Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Jeffrey Goldberg Newsgroups: sci.crypt Subject: Re: Trusting password managers [Re: Firefox improvements.] Date: Mon, 19 Oct 2015 00:35:09 -0500 Lines: 50 Message-ID: References: <263cd$561a967a$d47876e2$46985@news.ziggo.nl> <5623C10D.4010905@verizon.net> Reply-To: jeffrey+news@goldmark.org Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-Trace: individual.net fwvJC+8CEvKoB7V72jb/CQy2KbyJzNKV38EsAVMSWyUJeEgFy8 Cancel-Lock: sha1:utYHds5juyiuD71SQms38jDdmI4= User-Agent: Unison/2.1.10 Xref: csiph.com sci.crypt:33056 On 2015-10-18 15:55:57 +0000, James Kuyper said: > On 10/18/2015 01:34 AM, Jeffrey Goldberg wrote: >> On 2015-10-16 21:33:52 +0000, James Kuyper said: > ... >>> That's one reason why I chose a manager >>> that doesn't need any external connections - I feel safer if the >>> information is stored only on my smartphone, >> >> That makes synchronization across devices tricky. > > It's not that hard - I can copy the file manually to wherever I want it. > The key point is that the app itself doesn't have permission to do so, > which leaves me in control. You might have seven items in your data, but most people end up with hundreds after a not so long while. We also have to allow for changes (additions) to be made on several devices before they have the opporunity to sync. >> Under the law, NASA aren't allowed to use a password manager for their >> passwords. I can't speak for them, but I think that what you encountered >> was the strongest endorsement they could possibly offer. > > I didn't realize that - is there a good security justification for that > law, or was it just a matter of politics? I don't know if this has the status of "law" or "regulation", but some passwords for some government (or even contractors) cannot be stored anywhere. That includes password managers. Although I think that a good password manager offers more security than forbidding them; this kind of regulation makes sense until there is a procedure for vetting password managers. So while in this very particular instance, the regulation harms password security, I don't think it is a bad regulation at this time. But it does appear that you can use a good password manager for data covered by HIPAA as far as I understand. A real disclaimer: I am not a lawyer; we are a Canadian company; and we do not offer legal advice. It is your responsibility to determine whether your particular use of our product is legal in your circumstances. (And that bloody well goes for US export restrictions, which we can't make sense of and haven't (yet) hired a lawyer to give a definitive answer.)