use quotes for emphasis of your own words?
- riobard 13y ago
  It's from the Lavabit mail.

coldcode 13y ago

I think if your are building closed crypto products you need to be (1) not a US company (2) have multiple technical people in various different countries not likely to be politically compatible. Even better have no connections to the US at all other than selling products there. Then at least you have a chance to avoid the pressure to compromise.

jgalt212 13y ago

This is sort of funny: Back on June 6, 2013 David Pogue wrote a puff piece on Dashlane interesting quote: No system is foolproof. But Dashlane notes that it doesn’t ever see your passwords or your credit card information. They’re all stored on your own computer, encoded by the AES-256 encryption method, an open-source standard approved by the National Security Agency. http://www.nytimes.com/2013/06/06/technology/personaltech/too-many-passwords-and-no-way-to-remember-them-until-now.html?pagewanted=all&_r=0 http://www.nytimes.com/2013/06/06/technology/personaltech/to...