5 ms·

Bruce Schneier still recommends using copy and paste to transfer passwords from a password manager to the browser: https://www.schneier.com/blog/archives/2014/0

by sedachv 12y ago

Bruce Schneier still recommends using copy and paste to transfer passwords from a password manager to the browser: https://www.schneier.com/blog/archives/2014/09/security_of_pas.html https://www.schneier.com/blog/archives/2014/09/security_of_p... I've been using Emacs and GPG files (one for personal stuff, one for work accounts) as a password manager since GNU Emacs 22 came out with GPG integration in 2007. Works almost anywhere without needing any other applications. I back up the GPG files to remote servers and keep my private keys on several private devices to get the benefit of remote backups without the risk. Both iOS and Android are pretty much designed as surveillance devices, I would not recommend putting your private keys or password list on them.

Someone1234 12y ago
> Bruce Schneier still recommends using copy and paste to transfer passwords from a password manager to the browser That's just a justification for his password manager which has no other way to transfer passwords. There's no security benefit. Keyloggers don't literally "log keys." A stream of typed keys with no context is utterly useless. Particularly when the goal is automated data theft (rather than a dedicated attacker targeting you personally). Most keyloggers are embedded somewhere on the HTTP stack (e.g. browser extensions/plugins, Win32 message hooking (e.g. steal the password from a specifically named element when that element is destroyed), TCP driver, etc). Why do otherwise intelligent people continue to think that malware literally logs their keys? Even a cursory thought about the subject would flag all kinds of issues and better alternatives. I strongly suggest everyone with an interest in the topic go grab some malware source code and read. It isn't like it is hard to find.

5 ms·

Bruce Schneier still recommends using copy and paste to transfer passwords from a password manager to the browser: https://www.schneier.com/blog/archives/2014/0

by sedachv 12y ago

Someone1234 12y ago
> Bruce Schneier still recommends using copy and paste to transfer passwords from a password manager to the browser That's just a justification for his password manager which has no other way to transfer passwords. There's no security benefit. Keyloggers don't literally "log keys." A stream of typed keys with no context is utterly useless. Particularly when the goal is automated data theft (rather than a dedicated attacker targeting you personally). Most keyloggers are embedded somewhere on the HTTP stack (e.g. browser extensions/plugins, Win32 message hooking (e.g. steal the password from a specifically named element when that element is destroyed), TCP driver, etc). Why do otherwise intelligent people continue to think that malware literally logs their keys? Even a cursory thought about the subject would flag all kinds of issues and better alternatives. I strongly suggest everyone with an interest in the topic go grab some malware source code and read. It isn't like it is hard to find.