Profile of Sarantini

Jump back to quoted post20 Apr 2015, 16:29 PMRooster Illusion

OKW question:

Is it still best move to go Mech truck first? Then what should be the determinant for your next truck? Typically I go 3 Volks, Mech truck, FlakHT, Flak truck...

Or am I all wrong?

Jump back to quoted post19 Apr 2015, 17:56 PMCieZ

Ummmmm.... no...

Okay, let's assume for a minute that you store all of your passwords on a computer that you have disabled ALL network/internet access in, so there's absolutely no way other than physical access that an attacker could gain access to said machine. That might be mildly better than saving them in an encrypted database on your actual machine... but you'd still need to randomly generate your passwords, and then you'd have to type them all in manually. For example, the first few characters of my coh2.org password are:

"wQGNX8zJUY" (go ahead, try and brute-force the rest, it's 64 characters long in my database although CoH2.org truncates after a certain amount - so it isn't truly 64 characters long). It'd take computer somewhere in the realm of 40 untrigintillion years @ 4 billion guesses per second to crack my coh2.org password.

Do you really want to type that out every time you log in somewhere? Probably not.

Furthermore, storing them on that completely air-gapped machine does absolutely nothing to protect your own home network, nor does it do anything to protect you from social engineering/conscious password guessing and it does nothing to prevent an attacker from capturing your password in transit in clear text (assuming the server supports no encryption - like coh2.org's) or the hash of said password if the server won't establish an SSL/TLS connection for authentication (like community.companyofheroes.com - your browser sends the hash of your password to the server, no encryption). Therefore, if your password is at all weak, even on that air-gapped machine - you have an inherent vulnerability.

Realistically the user name/password system sucks, and we'll probably see a major shift in authentication mechanisms in the next ten years but there are a lot of steps that can be taken to provide enough protection that no one short of a state-backed actor can compromise your password (unless you let some nasty malware on your system, and even the NSA isn't going to enjoy cracking a 64-character long password). The safest password is one that you do not know. It is nearly impossible for us, as humans, to generate a truly random password - and we have a hard time remembering them all. Most people make the mistake of using the same few passwords (usually very similar) for everything. Think of that for a minute. I, as an attacker, get access to one of your passwords - it'll probably be extremely easy to get access to everything you protect with a password.

Also, systems like LastPass do all decryption locally meaning the only thing they ever store is the encrypted version of your password (aka useless/meaningless to them). They use PBKDF2 with thousands of iterations to further increase the strength of the encryption/protect against brute-force attacks and you can add multi-factor authentication...

There's just no way you can easily beat something like that on your own...