On October 12, 2014 at 11:54, Anthony said...
then you need a smarter boss
From your comments, you have nothing on the boss I was talking of.
neither I gave my opinion and why I would not go with an on-line PW solution.
Actually you state what you don't advise, and don't give advice on what you think does work. And you reiterate that here, and don't seem to understand what the issue is with that methodology.
I use a home brew system, which is why I did not go into more detail and I can't recommend a specific PW protection system.
Again, he's asking for a solution, of which you don't really give one.
It would also depend on what is being discussed, for example, your PW to log on here is not so important which is why you are probably logged in automatically but you most likely use it with all your devices, on the other hand the PW for your bank account is probably the most critical one you have, but do you really need it on every device?
This is part of the issue. The idea that not everything is important leads to problems. If you view your bank as most important, I'd say that's wrong. Because I can likely get your bank to reset your password, and they'll send temporary login info to your email address, so if I can break into your email, that's likely the most important, as I can get passwords reset, and changed to what I want as a hacker, given access to your email.
you missed the point. It was not the internet that is the main issue at hand (after all your PC can be hacked). It is:
1) the idea that the info is stored in an on-line database and so once the place is hacked the hacker has access to everyone's data which, in order to be useful, will tend to also have more info than just the PW. It is the same issue with retailers and credit card numbers except in the later you don't have a choice. One hack like the Target a few months ago and the guy has info for 98M CC (or the Kmart a few days ago-but I don't know how much CC info the hackers got away with).
On the other hand if we are talking an encrypted file backed up on line with all your other files then you have the added benefit of security through obscurity and the fact that the person would need to hack the cloud location as well as the data itself.
So, you're storing your password file in an online cloud storage solution. And you think somehow this is safer than a password storage site? You do realize Dropbox had an event about a year ago, where they gave access to everyones Dropbox in the clear for about 12 hours. The problem is the data is encrypted and decrypted at Dropbox's site, not on the local PC.
Dropbox is known for being a leaky bucket when it comes to security:
[Link: readwrite.com]A good password manager like LastPass encrypts the password file on the local PC, and the encryption password is not sent to LastPass, so even if someone were to break their server, it doesn't do them much good.
2) there is also the transmission/usage issue. If we are talking a local copy backed up once a month the info is traveling very few times over the internet and it is an encrypted file, on the other hand if the service does not use encryption during transmission that will be clear text where packet sniffers could get the data.
LOL You're talking about clear text for a password management system? You're showing you know nothing about how these systems work.
You've shown nothing here. You've not given a solution, which is what was asked for.
Your comments make it clear, you don't understand LastPass, or the other online password management sites.
A good system, like LastPass, stores an encrypted store of the passwords. LastPass themselves admit they don't know the password and if you lose it, they can't recover it for you. It is only decrypted locally on the device, so a hacker which breakss into the LastPass site, even if they got the files, they would still need to break the encryption. Of course a user would have the opportunity to change their passwords long before a hacker could throw even the strongest supercomputers at it, and ever have a chance at breaking the encryption.
I work at a place that is paranoid about security, and the security of their network and IT infrastructure. We've had people whose full time job is security go over LastPass with people there. I'd bet you have way more holes in your homebrew system, than LastPass has in their system. Go ahead and rely on security by obscurity... Bruce Schneir, a foremost expert on security, used to profess that "security by obscurity" was bad. Now he professes that "obscurity means insecurity."
[Link: schneier.com]