3 ms·

It's good to see the concept was named. Having a name for idea empowers. While the hypothetical defense (in the privacy protection context, not DRM) to close t

It's good to see the concept was named. Having a name for idea empowers. While the hypothetical defense (in the privacy protection context, not DRM) to close the Analog Hole would be to train human brain to make it consume encrypted stream and decrypt inside the skull, I'm disappointed to see that the trend is reverse. It's a pity that the above term is not brought about when discussing keepass/lastpass kind of tools that IMO do a disservice to personal security. They perversely expose your entire secret space to be vulnerable to Analog Hole. I know it sounds like dangerously off topic but I feel that the "Snowden case" begs the call for action. Snowden's response on "how to defend yourself" in June 2013 was: strong cryptography. Today his stance is less optimistic since encryption is never really end-to-end. That's why secret management seems to be the paramount issue of individual protection against totalitarian state. Convenience-over-security services don't make a good job here.

aptwebapps 12y ago
You may be getting hung up on this concept a little too much. Of course, using a password manager increases the attack surface in that if the encrypted passwords are stored on a server and the encryption wasn't good enough you're in trouble. But what you're talking about, where the plaintext password must be inserted into the web form, doesn't strike me as a vulnerability that would not exist without the password manager. If you simply memorized it you would still have to type it in. Moreover, keeping the password secret is not an end in itself, it's a tool to keep your actual secrets secret. If you login to some sort of account, and then access those secrets on your computer there's the analog hole again. If you don't have a computer on which it's safe to type in a password you don't have one on which it is safe to read or view your secrets.
- deleted 12y ago
  [deleted]

aptwebapps 12y ago

You may be getting hung up on this concept a little too much. Of course, using a password manager increases the attack surface in that if the encrypted passwords are stored on a server and the encryption wasn't good enough you're in trouble. But what you're talking about, where the plaintext password must be inserted into the web form, doesn't strike me as a vulnerability that would not exist without the password manager. If you simply memorized it you would still have to type it in. Moreover, keeping the password secret is not an end in itself, it's a tool to keep your actual secrets secret. If you login to some sort of account, and then access those secrets on your computer there's the analog hole again. If you don't have a computer on which it's safe to type in a password you don't have one on which it is safe to read or view your secrets.

deleted 12y ago
[deleted]