Reputation
1,976
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
5 8
Newest
 passwords
Impact
~214k people reached

  • 0 posts edited
  • 0 helpful flags
  • 22 votes cast
Apr
7
answered Is attacking a password manager on android with root access a plausible concern?
Mar
1
awarded  passwords
Feb
29
comment 1Password for team how secure it is?
"If a site changes its API, you'll have to tweak the login data to be able to login again. And you'll still need a local copy of your passwords, just in case this service goes bust." Just to let you know, the various 1Password applications (other than the web app) store a copy of your data locally. We will never lock people out of their own data.
Feb
29
answered Why do email that didn't pass SPF checks go to my mailbox?
Feb
28
answered 1Password for team how secure it is?
Jan
29
awarded  Yearling
Dec
16
awarded  Nice Answer
Nov
21
comment Two passwords provide better security than two-factor authentication?
Yes. The design does pose a greater risk of data loss. If you would like to have your data protected only by your Master Password than plaster your Account Key in dozens of different places. The "Emergency Kit" we encourage people to print out contains it. But if a secret isn't actually needed to decrypt the data, then it is largely security theater for our sorts of threats.
Nov
21
comment Two passwords provide better security than two-factor authentication?
If our documentation says "sent" an Emergency Kit, we very much need to fix that. The Emergency Kit is generated by your client on your machine.
Nov
18
answered Two passwords provide better security than two-factor authentication?
Nov
4
answered Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
Oct
23
comment Could PKE be used as a better alternative to SRP for authentication?
You will need a way to deterministically generate a keypair from a passphrase, and you will need all of the machinery of public keys. SRP and other PAKEs are "public key lite" and so are simpler than using general PK mechanisms.
Oct
7
answered Could PKE be used as a better alternative to SRP for authentication?
Oct
6
answered What is the entropy of a password made with pwgen?
Jan
29
awarded  Yearling
Oct
27
awarded  Good Answer
Jul
20
answered Want to build a password manager using OpenPGP.js
Jul
14
awarded  Good Answer
Jul
12
answered password generating algorithm
Jul
11
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
Excellent question! My (possibly erroneous) thinking at the time was that I also wanted passphrases to be a minimum length. I wanted to make sure that if someone used a three word passphrase, it would exceed a minimum of 12 characters in length. I note that S/Key also allows 1, 2, and 3 letter words.