Lost email password.

conny · 17 Sep 2020

These password managers seem like a good idea but what if your actual laptop/computer get stolen?
A 'reasonable' hacker should be able to get into your pc and use your PM to access your accounts surely?
If you want to change your password you need to put the original one in as confirmation before selecting a new one. So unless you have them written down somewhere else you are going to have difficulty changing them quickly when you get a replacement PC.

IT Minion · 17 Sep 2020

SirGalahad said:
Well even if the data is encrypted if someone gets acess to it - they can spend as long as they like cracking it with rainbow tables. Some salt n pepper goes a long way.
Argon ftw!

If they did it properly, which depressingly isn't always. They should only be storing the salted hash, which always makes me peckish.

IT Minion · 17 Sep 2020

conny said:
These password managers seem like a good idea but what if your actual laptop/computer get stolen?
A 'reasonable' hacker should be able to get into your pc and use your PM to access your accounts surely?
If you want to change your password you need to put the original one in as confirmation before selecting a new one. So unless you have them written down somewhere else you are going to have difficulty changing them quickly when you get a replacement PC.

The password manager should be locked with a very good password, I agree with the concept of pass phrases rather than passwords, but I'll call them passwords for now. A very good password is nearly impossible to crack even if you have the computer in your hands. So someone steals your computer, takes the Hard drive out, opens up your disk and finds an encrypted password manager file. That file should be utterly useless to them.

My password manager is stored in the cloud, so it doesn't matter if the PC is lost, that useless encrypted file that only I can open is still there for me on one of my other devices.

Writing things down on paper is just an old fashioned password manager. One that's much easier for someone who breaks into your house to steal along with your PC.

https://www.useapassphrase.com/

Security is a balance between risk and cost. Too much security and it's too hard to use, too little and you can have people buying stuff off the internet with your card details. The trick is to find the most effective, but least awkward, ways to be secure.

SirGalahad · 17 Sep 2020

IT Minion said:
The password manager should be locked with a very good password, I agree with the concept of pass phrases rather than passwords, but I'll call them passwords for now. A very good password is nearly impossible to crack even if you have the computer in your hands. So someone steals your computer, takes the Hard drive out, opens up your disk and finds an encrypted password manager file. That file should be utterly useless to them.

My password manager is stored in the cloud, so it doesn't matter if the PC is lost, that useless encrypted file that only I can open is still there for me on one of my other devices.

Writing things down on paper is just an old fashioned password manager. One that's much easier for someone who breaks into your house to steal along with your PC.

https://www.useapassphrase.com/

Security is a balance between risk and cost. Too much security and it's too hard to use, too little and you can have people buying stuff off the internet with your card details. The trick is to find the most effective, but least awkward, ways to be secure.

There is always one solution...get rid of the users.

conny · 17 Sep 2020

If the Pentagon and British security services can be hacked I'm sure it won't be too long before someone cracks the 'cloud'.
Whether you will get to hear about it is another matter.

IT Minion · 17 Sep 2020

conny said:
If the Pentagon and British security services can be hacked I'm sure it won't be too long before someone cracks the 'cloud'.
Whether you will get to hear about it is another matter.

It's all a trade off, the only secure computer is one in a nuclear silo with multiple backup power supplies that isn't connected to the internet and is turned off. Pretty useless for me to do my online banking.

SirGalahad · 17 Sep 2020

conny said:
If the Pentagon and British security services can be hacked I'm sure it won't be too long before someone cracks the 'cloud'.
Whether you will get to hear about it is another matter.

https://www.f5.com/labs/articles/th...art-2--breach-highlights-for-the-past-3-years

All breaches need to be reported to the ICO, but once we are out of the EU and you are a UK citizen then that might be watered down. As a EU citizen UK companies will still need to abide by GDPR regs.

So it will be UK citizen data protection on the whim of the ICO office vs EU citizens data protected under GDPR.

SirGalahad · 17 Sep 2020

IT Minion said:
It's all a trade off, the only secure computer is one in a nuclear silo with multiple backup power supplies that isn't connected to the internet and is turned off. Pretty useless for me to do my online banking.

But you would have a nuclear silo... Come on that's gotta be worth a talking point or two.

Lost email password.

Similar threads