Re: [PLUG] password safe

On Jan 5, 2016, at 11:58 AM, Keith C. Perry <kperry@daotechnologies.com> wrote:

This is why it's great to run your own mail server. I can create burnable accounts like this. :D

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Keith C. Perry, MS E.E.
Owner, DAO Technologies LLC
(O) +1.215.525.4165 x2033
(M) +1.215.432.5167
www.daotechnologies.com

From: "Rich Mingin (PLUG)" <plug@frags.us>
To: "Philadelphia Linux User's Group Discussion List" <plug@lists.phillylinux.org>
Sent: Tuesday, January 5, 2016 11:54:07 AM
Subject: Re: [PLUG] password safe

Please, shake that walking stick any time you want to feel better.
I use multiple emails, first.last@gmail, gforge@gmail, lettersnumbers@maricopa.edu, and *@frags.us. The last I use for any insecure/bulk communications, I'm the domain catchall address, and I give out emails like kmart@frags.us and amazon@frags.us and annoying.spam.site.but.it.might.be.ok@frags.us.

Don't send email to microcenter@frags.us or microcenter2@frags.us, I had to block both after Microcenter repeatedly "lost" their email DB to spammers. That's the big advantage, though, I can watch spam flow and usually know about DB break-ins at major retailers at about the same time that the news services do. I've also spotted some "inside job" type attacks where my email info got sold to spammers that way.

On Tue, Jan 5, 2016 at 11:29 AM, Rich Freeman <r-plug@thefreemanclan.net> wrote:
On Tue, Jan 5, 2016 at 11:13 AM, Keith C. Perry
<kperry@daotechnologies.com> wrote:
>
> From what I saw on lastpass's website their encrypted value mechanisms would be acceptable to me but it's still not something I would use.
>

My biggest concern with lastpass is that if they're hacked somebody
can potentially change your client. It is all _javascript_ with local
encryption, but if you can change the code you can just have it pass
the key back to the compromised server.

So, an attack that just grabs their entire database isn't a huge
threat since the data is all locally encrypted. However, a persistent
undiscovered attack is a much larger threat since it can be used to
skim passwords as people run the client.

That is actually a threat if somebody compromises your distro and
updates you to a compromised version of Keepass or such as well, but I
don't think people update their software as often as they reload their
browser.

___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug