Timeline for Attacking encrypted storage vs attacking memory [duplicate]
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 10, 2018 at 14:50 | comment | added | kenorb | Relevant: Mozilla Confirms Web-Based Execution Vector for Meltdown and Spectre Attacks | |
| Jun 8, 2016 at 8:15 | history | closed |
Neil Smithline Steffen Ullrich Anders Stephane Matthew |
Duplicate of Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed] | |
| Jun 7, 2016 at 16:58 | review | Close votes | |||
| Jun 8, 2016 at 8:15 | |||||
| Jun 5, 2016 at 19:31 | vote | accept | mrQWERTY | ||
| Jun 5, 2016 at 6:28 | comment | added | Clockwork-Muse | A breach-and-steal (for offline cracking) probably isn't your biggest worry, it's client compromise. At that point, pretty much anything goes, and storage vs generated doesn't matter much. @JuliePelletier - Most online password managers do not store the key (or at least, not the only one), specifically to prevent breaches, instead relying on the client to supply a password. The real strength is still dependent on the client, which is something that can't really be dodged. | |
| Jun 5, 2016 at 6:17 | comment | added | Clockwork-Muse | If the only criteria for a generative is the master password (website URL being implied), it's just as secure as a password manager that stores the passwords in an encrypted file (well, mostly; with an encrypted file you'd at least be able to tell it decrypted correctly, but you'd need to try the same number of guesses anyways). Additionally, such a thing would automatically enable offline attacks, allowing attackers to precompute what amount to rainbow tables (given most peoples' password habits...). | |
| Jun 5, 2016 at 4:03 | answer | added | Limit | timeline score: 0 | |
| Jun 4, 2016 at 17:55 | comment | added | Julie Pelletier | It's also worth mentioning that sending an encrypted file to a client will also require sending them the key which adds a layer of inherent risks. Furthermore, isn't it easier to guarantee the security of your server than the one of each client? | |
| Jun 4, 2016 at 17:37 | comment | added | mrQWERTY | @AndréBorie That is true. I think that is the main reason why generative password managers are relegated as merely an academic novelty. | |
| Jun 4, 2016 at 17:35 | comment | added | André Borie | The issue I see with this kind of password manager is that you can no longer change your password should it become compromised. | |
| Jun 4, 2016 at 17:30 | history | asked | mrQWERTY | CC BY-SA 3.0 |