5 ms·

I do not see more reasons to trust the OSX Keyring, than to trust a browser extension.

• knodi123 12y ago
  Do you think it's better to put all your eggs in one basket, or in two baskets?
  • TeMPOraL 12y ago
    Private keys are not fungible, if you lose one you're done, game over. By putting them in more places you're making yourself strictly less secure. Also, with that old and worn proverb about eggs and baskets, if having none of your eggs is equivalent in value to you for having only some but not all (i.e. you must have exactly all of them, or else you fail), then putting them all in one basket is better than putting in two (or more).
    • derefr 12y ago
      > By putting them in more places you're making yourself strictly less secure. If you're trying to minimize baskets, though, then having two very-secure baskets is much better than having N baskets ever-growing because you can't trust in their sturdiness. Which is to say, putting a USB with your private key on it in your safe-deposit box at your bank, for example, means being more assured about the fact that you'll have a backup copy, meaning you then feel safe excluding it from local hard-disk backups and synchronized remote backups/cloud storage, and have no reason to have it on any computers you aren't currently using for the sake of having somewhere to import it from. In a sense, you've added one vector of attack, but in practice, you've removed several.
• madeofpalk 12y ago
  At least in this case, there are a lot more eyes and attention on cracking OS X Keychain compared to this browser extension which most will forget about in a week or so.
  • ceejayoz 12y ago
    There are similarly a lot more eyes and attention on keeping OS X Keychain safe.
    • madeofpalk 12y ago
      Sorry, that was my point. There's a lot of effort going into cracking keychain, so there's a lot of attention on preventing these attacks from working.
• phn 12y ago
  Do you not trust the OSX Keyring because of apple? Or outside attackers? If it is apple you don't trust in this regard, keychain is the least of your problems. If it is outside attackers. At least they should need physical access to the machine to crack it, right? (If you don't back up that specific keychain to iCloud)
  • malka 12y ago
    Both, actually. I Think encryption should involve specialized hardware, such as a smart card. That way, it would NEVER ever be exposed to a network.
    • jpollock 12y ago
      In order to be used, it has to be exposed to the network.
      • malka 12y ago
        not really. You could imagine a smart card with a software (the smart card itself runs the software)that would take bytes[] as an input and would output the encrypted bytes. The only 'network' communication would be between the card and the computer, and the computer would be unable to access the private key stored on the card.
        • crdoconnor 12y ago
          Losing one of those things would not be fun.
          • zokier 12y ago
            Do you lose your house keys very often?
          • jtheory 12y ago
            Not quite the same thing, but I have a little (physical) keypad that HSBC provided to generate codes to sign in online. It's small, and flimsy, and my almost-2-year-old is fascinated with it -- when she manages to get her hands on it, she presses buttons and talks on it like it's a tiny phone... it's adorable, but one of these days it's going to decide she has "failed" my passcode too many times and it'll brick itself. And when I'm spending a month or two in Asia, for example, I have no illusions that I could possibly get another mailed to me, if it broke or was lost. These are great in terms of security, and should be an option for people who need it, but shouldn't be obligatory (I wouldn't use this for my bank if I had a better option).
• Istof 12y ago
  If you cannot trust OSX, there is no reason to trust a browser extension as it can be compromised... so why not stay at the lowest possible level.