Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #73186

Trusting password managers [Re: Firefox improvements.]

From Jeffrey Goldberg <nobody@goldmark.org>
Newsgroups sci.crypt, sci.electronics.design, comp.lang.c
Subject Trusting password managers [Re: Firefox improvements.]
Date 2015-10-18 00:34 -0500
Message-ID <d8gpbbFodfuU1@mid.individual.net> (permalink)
References (1 earlier) <s46l1b1q5sbqff3lgitvqprbvk1mdqg4ad@4ax.com> <mveb7b$9sd$1@dont-email.me> <mvf01r$fc4$1@dont-email.me> <d8d6isFr1seU1@mid.individual.net> <mvrqc2$t0q$1@dont-email.me>

Cross-posted to 3 groups.

Show all headers | View raw

On 2015-10-16 21:33:52 +0000, James Kuyper said:

> On 10/16/2015 04:55 PM, Jeffrey Goldberg wrote:
>> On 2015-10-12 00:51:04 +0000, James Kuyper said:
> ...
>>> I use randomly generated passwords;
>> 
>> Good for you!
>> 
>>> they're harder to memorize, but it
>>> only takes me a week or so to memorize the ones I use daily. The ones I
>>> use less frequently are stored in an encrypted file stored using an app
>>> on my smart phone that has no permissions to access any of the external
>>> connections of my phone.
>> 
>> Good.
>> 
>> [Disclosure: I work for AgileBits, the makers of 1Password, a password
>> manager.]
> 
> Perhaps you could address an issue that bothered me. How can I trust the
> maker of my password manager?

The short answer is for me to point you to a longer answer

  https://blog.agilebits.com/2013/09/06/1password-and-the-crypto-wars/

## Starting with the bad news

Let me start out by pointing out that we are not an open source, and in
the absense of deterministic builts, even publishing the source couldn't
give you perfect assurance either. You would need some way to know that
the binary you are running was built from the reviewed source and that
it was built with trusted tools. (The old idea of an evil compiler has
been shown to exist in practice with XcodeGhost.)

So there is a certain level of assurance that we can't provide. We are
good guys, but we can't prove that we are to such a level of certainty.

But if you are willing to look at things that fall short of absolute
proof there are a number of things.

## Verifiable claims

(Almost) all of our claims about security and privacy are verifiable.
You can look at the data and you can look at our specification of the
data form and see that, yes, things are encrypted as we say they are.
You can monitor your own network traffic and verify that it behaves as
we say it does.

First there are the purely technical ones. Where are keys generated, how
are keys generated, where is all encryption done, what if anything is
passed to something out of your own control.

With 1Password, we've picked a design (which you can largely verify)
that has all keys generated locally and all encryption done locally.
Quite simply, 1Password uses end-to-end encryption.

We've also designed things so that we know pretty much nothing about our
customers. We might have purchase records, and records if you contact
us, but your use of 1Password does not involve (much) interaction with
us.

For details (and an explanation of that "much") see

 https://support.1password.com/private-by-design/

Our view is that we cannot lose, use, or abuse data we never have. So
best is to never have it and to do what we can to make it hard for us to
acquire it.

Again pretty much everything we say can be verified by you.

### Example of this design approach

Let me give you an example. Shortly after heartbleed we introduced a
feature, "Watchtower" that lets you know whether you have login
credentials for sites on which we recommend a password change.

The easiest way to implement this in the application would be for it to
contact some service that we would run and query about specific logins.
But that design would mean that our service would know which sites you
have logins for. We don't want to know whether you have Pintrest login
and how often you use it.

So instead we designed it so that the application simply fetched our
database about which sites suffered breaches when. The querying of that
database is done locally on your device, and we are never in a position
to learn what sites you have logins for.

## Simply business

When I joined AgileBits, there were less than a dozen people. Now we
have more than 60. Most are full time. This is a lot of people whose
livelihoods depend on maintaining your trust. Over even a relatively
short term, we make more money selling you software than we could by
stealing your passwords.

### Competence

It is remarkably easy to write a bad password manager, even with the
best intentions and access to good cryptographic libaries. I think we
have a fairly deep understanding of the tools that we use and so are far
less likely to use them wrong. We understand the choice of encryption
modes beyond whether you end up seeing penguins.

Obviously it would be ridiculous to claim that we are bug-free or even
that our design is provably secure. (Complexities, mostly having to do
with data synchronization, make the design go beyond what we can
comfortably prove theorems about.) But we can use a kind of defense in
depth in both our coding and our design. That is, if something that we
believe is secure should fail, to what extent would that lead to a
catestrophic failure or  would the damage be contained by other aspects
of the design and coding.

### Coercion

The story of Lavabit scares me. And it is one of the reaons why we like
to have nothing of value that we could turn over.

Again, we've tried to design things so that not only is there no back
door, it would be tricky to put in a backdoor (without getting spotted
doing so).

>  That's one reason why I chose a manager
> that doesn't need any external connections - I feel safer if the
> information is stored only on my smartphone,

That makes synchronization across devices tricky.

We are sort of half way in between. We don't host your data, but we
do set things up to make third party sync services work for you. But
again, we use end-to-end authenticated encryption so, if we've done
everything right, the worst that could happen with a server compromise
is that synching would stop working.

> However, it seems to me that the password manager could
> choose an encryption scheme that would allow it's maker to access my
> information even without the password that I have to use to access that
> same data.

Again, we fully detail our encryption scheme and it is possible for you
to verify that things are encrypted as we say.

Now, again, this doesnt' 100% rule out all attacks. For example, if we
were to corrupt the RNG that is used for generating keys, it would be
possible for encrypt as we say we do, but with giving us an advantage in
cracking.

Your only full defense against this is a reviewed, open-source solution,
which you compile yourself using a compiler that you also can fully
trust and running on an operating system that you can fully trust.

However, we can offer a partial defense. There are a couple of dozen
people who have eyes on the source. It would just take one to spot
something like that and go public to completely destroy us if any such
malicious mechanism were in place. So this doesn't completely rule out
something of that nature, it does reduce the chance of getting away with
some  malicious mechanism.

> As a simple practical matter of fact, I've chosen to trust the maker of
> my password manager - but only because I didn't have a workable
> alternative. Maintaining a small number of passwords for a large number
> of different accounts is a bad idea,

Yep. Password reuse is probably a bigger problem than weak passwords.

> choosing passwords that are easy to
> remember also makes them easy to crack, and keeping track of large
> numbers of random passwords was just getting too difficult to do by any
> other method.

We have to make choices. In a sense, many of the choices that we make
aren't "security versus convenience" but instead is one type of
security versus another.

> However, I don't have any information to justify the trust I'm giving
> that company.

Please follow the links above for information about us.

> At a NASA IT security briefing,
> 1Password was the only password manager mentioned by name, but they went
> out of their way to say that they were NOT endorsing it. In fact, while
> they said it was OK for us to use a password manager for other
> passwords, we were prohibited from using one for our NASA passwords -
> which is actually a kind of negative endorsement for the whole idea.

Under the law, NASA aren't allowed to use a password manager for their
passwords. I can't speak for them, but I think that what you encountered
was the strongest endorsement they could possibly offer.

> Can you comment, preferably in an official capacity as a representative
> of your company, but if you company policy prohibits that, could you at
> least give us an unofficial personal response?

Pretty much everything I've said here is on our site somewhere; but
other than lack of proper proof reading and such, I'm guess I can
consider this "official-ish".

Cheers,

-j

–-
Jeffrey Goldberg
Chief Defender Against the Dark Arts @ AgileBits
http://agilebits.com

Back to comp.lang.c | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-08 07:55 +0200
  Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-08 07:57 +0200
    Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-08 08:01 +0200
      Re: Firefox improvements. Robert Baer <robertbaer@localnet.com> - 2015-10-09 01:08 -0700
        Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-10 13:08 +0200
          Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-10 13:09 +0200
    Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-11 19:03 +0200
      Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 13:13 -0400
        Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-11 19:55 +0100
          Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 16:02 -0400
            Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-11 21:45 +0100
              Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-11 17:01 -0400
                Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-11 22:18 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 18:45 -0400
                Re: Firefox improvements. "Osmium" <r124c4u102@comcast.net> - 2015-10-11 18:03 -0500
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 19:24 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-11 21:07 -0400
              Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 03:53 +0100
            Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 03:50 +0100
          Re: Firefox improvements. "Osmium" <r124c4u102@comcast.net> - 2015-10-11 17:13 -0500
            Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 03:55 +0100
            Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 01:08 -0500
              Re: Firefox improvements. Tim Rentsch <txr@alumni.caltech.edu> - 2015-10-19 11:53 -0700
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-19 16:58 -0400
                Re: Firefox improvements. Keith Thompson <kst-u@mib.org> - 2015-10-19 14:32 -0700
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-19 18:26 -0400
                Re: Firefox improvements. Keith Thompson <kst-u@mib.org> - 2015-10-20 07:55 -0700
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-20 16:35 +0100
          Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-11 20:51 -0400
            Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 21:05 -0400
            Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-12 01:08 +0000
            Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 03:59 +0100
              Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 23:08 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 04:41 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 00:16 -0400
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 00:37 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 05:46 +0100
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 00:56 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 06:18 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:22 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 08:44 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:23 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 08:47 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 03:59 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 09:14 +0100
                Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-12 12:08 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 08:59 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 14:25 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 12:20 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:27 +0000
                Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 11:20 +0100
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 16:01 +0000
                Re: Firefox improvements. Geoff <geoff@invalid.invalid> - 2015-10-13 16:16 -0700
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 23:27 +0000
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-15 21:41 +0200
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 22:43 +0000
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-16 04:44 +0200
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-16 07:51 -0400
                Re: Firefox improvements. Keith Thompson <kst-u@mib.org> - 2015-10-16 08:27 -0700
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-16 13:21 -0400
                Re: Firefox improvements. Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2015-10-13 11:31 -0400
                Re: Firefox improvements. Jeff Liebermann <jeffl@cruzio.com> - 2015-10-13 08:45 -0700
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 16:03 +0000
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 17:46 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 13:10 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-12 20:01 -0400
                Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-13 00:44 +0000
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 12:25 -0400
                Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-13 16:40 +0000
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 13:02 -0400
                Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 18:16 +0100
                Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-13 11:32 -0600
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:53 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 20:27 -0400
                Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-14 01:45 +0000
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 21:58 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-14 02:13 +0000
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:29 -0400
                Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-15 01:46 +0100
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 01:01 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 21:16 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 01:19 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 22:07 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:22 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:19 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:51 +0100
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 12:59 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:09 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 13:18 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:29 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:30 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:31 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:09 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 22:47 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 21:22 -0400
                Re: Firefox improvements. JW <none@dev.null> - 2015-10-16 06:14 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:09 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:07 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 16:24 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 22:50 +0000
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:02 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 17:12 +0100
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:50 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 18:01 +0100
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 20:06 -0400
                Re: Firefox improvements. Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-16 02:37 +0200
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 07:32 +0200
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-15 14:05 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 19:10 +0100
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-15 14:46 -0400
                Re: Firefox improvements. David Brown <david.brown@hesbynett.no> - 2015-10-15 21:28 +0200
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-16 00:19 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 21:31 -0400
                Re: Firefox improvements. Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-10-15 17:51 -0700
                Re: Firefox improvements. gazelle@shell.xmission.com (Kenny McCormack) - 2015-10-16 01:41 +0000
                Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-14 20:35 -0600
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-15 21:53 +0200
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:18 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:46 +0100
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-15 09:18 -0400
                Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-14 02:13 +0000
                Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-13 21:32 -0600
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 00:21 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:30 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 21:09 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 13:20 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:07 -0400
                Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-14 04:49 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 00:56 -0400
                Re: Firefox improvements. Keith Thompson <kst-u@mib.org> - 2015-10-13 22:39 -0700
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 08:40 +0100
                Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-14 15:01 -0600
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 19:13 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:33 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 19:15 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:42 +0100
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:32 -0400
                Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 13:26 -0500
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 07:48 +0200
                Re: Firefox improvements. Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-10-21 02:09 -0700
                Re: Firefox improvements. Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-10-21 11:10 +0100
                Re: Firefox improvements. Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-10-21 03:45 -0700
                Re: Firefox improvements. Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-10-21 13:05 +0100
                Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-21 11:25 -0500
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 07:53 +0200
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 18:45 +0100
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-13 15:47 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 22:17 +0100
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 21:59 +0000
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 20:35 -0400
                Re: Firefox improvements. Richard Damon <Richard@Damon-Family.org> - 2015-10-13 22:28 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 04:00 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 23:10 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 04:19 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 00:15 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 08:29 +0100
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:39 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 21:10 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:24 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 22:31 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:16 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 16:25 -0400
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 08:03 +0200
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-14 22:50 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:19 -0400
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-14 22:26 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 22:38 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:20 +0100
                Re: Firefox improvements. "Osmium" <r124c4u102@comcast.net> - 2015-10-13 22:54 -0500
                Re: Firefox improvements. glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-10-14 04:24 +0000
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:47 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 23:01 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:44 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 21:11 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:26 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 18:48 +0000
                Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-13 13:24 -0600
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 22:23 +0100
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 20:36 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:59 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 20:35 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 02:16 +0100
                Re: Firefox improvements. Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-10-13 18:54 -0700
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 04:05 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:52 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:49 -0400
                Re: Firefox improvements. "Osmium" <r124c4u102@comcast.net> - 2015-10-14 23:07 -0500
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 07:12 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:58 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 20:49 -0400
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 12:26 -0400
                Re: Firefox improvements. glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-10-13 03:02 +0000
                Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 12:19 -0500
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-16 17:17 -0400
                Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-20 22:13 -0500
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 14:13 +0100
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 15:04 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 12:30 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:43 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:29 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 08:53 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 08:50 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 14:18 +0100
                Re: Firefox improvements. Jeroen Belleman <jeroen@nospam.please> - 2015-10-12 16:50 +0200
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 12:12 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 17:33 +0100
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:32 +0000
                Re: Firefox improvements. Richard Damon <Richard@Damon-Family.org> - 2015-10-12 21:20 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 21:43 -0400
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-13 08:03 +0200
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 07:18 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 07:28 +0100
                Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 10:16 +0100
                Re: Firefox improvements. Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-10-13 04:35 -0700
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 12:57 +0100
                Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 13:29 +0100
                Re: Firefox improvements. David Brown <david.brown@hesbynett.no> - 2015-10-13 14:41 +0200
                Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 13:53 +0100
                Re: Firefox improvements. David Brown <david.brown@hesbynett.no> - 2015-10-13 16:24 +0200
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 16:12 +0000
                Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-13 16:39 +0000
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 18:51 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:55 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:47 -0400
                Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 18:13 +0100
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 19:03 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:57 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 22:02 +0100
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 22:04 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 12:15 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:37 +0000
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 12:46 -0400
                Re: Firefox improvements. Brian Gladman <blindanagram@nowhere.net> - 2015-10-12 18:01 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 13:14 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 15:12 +0000
                Re: Firefox improvements. glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-10-13 03:06 +0000
                Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 12:28 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:30 -0400
                Re: Firefox improvements. Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-10-11 23:58 -0700
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 09:01 +0100
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 08:54 -0400
                Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 14:24 +0100
                Re: Firefox improvements. Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-10-12 07:07 -0700
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 13:02 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 15:24 +0000
              Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 00:18 -0400
              Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 16:31 -0500
            Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 15:55 -0500
              Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-16 17:33 -0400
                Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-17 01:32 +0000
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-17 01:12 -0400
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-17 12:53 -0400
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-17 19:32 -0400
                Re: Firefox improvements. Chad <cdalten@gmail.com> - 2015-10-17 20:29 -0700
                Re: Firefox improvements. gazelle@shell.xmission.com (Kenny McCormack) - 2015-10-18 08:10 +0000
                Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-18 11:08 -0500
                Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-18 17:15 -0400
                Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-18 12:42 -0400
                Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-17 10:01 +0200
                Trusting password managers [Re: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-18 00:34 -0500
                Re: Trusting password managers [Re: Firefox improvements.] James Kuyper <jameskuyper@verizon.net> - 2015-10-18 11:55 -0400
                Re: Trusting password managers [Re: Firefox improvements.] DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-18 17:13 -0400
                Re: Trusting password managers [Re: Firefox improvements.] DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-19 06:47 -0400
                Re: Trusting password managers [Re: Firefox improvements.] Neon John <no@never.com> - 2015-10-18 13:25 -0400
                Re: Trusting password managers [Re: Firefox improvements.] Malcolm McLean <malcolm.mclean5@btinternet.com> - 2015-10-18 16:18 -0700
                Re: Trusting password managers [Re: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-19 18:37 -0500
                Re: Trusting password managers [Re: Firefox improvements.] Tim Rentsch <txr@alumni.caltech.edu> - 2015-10-19 11:54 -0700
          Re: Firefox improvements. rpw3@rpw3.org (Rob Warnock) - 2015-10-12 05:52 +0000
            Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:35 -0400
              Password crackers are not naive [Was: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-18 01:07 -0500
                Re: Password crackers are not naive [Was: Firefox improvements.] "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 08:16 +0200
                Re: Password crackers are not naive [Was: Firefox improvements.] David Malone <dwmalone@walton.maths.tcd.ie> - 2015-10-21 15:54 +0000
                Re: Password crackers are not naive [Was: Firefox improvements.] DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-21 11:57 -0400
                Re: Password crackers are not naive [Was: Firefox improvements.] dplatt@coop.radagast.org (Dave Platt) - 2015-10-21 11:17 -0700
          Re: Firefox improvements. Tim Rentsch <txr@alumni.caltech.edu> - 2015-10-15 10:38 -0700
        Re: Firefox improvements. Rosario19 <Ros@invalid.invalid> - 2015-10-12 09:56 +0200
          Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-18 01:25 -0500
      Re: Firefox improvements. fir <profesor.fir@gmail.com> - 2015-10-14 00:32 -0700
      Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 08:47 +0200
      Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 09:17 +0200
      Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 09:36 +0200
  Re: Firefox improvements. bartekltg <bartekltg@gmail.com> - 2015-10-11 23:07 +0200
    Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-13 21:42 +0200

csiph-web