Password Overload
May 16, 2011 | 11:32 am
#61
Join Date: Feb 2000
Location: Menlo Park, CA, USA
Programs: UA 1MM 0P, AA, DL, *wood, Lifetime FPC Plat., IHG, HHD
Posts: 7,176
yes
Anyway, if I recall there was essentially a small DMZ on the card. the biometric would authenticate with the server and allow access for the LOCAL MACHINE to access the information from the CARD. The local MACHINE would validate the authentication and pass access as "open" to the direct client with a simple user name, which would call up the network share for that user. Then, the user would have to re-authenticate with a password sign on which was simply network based as usual. At first there was a second step to authenticate back to the DMZ of the card but it wasn't really necessary.
or something like that. Losing the CARD was a pain to deal with as everything would have to be rebuilt.
May 16, 2011 | 12:49 pm
#62
FlyerTalk Evangelist
Join Date: Nov 2002
Location: ORD
Posts: 14,773
Sure, I didn't mean to infer that lastpass was totally comprimised, just that THINGS are getting hacked, companies with credit cards, companies with emails and their associated passwords, etc. It would appear for the time being at least that if one wants to have essentially absolute security for documents, information, privacy, etc., it is best NOT to put it IN THE CLOUD as the cloud (which is just another word for INTERNET IMHO) has been shown to be vulnerable in many different ways. Direct access to servers, collocation breaches and hacking, third party CDN and application provider networks, etc.
If you want absolute privacy, keep everything in your head and don't write anything down...but what will you do when they send you to Guantanamo?
to the point above about keepass and other locally stored master files, I have seen where people will LOCALLY ENCRYPT that file, which requires a constant direct LOCAL authentication when it requires access, but if the laptop or local file is compromised then it cannot be used by a third party. This can be done with services as well like the dropbox master file, the dropbox master storage location, etc., which means that even if it is compromised or they choose to turn it over to an authority organization via subpoena that it cannot be recovered or read.
Tell you (or anyone) what: anyone who wants to try getting into my LastPass account is welcome to try. PM me for my email address logon. I'll tell you that it's a 9 character password with upper- and lowercase letters and at least one number.
May 18, 2011 | 1:42 pm
#63
Join Date: May 2011
Posts: 1
We also have eWallet GO! ( http://www.ewalletgo.com) It's a great solution for folks looking for a simpler, low-priced solution for storing passwords.
Marc
Ilium Software
www.iliumsoft.com
PS: I'm a really person - not a bot! Not trying to spam anyone here. Just saw Mark's post and wanted to suggest eWallet GO! as well. A lot of folks who don't need all the features in eWallet really like eWallet GO!
May 22, 2011 | 11:00 am
#64
Join Date: Mar 2008
Location: Miami
Programs: DL Silver, AA Gold
Posts: 568
Furthermore, I disagree that programs like Keepass are any better. If anyone gets access to your computer and downloads the Keepass file (or if you contract some malware that sends it to someone), then you're vulnerable to the same attack. In fact, you're doubly vulnerable, because you can't simply change your master password. That would only re-encrypt the password file on your computer, not the one that the hackers took.
Really, any password manager that allows you to use long and difficult passwords without the fallibility of human memory and randomization is fine. If somebody really wants to get you, they'll always be able to use rubber-hose cryptanalysis, and anybody who wants to just do wanton damage will find other peoples' crappy passwords first.
May 22, 2011 | 11:13 am
#65
FlyerTalk Evangelist
Join Date: Aug 2002
Location: Department of Homeland Sincerity
Programs: WN Platinum, UA 1k, AA EP, Marriott Plat
Posts: 12,319
That's not doubly vulnerable; lastpass sends your computer the same stuff 1password or keepass would store locally, and there's nothing stopping an attacker who gets access to that information from storing it for an offline attack (which would still take thousands of years).
Really, any password manager that allows you to use long and difficult passwords without the fallibility of human memory and randomization is fine. If somebody really wants to get you, they'll always be able to use rubber-hose cryptanalysis, and anybody who wants to just do wanton damage will find other peoples' crappy passwords first.
Really, any password manager that allows you to use long and difficult passwords without the fallibility of human memory and randomization is fine. If somebody really wants to get you, they'll always be able to use rubber-hose cryptanalysis, and anybody who wants to just do wanton damage will find other peoples' crappy passwords first.
Open Source + Free is always best for personal security solutions, unless I'm the developer that developed the program myself and charge people to use it, with my closed source program code.
May 22, 2011 | 1:24 pm
#66
Join Date: Mar 2008
Location: Miami
Programs: DL Silver, AA Gold
Posts: 568
Not only that, if LastPass was free and open source maybe I'd consider it. The fact I have to PAY money to have a private closed source program to store my most sensitive data - no thanks.
Open Source + Free is always best for personal security solutions, unless I'm the developer that developed the program myself and charge people to use it, with my closed source program code.
Open Source + Free is always best for personal security solutions, unless I'm the developer that developed the program myself and charge people to use it, with my closed source program code.
Have fun with your auditing!
May 22, 2011 | 7:47 pm
#69
FlyerTalk Evangelist
Join Date: Nov 2002
Location: ORD
Posts: 14,773
Oh about passwords, the IronKey will also generate them for you. Also you can back it up on your computer and also online.
IronKey
IronKey
LastPass is free unless you want the mobile apps. Then it's something like $10/year.