Page 7 of 15 « First 56 7 89 Last »
Reply
Thread Tools
zwer's Avatar
zwer is offline zwer
2010-01-18 , 13:12
Posts: 455 | Thanked: 782 times | Joined on Nov 2009 @ Netherlands
#61
Originally Posted by GameboyRMH View Post
Seriously, it's about 3 more lines of code to encrypt it!
... and about 3 seconds more to decrypt it, so nothing is gained security-wise...

Unless you implement strong encryption and a master password that you will always need to enter when some of the services need to read a password from that file.
 

The Following 2 Users Say Thank You to zwer For This Useful Post:
range is offline range
2010-01-18 , 13:12
Posts: 337 | Thanked: 160 times | Joined on Aug 2009 @ München, DE
#62
Originally Posted by hqh View Post
Like already mentioned, providing a false sense of security through obscuring the passwords would do no good either. They would still be easily accessible by determined "friends"/family members and malicious programs.
Ummm. Who talked about obscuring them? Clearly something like a keyring is needed for passwords - that's encrypting, and not obscuring.
 
range is offline range
2010-01-18 , 13:15
Posts: 337 | Thanked: 160 times | Joined on Aug 2009 @ München, DE
#63
Originally Posted by mece View Post
I guess hashing the password is a simple way to make people feel secure, and it does give some protection against opportunist laymen.
You cannot hash the password. How would you use the hash to log in?
 
mece's Avatar
mece is offline mece
2010-01-18 , 13:17
Posts: 1,111 | Thanked: 1,985 times | Joined on Aug 2009 @ Ċbo, Finland
#64
Originally Posted by range View Post
You cannot hash the password. How would you use the hash to log in?
sorry I meant some reversable type of encoding.
__________________
Class .. : Meddler, Thread watcher, Developer, Helper
Humor .. : [********--] Alignment: Pacifist
Patience : [*****-----] Weapon(s): N900, N950, Metal music
Agro ... : [----------] Relic(s) : N95, NGage, Tamyia Wild One
Try Tweed Suit for your hardcore twittering needs
http://twitter.com/mece66
I like my coffee black, like my metal.
 
hqh is offline hqh
2010-01-18 , 13:18
Posts: 388 | Thanked: 842 times | Joined on Sep 2009 @ Finland
#65
Originally Posted by range View Post
Ummm. Who talked about obscuring them?
Quite a many people in this thread

Originally Posted by range View Post
Clearly something like a keyring is needed for passwords - that's encrypting, and not obscuring.
Yes, agreed. That would mean no more autologin though, and require such changes that I guess it's safe to bet that this won't be seen in maemo 5.
 
Venomrush is offline Venomrush
2010-01-18 , 13:21
Posts: 891 | Thanked: 499 times | Joined on Nov 2009 @ UK
#66
So I see a lot of comments here leading to one fact that: as long as you have physical access to the device you shouldn't worry

But, remotely steal your data is a possibility without the need to have access to the device.

For example:
ATM it's difficult to know thats apps on Extras got anything harmful in them...I believe it is reasonably easy to slip in a code to send accounts.cfg with passwords in plain text back

Encrypted is better than nothing, if can't encrypted can't be done then don't store them at all.
__________________
Follow me on Twitter
 
zwer's Avatar
zwer is offline zwer
2010-01-18 , 13:23
Posts: 455 | Thanked: 782 times | Joined on Nov 2009 @ Netherlands
#67
So, a guy that knows how to write an app, or inject his malicious code into some other app, and convince you to download and install it, will have more trouble getting your obfuscated passwords than those written in plain text? Come on...
 

The Following 5 Users Say Thank You to zwer For This Useful Post:
Jaffa's Avatar
Jaffa is offline Jaffa
2010-01-18 , 13:26
Posts: 2,535 | Thanked: 6,681 times | Joined on Mar 2008 @ UK
#68
Originally Posted by Venomrush View Post
Last Modified by petr.bug, 16 months ago

You should not apply what being said in this article to today's world where security takes priority,
The threat vectors for the Internet have changed significantly in the last 16 months? Wow.

[...] where there's a massive growth in the smart mobile market and Web 2.0 usage such as blogging Twitter Facebook etc.

Users are now becoming more concern with their privacy and the risks of identity theft.
Do you not see the irony of linking increased usage of Twitter & Facebook with a growing concern about people's privacy? If anything, people's concern with their privacy is decreasing (apart from short-lived, largely hyped, mis-understood bubbles... kinda like this one).
__________________
Andrew Flegg -- mailto:andrew@bleb.org | http://www.bleb.org
 

The Following 7 Users Say Thank You to Jaffa For This Useful Post:
twaelti is offline twaelti
2010-01-18 , 13:33
Posts: 883 | Thanked: 980 times | Joined on Jul 2007 @ Bern, Switzerland
#69
I can't believe the sheer arrogance of the ideologic "security folks", preaching supersecurity or none at all.
In practice, having weak security IS better than no security. In this case, at least having encoded passwords is still better than having plaintext. Becaus it at least prevents random/accidental password exposure. Otherwise we could pretty much also stop **** the password entry fields.
__________________
-Tom (N900, N810, N800)

"the idea of truly having a computer in your pocket just moved a big step closer."
 

The Following 4 Users Say Thank You to twaelti For This Useful Post:
Venomrush is offline Venomrush
2010-01-18 , 13:37
Posts: 891 | Thanked: 499 times | Joined on Nov 2009 @ UK
#70
Originally Posted by twaelti View Post
I can't believe the sheer arrogance of the ideologic "security folks", preaching supersecurity or none at all.
In practice, having weak security IS better than no security. In this case, at least having encoded passwords is still better than having plaintext. Becaus it at least prevents random/accidental password exposure. Otherwise we could pretty much also stop **** the password entry fields.
+1

If having access to the device is the only way to get the passwords, then might as well unhide the asterisks so we (the real owners) know what we mistyped.
__________________
Follow me on Twitter
 
Reply
Page 7 of 15 « First 56 7 89 Last »

Tags
conversations, debate, email, fremantle, instant message, instant messaging, maemo, maemo 5, modest, password, passwords, plain text, security, telepathy

« Previous Thread | Next Thread »

 
Forum Jump


All times are GMT. The time now is 00:50.

Contact Us - Home - Archive - Top