3 ms·

Ok, i thought you mean you will see an incoming email. Anyway, is it critical to know or not if your account was breached? If it's breached nothing else matters

by homakov 12y ago

Ok, i thought you mean you will see an incoming email. Anyway, is it critical to know or not if your account was breached? If it's breached nothing else matters. Safari manager is probably great, like other managers. But my scheme is for developers not for end users. You can't make everyone use pw managers, but link on demand is super helpful This can added as an option. Some use password, some use on demand link. Everyone's happy

stephenr 12y ago
> is it critical to know or not if your account was breached? If it's breached nothing else matters. This comment is terrifying, given that you are making claims and suggestions about security. In a normal system I can take action as soon as I know it's breached, to ensure the attacker doesn't have continued access to my account and check/fix damage caused. With your system an attacker could conceivably have complete access without my knowledge for weeks or months. Edit: > Safari manager is probably great, like other managers. Your entire argument is that password managers are not a good solution - now you're agreeing that they're great. Which is it? > But my scheme is for developers not for end users. You can't make everyone use pw managers, but link on demand is super helpful Except users cannot be trusted to make safe choices - our job is to make informed decisions for them, such as requiring passwords, storing password hashes, etc. > This can added as an option. Some use password, some use on demand link. Everyone's happy Anyone except the people who are affected by the inevitable breach caused by the use of this non-secure solution. Even if I choose to use a password, I could still be affected negatively by an attacker using someone else's account in a system.
- homakov 12y ago
  I will take it as a slight disadvantage. I personally never log out, so I would never know if someone else changed my password while I keep using it on my laptop. Also remember this scheme is not for advanced users (which care about "was i breached" at all). Advanced users can keep using old password scheme with pw managers. P.S. There is nothing you can do if your email is breached anyway. I can change it to new email right away.

by homakov 12y ago

stephenr 12y ago

> is it critical to know or not if your account was breached? If it's breached nothing else matters. This comment is terrifying, given that you are making claims and suggestions about security. In a normal system I can take action as soon as I know it's breached, to ensure the attacker doesn't have continued access to my account and check/fix damage caused. With your system an attacker could conceivably have complete access without my knowledge for weeks or months. Edit: > Safari manager is probably great, like other managers. Your entire argument is that password managers are not a good solution - now you're agreeing that they're great. Which is it? > But my scheme is for developers not for end users. You can't make everyone use pw managers, but link on demand is super helpful Except users cannot be trusted to make safe choices - our job is to make informed decisions for them, such as requiring passwords, storing password hashes, etc. > This can added as an option. Some use password, some use on demand link. Everyone's happy Anyone except the people who are affected by the inevitable breach caused by the use of this non-secure solution. Even if I choose to use a password, I could still be affected negatively by an attacker using someone else's account in a system.

homakov 12y ago
I will take it as a slight disadvantage. I personally never log out, so I would never know if someone else changed my password while I keep using it on my laptop. Also remember this scheme is not for advanced users (which care about "was i breached" at all). Advanced users can keep using old password scheme with pw managers. P.S. There is nothing you can do if your email is breached anyway. I can change it to new email right away.