Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > sci.crypt > #32711 > unrolled thread
| Started by | "Skybuck Flying" <skybuck2000@hotmail.com> |
|---|---|
| First post | 2015-10-11 19:03 +0200 |
| Last post | 2015-10-21 09:36 +0200 |
| Articles | 20 on this page of 281 — 32 participants |
Back to article view | Back to sci.crypt
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-11 19:03 +0200
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 13:13 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-11 19:55 +0100
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-11 14:42 -0500
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-11 20:47 +0100
Password restrictions [Was: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-15 13:30 -0500
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 16:02 -0400
Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-11 21:45 +0100
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-11 17:01 -0400
Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-11 22:18 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 18:45 -0400
Re: Firefox improvements. "Osmium" <r124c4u102@comcast.net> - 2015-10-11 18:03 -0500
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 19:24 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-11 21:07 -0400
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-15 20:07 -0500
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-16 09:01 +0100
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 11:59 -0500
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-16 18:21 +0100
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 03:53 +0100
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 03:50 +0100
Re: Firefox improvements. "Osmium" <r124c4u102@comcast.net> - 2015-10-11 17:13 -0500
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 03:55 +0100
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 01:08 -0500
Re: Firefox improvements. Tim Rentsch <txr@alumni.caltech.edu> - 2015-10-19 11:53 -0700
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-19 16:58 -0400
Re: Firefox improvements. Keith Thompson <kst-u@mib.org> - 2015-10-19 14:32 -0700
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-19 18:26 -0400
Re: Firefox improvements. Keith Thompson <kst-u@mib.org> - 2015-10-20 07:55 -0700
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-20 16:35 +0100
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-11 20:51 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 21:05 -0400
Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-12 01:08 +0000
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 03:59 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-11 23:08 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 04:41 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 00:16 -0400
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 00:37 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 05:46 +0100
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 00:56 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 06:18 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:22 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 08:44 +0100
Strength from generation restrictions [Re: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-15 15:18 -0500
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:23 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 08:47 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 03:59 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 09:14 +0100
Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-12 12:08 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 08:59 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 14:25 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 12:20 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:27 +0000
Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 11:20 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 16:01 +0000
Re: Firefox improvements. Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-10-13 23:45 +0100
Re: Firefox improvements. Geoff <geoff@invalid.invalid> - 2015-10-13 16:16 -0700
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 23:27 +0000
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-15 21:41 +0200
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 22:43 +0000
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-16 04:44 +0200
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-16 07:51 -0400
Re: Firefox improvements. Keith Thompson <kst-u@mib.org> - 2015-10-16 08:27 -0700
Re: Firefox improvements. MM <mrvmurray@gmail.com> - 2015-10-16 10:13 -0700
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-16 13:21 -0400
Re: Firefox improvements. Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2015-10-13 11:31 -0400
Re: Firefox improvements. Jeff Liebermann <jeffl@cruzio.com> - 2015-10-13 08:45 -0700
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 16:03 +0000
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 17:46 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:47 +0000
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 17:56 +0100
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-20 00:52 -0500
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 13:10 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-12 20:01 -0400
Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-13 00:44 +0000
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 12:25 -0400
Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-13 16:40 +0000
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 13:02 -0400
Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 18:16 +0100
Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-13 11:32 -0600
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:53 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 20:27 -0400
Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-14 01:45 +0000
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 21:58 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-14 02:13 +0000
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:29 -0400
Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-15 01:46 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 01:01 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 21:16 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 01:19 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 22:07 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:22 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:19 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:51 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 12:59 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:09 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 13:18 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:29 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 14:35 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 22:44 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:30 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:31 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:09 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 22:47 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 21:22 -0400
Re: Firefox improvements. JW <none@dev.null> - 2015-10-16 06:14 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:09 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:07 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 16:24 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-15 22:50 +0000
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:02 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 17:12 +0100
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:50 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 18:01 +0100
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 20:06 -0400
Re: Firefox improvements. Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-16 02:37 +0200
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 07:32 +0200
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-15 14:05 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 19:10 +0100
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-15 14:46 -0400
Re: Firefox improvements. David Brown <david.brown@hesbynett.no> - 2015-10-15 21:28 +0200
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-16 00:19 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 21:31 -0400
Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-14 20:35 -0600
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-15 21:53 +0200
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:18 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:46 +0100
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-15 09:18 -0400
Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-14 02:13 +0000
Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-13 21:32 -0600
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 00:21 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:30 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 21:09 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 13:20 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 09:07 -0400
Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-14 04:49 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 00:56 -0400
Re: Firefox improvements. Keith Thompson <kst-u@mib.org> - 2015-10-13 22:39 -0700
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 08:40 +0100
Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-14 15:01 -0600
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 19:13 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:33 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 19:15 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:42 +0100
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:32 -0400
Exhaustive searches, brutish and otherwise [Was: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-20 01:19 -0500
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 13:26 -0500
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 07:48 +0200
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-21 11:25 -0500
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 07:53 +0200
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 18:45 +0100
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-13 15:47 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 22:17 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 21:59 +0000
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 20:35 -0400
Re: Firefox improvements. Richard Damon <Richard@Damon-Family.org> - 2015-10-13 22:28 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 04:00 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 23:10 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 04:19 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 00:15 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 08:29 +0100
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:39 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 21:10 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:24 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 22:31 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:16 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 16:25 -0400
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 08:03 +0200
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-14 22:50 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-15 12:19 -0400
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-14 22:26 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 22:38 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:20 +0100
Re: Firefox improvements. "Osmium" <r124c4u102@comcast.net> - 2015-10-13 22:54 -0500
Re: Firefox improvements. glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-10-14 04:24 +0000
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:47 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 23:01 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:44 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-14 21:11 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 22:26 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 18:48 +0000
Re: Firefox improvements. Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2015-10-13 13:24 -0600
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 22:23 +0100
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 20:36 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:59 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 20:35 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-14 02:16 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:52 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-14 20:49 -0400
Re: Firefox improvements. "Osmium" <r124c4u102@comcast.net> - 2015-10-14 23:07 -0500
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-15 07:12 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-15 12:58 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 20:49 -0400
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 12:26 -0400
Re: Firefox improvements. glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-10-13 03:02 +0000
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 12:19 -0500
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-16 17:17 -0400
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-20 22:13 -0500
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-21 00:46 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-21 00:47 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-21 00:48 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-21 00:51 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-21 00:52 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-21 00:53 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 14:13 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 15:04 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 12:30 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:43 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:29 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 08:53 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 08:50 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 14:18 +0100
Re: Firefox improvements. Jeroen Belleman <jeroen@nospam.please> - 2015-10-12 16:50 +0200
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 12:12 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 17:33 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:32 +0000
Re: Firefox improvements. Richard Damon <Richard@Damon-Family.org> - 2015-10-12 21:20 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 21:43 -0400
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-13 08:03 +0200
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 07:18 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 07:28 +0100
Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 10:16 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 16:12 +0000
Re: Firefox improvements. William Unruh <unruh@invalid.ca> - 2015-10-13 16:39 +0000
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 18:51 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:55 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:47 -0400
Re: Firefox improvements. Bartc <bc@freeuk.com> - 2015-10-13 18:13 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 19:03 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-13 22:57 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-13 22:02 +0100
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-13 22:04 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 12:15 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 16:37 +0000
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 12:46 -0400
Re: Firefox improvements. Brian Gladman <blindanagram@nowhere.net> - 2015-10-12 18:01 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 13:14 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 15:12 +0000
Re: Firefox improvements. glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-10-13 03:06 +0000
Re: Firefox improvements. krw <krw@nowhere.com> - 2015-10-13 12:28 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:30 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 09:01 +0100
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 08:54 -0400
Re: Firefox improvements. Richard Heathfield <rjh@cpax.org.uk> - 2015-10-12 14:24 +0100
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 13:02 -0400
Re: Firefox improvements. gordonb.wak65@burditt.org (Gordon Burditt) - 2015-10-12 20:47 -0500
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-12 15:24 +0000
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-12 00:18 -0400
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 16:31 -0500
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-16 15:55 -0500
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-16 17:33 -0400
Re: Firefox improvements. Rich <rich@example.invalid> - 2015-10-17 01:32 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-17 01:12 -0400
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-17 12:53 -0400
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-17 19:32 -0400
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-18 11:08 -0500
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-18 17:15 -0400
Re: Firefox improvements. James Kuyper <jameskuyper@verizon.net> - 2015-10-18 12:42 -0400
Re: Firefox improvements. gordonb.ll6qm@burditt.org (Gordon Burditt) - 2015-10-21 18:36 -0500
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-17 10:01 +0200
Trusting password managers [Re: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-18 00:34 -0500
Re: Trusting password managers [Re: Firefox improvements.] James Kuyper <jameskuyper@verizon.net> - 2015-10-18 11:55 -0400
Re: Trusting password managers [Re: Firefox improvements.] DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-18 17:13 -0400
Re: Trusting password managers [Re: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-19 00:35 -0500
Re: Trusting password managers [Re: Firefox improvements.] DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-19 06:47 -0400
Re: Trusting password managers [Re: Firefox improvements.] Neon John <no@never.com> - 2015-10-18 13:25 -0400
Re: Trusting password managers [Re: Firefox improvements.] MM <mrvmurray@gmail.com> - 2015-10-18 11:39 -0700
Re: Trusting password managers [Re: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-19 15:33 -0500
Re: Trusting password managers [Re: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-19 18:37 -0500
Re: Trusting password managers [Re: Firefox improvements.] Tim Rentsch <txr@alumni.caltech.edu> - 2015-10-19 11:54 -0700
Re: Firefox improvements. rpw3@rpw3.org (Rob Warnock) - 2015-10-12 05:52 +0000
Re: Firefox improvements. DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-12 02:35 -0400
Password crackers are not naive [Was: Firefox improvements.] Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-18 01:07 -0500
Re: Password crackers are not naive [Was: Firefox improvements.] "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 08:16 +0200
Re: Password crackers are not naive [Was: Firefox improvements.] David Malone <dwmalone@walton.maths.tcd.ie> - 2015-10-21 15:54 +0000
Re: Password crackers are not naive [Was: Firefox improvements.] DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> - 2015-10-21 11:57 -0400
Re: Password crackers are not naive [Was: Firefox improvements.] dplatt@coop.radagast.org (Dave Platt) - 2015-10-21 11:17 -0700
Re: Firefox improvements. Rosario19 <Ros@invalid.invalid> - 2015-10-12 09:56 +0200
Re: Firefox improvements. Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-18 01:25 -0500
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 08:47 +0200
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 09:17 +0200
Re: Firefox improvements. "Skybuck Flying" <skybuck2000@hotmail.com> - 2015-10-21 09:36 +0200
Page 14 of 15 — ← Prev page 1 … 12 13 [14] 15 Next page →
| From | James Kuyper <jameskuyper@verizon.net> |
|---|---|
| Date | 2015-10-18 11:55 -0400 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <5623C10D.4010905@verizon.net> |
| In reply to | #33030 |
On 10/18/2015 01:34 AM, Jeffrey Goldberg wrote: > On 2015-10-16 21:33:52 +0000, James Kuyper said: ... >> That's one reason why I chose a manager >> that doesn't need any external connections - I feel safer if the >> information is stored only on my smartphone, > > That makes synchronization across devices tricky. It's not that hard - I can copy the file manually to wherever I want it. The key point is that the app itself doesn't have permission to do so, which leaves me in control. ... >> At a NASA IT security briefing, >> 1Password was the only password manager mentioned by name, but they went >> out of their way to say that they were NOT endorsing it. In fact, while >> they said it was OK for us to use a password manager for other >> passwords, we were prohibited from using one for our NASA passwords - >> which is actually a kind of negative endorsement for the whole idea. > > Under the law, NASA aren't allowed to use a password manager for their > passwords. I can't speak for them, but I think that what you encountered > was the strongest endorsement they could possibly offer. I didn't realize that - is there a good security justification for that law, or was it just a matter of politics?
[toc] | [prev] | [next] | [standalone]
| From | DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> |
|---|---|
| Date | 2015-10-18 17:13 -0400 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <go282b1hv66525thn3chv1183to4fogi2i@4ax.com> |
| In reply to | #33037 |
On Sun, 18 Oct 2015 11:55:57 -0400, James Kuyper <jameskuyper@verizon.net> Gave us: >On 10/18/2015 01:34 AM, Jeffrey Goldberg wrote: >> On 2015-10-16 21:33:52 +0000, James Kuyper said: >... >>> That's one reason why I chose a manager >>> that doesn't need any external connections - I feel safer if the >>> information is stored only on my smartphone, >> >> That makes synchronization across devices tricky. > >It's not that hard - I can copy the file manually to wherever I want it. >The key point is that the app itself doesn't have permission to do so, >which leaves me in control. > >... >>> At a NASA IT security briefing, >>> 1Password was the only password manager mentioned by name, but they went >>> out of their way to say that they were NOT endorsing it. In fact, while >>> they said it was OK for us to use a password manager for other >>> passwords, we were prohibited from using one for our NASA passwords - >>> which is actually a kind of negative endorsement for the whole idea. >> >> Under the law, NASA aren't allowed to use a password manager for their >> passwords. I can't speak for them, but I think that what you encountered >> was the strongest endorsement they could possibly offer. > >I didn't realize that - is there a good security justification for that >law, or was it just a matter of politics? If it is a device you use, it is a vulnerability. If it auto-fills, it is a vulnerability. If it is software it is a vulnerability. So what do you think... "good security justification" or "politics"?
[toc] | [prev] | [next] | [standalone]
| From | Jeffrey Goldberg <nobody@goldmark.org> |
|---|---|
| Date | 2015-10-19 00:35 -0500 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <d8jdocFeashU1@mid.individual.net> |
| In reply to | #33037 |
On 2015-10-18 15:55:57 +0000, James Kuyper said: > On 10/18/2015 01:34 AM, Jeffrey Goldberg wrote: >> On 2015-10-16 21:33:52 +0000, James Kuyper said: > ... >>> That's one reason why I chose a manager >>> that doesn't need any external connections - I feel safer if the >>> information is stored only on my smartphone, >> >> That makes synchronization across devices tricky. > > It's not that hard - I can copy the file manually to wherever I want it. > The key point is that the app itself doesn't have permission to do so, > which leaves me in control. You might have seven items in your data, but most people end up with hundreds after a not so long while. We also have to allow for changes (additions) to be made on several devices before they have the opporunity to sync. >> Under the law, NASA aren't allowed to use a password manager for their >> passwords. I can't speak for them, but I think that what you encountered >> was the strongest endorsement they could possibly offer. > > I didn't realize that - is there a good security justification for that > law, or was it just a matter of politics? I don't know if this has the status of "law" or "regulation", but some passwords for some government (or even contractors) cannot be stored anywhere. That includes password managers. Although I think that a good password manager offers more security than forbidding them; this kind of regulation makes sense until there is a procedure for vetting password managers. So while in this very particular instance, the regulation harms password security, I don't think it is a bad regulation at this time. But it does appear that you can use a good password manager for data covered by HIPAA as far as I understand. A real disclaimer: I am not a lawyer; we are a Canadian company; and we do not offer legal advice. It is your responsibility to determine whether your particular use of our product is legal in your circumstances. (And that bloody well goes for US export restrictions, which we can't make sense of and haven't (yet) hired a lawyer to give a definitive answer.)
[toc] | [prev] | [next] | [standalone]
| From | DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> |
|---|---|
| Date | 2015-10-19 06:47 -0400 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <jhi92bt8iebti9uho4f2t7m76u7gcdl6th@4ax.com> |
| In reply to | #33037 |
On Sun, 18 Oct 2015 11:55:57 -0400, James Kuyper <jameskuyper@verizon.net> Gave us: >On 10/18/2015 01:34 AM, Jeffrey Goldberg wrote: >> On 2015-10-16 21:33:52 +0000, James Kuyper said: >... >>> That's one reason why I chose a manager >>> that doesn't need any external connections - I feel safer if the >>> information is stored only on my smartphone, >> >> That makes synchronization across devices tricky. > >It's not that hard - I can copy the file manually to wherever I want it. >The key point is that the app itself doesn't have permission to do so, >which leaves me in control. > >... >>> At a NASA IT security briefing, >>> 1Password was the only password manager mentioned by name, but they went >>> out of their way to say that they were NOT endorsing it. In fact, while >>> they said it was OK for us to use a password manager for other >>> passwords, we were prohibited from using one for our NASA passwords - >>> which is actually a kind of negative endorsement for the whole idea. >> >> Under the law, NASA aren't allowed to use a password manager for their >> passwords. I can't speak for them, but I think that what you encountered >> was the strongest endorsement they could possibly offer. > >I didn't realize that - is there a good security justification for that >law, or was it just a matter of politics? I went to the National Cryptologic Museum Saturday... It sits on the same property as the NSA building over in Annapolis Junction, Virginia. It was really cool.. There were two Crays there. An old XM P-24 and a Y MP C-90. There was also a nice "Thinking Machines" brand CM-5 supercomputer there. https://en.wikipedia.org/wiki/File:Thinking_Machines_Connection_Machine_CM-5_Frostburg_2.jpg I also saw a replica of the Rosetta Stone, which a recognized immediately (from a past life residual memory, of course). There was also an ENIGMA machine, and the Navy Bombe. Pretty wild. They also have Geo. Washington's inaugural sword there for some reason. Wow.
[toc] | [prev] | [next] | [standalone]
| From | Neon John <no@never.com> |
|---|---|
| Date | 2015-10-18 13:25 -0400 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <67j72bdiubkas96dddlq87v05b3akbc584@4ax.com> |
| In reply to | #33030 |
On Sun, 18 Oct 2015 00:34:35 -0500, Jeffrey Goldberg <nobody@goldmark.org> wrote: >> Perhaps you could address an issue that bothered me. How can I trust the >> maker of my password manager? > >The short answer is for me to point you to a longer answer > > https://blog.agilebits.com/2013/09/06/1password-and-the-crypto-wars/ > >## Starting with the bad news > >Let me start out by pointing out that we are not an open source, and in >the absense of deterministic builts, even publishing the source couldn't >give you perfect assurance either. You would need some way to know that >the binary you are running was built from the reviewed source and that >it was built with trusted tools. (The old idea of an evil compiler has >been shown to exist in practice with XcodeGhost.) [Long post about the negative aspects of closed source deleted.] Jeffrey, the way to address the problems you've listed is simply to open source your product. The stuff about trusted tools is, IMO, FUD. How cloud a customer know that your tools haven't been compromised? The odds of Keepass (the manager that I use) being compromised is vanishingly small because so many eyes have looked at the source. The odds of Gnu C being compromised are even less. So though I'm no crypto expert, I am a competent programmer and my belief is that a popular open source crypto program that has been thoroughly examined, compiled by a compiler that has received even more public scrutiny is far more secure than any closed source product running on a closed source OS. In my case, I compiled Keepass from a tarball that passed the MD5 check sum on an air-gapped machine with a virgin Linux booted from CD that has never been connected to the Internet. I do the same with the GPG product and the FireFox plugin. And with FireFox itself. Then I personally distribute the binaries to all my company's employees. I don't change anything in the code so the binary passes the official MD5 test. That precludes the possibility of me being a black hat. That's about as much as I can think of to make the crypto that we use secure. Some features such as merging key databases can't easily be done in a crypto-secure method. We solve that solution by having 2 key databases on each employee's computer. One read-only official one that contains passwords to, for example, customers' sites and a second one that contains employee-specific passwords. There is a person (me) charged with adding new passwords to the official database, something I spend about half a day on once a month. Do I need all this security? Who knows? Our customers, some of whom disclose the very core of their proprietary technology to us certainly think so. And seeing how the government has persecuted people who appear on their radar, I'm not taking any chances there either. Anyway, it seems to me that your company could achieve that same level of trust by simply open sourcing your product. John John DeArmond http://www.neon-john.com http://www.fluxeon.com Tellico Plains, Occupied TN See website for email address
[toc] | [prev] | [next] | [standalone]
| From | MM <mrvmurray@gmail.com> |
|---|---|
| Date | 2015-10-18 11:39 -0700 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <77da63ae-7996-4c8f-9893-bb8b30020293@googlegroups.com> |
| In reply to | #33041 |
On Sunday, 18 October 2015 18:26:06 UTC+1, Neon John wrote: > The odds of Keepass (the manager that I use) being compromised is > vanishingly small because so many eyes have looked at the source. The > odds of Gnu C being compromised are even less. That's a myth. Look at the recent rush of bugs found in OpenSSL, and that has been OSS for 15+ years. M --
[toc] | [prev] | [next] | [standalone]
| From | Jeffrey Goldberg <nobody@goldmark.org> |
|---|---|
| Date | 2015-10-19 15:33 -0500 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <d8l2ciFs0jhU1@mid.individual.net> |
| In reply to | #33041 |
On 2015-10-18 17:25:55 +0000, Neon John said: > On Sun, 18 Oct 2015 00:34:35 -0500, Jeffrey Goldberg > <nobody@goldmark.org> wrote: >> https://blog.agilebits.com/2013/09/06/1password-and-the-crypto-wars/ >> >> ## Starting with the bad news >> >> Let me start out by pointing out that we are not an open source, and in >> the absense of deterministic builts, even publishing the source couldn't >> give you perfect assurance either. You would need some way to know that >> the binary you are running was built from the reviewed source and that >> it was built with trusted tools. (The old idea of an evil compiler has >> been shown to exist in practice with XcodeGhost.) > > [Long post about the negative aspects of closed source deleted.] > > Jeffrey, the way to address the problems you've listed is simply to > open source your product. Simple. It's clear that we largely agree on the security advantages of open source. And I'm not going to criticize anyone who insists that all their security tools be open source. And we have to forego some of those security advantages given our business model. As you've seen, we try to mitigate that by being open and explicit about our design and supportive of researchers. > The stuff about trusted tools is, IMO, FUD. How cloud a customer know > that your tools haven't been compromised? You compile your tools on a system that you built using a compiler that you checked the PGP sig for. That's great that give you a lot of extra control and ability to manage your security. But most people are installing binaries for their proprietary operating systems. Even if what they are installing is open source, they are still just installing something that has been packaged and built by others. And without deterministic builds, it is very hard to know that the binary you are installing really comes from the source that's been looked at by many eyeballs. > The odds of Keepass (the manager that I use) being compromised is > vanishingly small because so many eyes have looked at the source. The > odds of Gnu C being compromised are even less. Good. Now I would like to help bring top-notch security design in a password manager for people who aren't going to build these things for themselves. > In my case, I compiled Keepass from a tarball that passed the MD5 > check sum on an air-gapped machine with a virgin Linux booted from CD > that has never been connected to the Internet. Good. KeePass is probably a good choice for you. But people who don't compile their own code and don't build their own Linux boxes deserve good security, too. > I do the same with the GPG product and the FireFox plugin. And with > FireFox itself. Then I personally distribute the binaries to all my > company's employees. > > I don't change anything in the code so the binary passes the official > MD5 test. That precludes the possibility of me being a black hat. (It looks like MD5 will out-live Fortran.) > That's about as much as I can think of to make the crypto that we use > secure. Good. I'm glad that you are in a position to take those steps. But your description of the work that you are doing really seems to be illustrating the point that some of the security benefits of open source place a burden on the user that lots of people are going to find unacceptable. > Some features such as merging key databases can't easily be done in a > crypto-secure method. We solve that solution by having 2 key > databases on each employee's computer. One read-only official one > that contains passwords to, for example, customers' sites and a second > one that contains employee-specific passwords. Interesting approach. > There is a person (me) charged with adding new passwords to the > official database, something I spend about half a day on once a month. I'm glad that works out well for you. But I'm sure you see that won't work were multiple people are authorized to make changes (or even one person can make changes on to their own data, but on multiple systems). > Do I need all this security? Who knows? Not my call. You need to be in control of your choices to meet your needs and your evaluation of the threats. > Our customers, some of whom > disclose the very core of their proprietary technology to us certainly > think so. Like you, we are trying to meet the security needs of our customers. But the overwhelming majority of our customers aren't going to compile from source and run open source operating systems. > Anyway, it seems to me that your company could achieve that same level > of trust by simply open sourcing your product. Well, and then there is the whole business model thing. When I joined AgileBits, we were fewer than a dozen. Now we are more than 60. About half are in customer support. If the owners (I'm not one) come to think that we can continue to provide the same quality of product and support with an open source approach, then I think they would go that route. But I am not in a position to speak on behalf of them on business matters. But I do hope that you appreciate the fact that we do want to bring something like the security that you enjoy to a much broader range of people. Cheers, -j
[toc] | [prev] | [next] | [standalone]
| From | Jeffrey Goldberg <nobody@goldmark.org> |
|---|---|
| Date | 2015-10-19 18:37 -0500 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <d8ld5qF3kdU1@mid.individual.net> |
| In reply to | #33064 |
[Reposting, as my first attempt sent it only to sci.crypt. Sorry for the spam in the original Usenet sense of the word.] On 2015-10-18 17:25:55 +0000, Neon John said: > On Sun, 18 Oct 2015 00:34:35 -0500, Jeffrey Goldberg > <nobody@goldmark.org> wrote: >> https://blog.agilebits.com/2013/09/06/1password-and-the-crypto-wars/ >> >> ## Starting with the bad news >> >> Let me start out by pointing out that we are not an open source, and in >> the absense of deterministic builts, even publishing the source couldn't >> give you perfect assurance either. You would need some way to know that >> the binary you are running was built from the reviewed source and that >> it was built with trusted tools. (The old idea of an evil compiler has >> been shown to exist in practice with XcodeGhost.) > > [Long post about the negative aspects of closed source deleted.] > > Jeffrey, the way to address the problems you've listed is simply to > open source your product. Simple. It's clear that we largely agree on the security advantages of open source. And I'm not going to criticize anyone who insists that all their security tools be open source. And we have to forego some of those security advantages given our business model. As you've seen, we try to mitigate that by being open and explicit about our design and supportive of researchers. > The stuff about trusted tools is, IMO, FUD. How cloud a customer know > that your tools haven't been compromised? You compile your tools on a system that you built using a compiler that you checked the PGP sig for. That's great that give you a lot of extra control and ability to manage your security. But most people are installing binaries for their proprietary operating systems. Even if what they are installing is open source, they are still just installing something that has been packaged and built by others. And without deterministic builds, it is very hard to know that the binary you are installing really comes from the source that's been looked at by many eyeballs. > The odds of Keepass (the manager that I use) being compromised is > vanishingly small because so many eyes have looked at the source. The > odds of Gnu C being compromised are even less. Good. Now I would like to help bring top-notch security design in a password manager for people who aren't going to build these things for themselves. > In my case, I compiled Keepass from a tarball that passed the MD5 > check sum on an air-gapped machine with a virgin Linux booted from CD > that has never been connected to the Internet. Good. KeePass is probably a good choice for you. But people who don't compile their own code and don't build their own Linux boxes deserve good security, too. > I do the same with the GPG product and the FireFox plugin. And with > FireFox itself. Then I personally distribute the binaries to all my > company's employees. > > I don't change anything in the code so the binary passes the official > MD5 test. That precludes the possibility of me being a black hat. (It looks like MD5 will out-live Fortran.) > That's about as much as I can think of to make the crypto that we use > secure. Good. I'm glad that you are in a position to take those steps. But your description of the work that you are doing really seems to be illustrating the point that some of the security benefits of open source place a burden on the user that lots of people are going to find unacceptable. > Some features such as merging key databases can't easily be done in a > crypto-secure method. We solve that solution by having 2 key > databases on each employee's computer. One read-only official one > that contains passwords to, for example, customers' sites and a second > one that contains employee-specific passwords. Interesting approach. > There is a person (me) charged with adding new passwords to the > official database, something I spend about half a day on once a month. I'm glad that works out well for you. But I'm sure you see that won't work were multiple people are authorized to make changes (or even one person can make changes on to their own data, but on multiple systems). > Do I need all this security? Who knows? Not my call. You need to be in control of your choices to meet your needs and your evaluation of the threats. > Our customers, some of whom > disclose the very core of their proprietary technology to us certainly > think so. Like you, we are trying to meet the security needs of our customers. But the overwhelming majority of our customers aren't going to compile from source and run open source operating systems. > Anyway, it seems to me that your company could achieve that same level > of trust by simply open sourcing your product. Well, and then there is the whole business model thing. When I joined AgileBits, we were fewer than a dozen. Now we are more than 60. About half are in customer support. If the owners (I'm not one) come to think that we can continue to provide the same quality of product and support with an open source approach, then I think they would go that route. But I am not in a position to speak on behalf of them on business matters. But I do hope that you appreciate the fact that we do want to bring something like the security that you enjoy to a much broader range of people. Cheers, -j
[toc] | [prev] | [next] | [standalone]
| From | Tim Rentsch <txr@alumni.caltech.edu> |
|---|---|
| Date | 2015-10-19 11:54 -0700 |
| Subject | Re: Trusting password managers [Re: Firefox improvements.] |
| Message-ID | <kfn4mhmheof.fsf@x-alumni2.alumni.caltech.edu> |
| In reply to | #33030 |
Could those posting in this thread please remove comp.lang.c from the list of newsgroups? I'm sure it must be interesting to some folks but it doesn't really have anything to do with comp.lang.c. Thank you.
[toc] | [prev] | [next] | [standalone]
| From | rpw3@rpw3.org (Rob Warnock) |
|---|---|
| Date | 2015-10-12 05:52 +0000 |
| Message-ID | <561b4a9e$0$1628$742ec2ed@news.sonic.net> |
| In reply to | #32714 |
And we're back to <https://www.xkcd.com/936/>. Again. [Remember to read the hover tooltip.] -Rob ----- Rob Warnock <rpw3@rpw3.org> 627 26th Avenue <http://rpw3.org/> San Mateo, CA 94403
[toc] | [prev] | [next] | [standalone]
| From | DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> |
|---|---|
| Date | 2015-10-12 02:35 -0400 |
| Message-ID | <p1lm1b12eu6386v1pj15lh49jfm1h26jkc@4ax.com> |
| In reply to | #32741 |
On 12 Oct 2015 05:52:30 GMT, rpw3@rpw3.org (Rob Warnock) Gave us: >And we're back to <https://www.xkcd.com/936/>. Again. >[Remember to read the hover tooltip.] > > >-Rob > Actually the cartoon is wrong, because computers make no such assumptions. There is sample key attempts with brute force, not fuzzy logic brute force with probable choice guidance.
[toc] | [prev] | [next] | [standalone]
| From | Jeffrey Goldberg <nobody@goldmark.org> |
|---|---|
| Date | 2015-10-18 01:07 -0500 |
| Subject | Password crackers are not naive [Was: Firefox improvements.] |
| Message-ID | <d8gr9kFoqirU1@mid.individual.net> |
| In reply to | #32747 |
On 2015-10-12 06:35:28 +0000, DecadentLinuxUserNumeroUno said: > On 12 Oct 2015 05:52:30 GMT, rpw3@rpw3.org (Rob Warnock) Gave us: > >> And we're back to <https://www.xkcd.com/936/>. Again. >> [Remember to read the hover tooltip.] > Actually the cartoon is wrong, because computers make no such > assumptions. There is sample key attempts with brute force, not fuzzy > logic brute force with probable choice guidance. Sorry, you are quite wrong about this. I strongly recommend that people who wish to speculate on how password crackers work actually look at password crackers. Password cracking tools very much make use of the sorts of things that are discussed in that comic. Here are some extracts from sample John the Ripper rulesets #uppercase the first character and then add numbers/special characters to the end of the password Ct$[0-9] Ct$[0-9]$[0-9] Ct$[0-9]$[0-9]$[0-9] Ct$[!@#$%^&*()+=.?] Ct$[!@#$%^&*()+=.?]$[0-9] <- Thats the rule that will work for us Ct$[0-9]$[!@#$%^&*()+=.?] Ct$[0-9]$[0-9]$[0-9]$[0-9] Ct So starting with a dictionary that included "troubadour" this would produce "Troubador&3" as something to check. And here are some "leet" transforming rules /a lsa@ /a lsa4 <- This rule, and /e lse3 /l lsl1 /o lso0 <- This rule /s lss$ They would get us from ""Troubador&3" to "Tr0b4dor&3" So before you presume what password crackers do and don't do you should actually tak a look at them. John the Ripper: http://www.openwall.com/john/ Hashcat: http://hashcat.net/oclhashcat/ And if you are a geezer like me, you may have started out with https://github.com/cracklib/cracklib way back in the days before /etc/shadow BTW, my lame claim to fame is that something I wrote inspired that comic: https://blog.agilebits.com/2011/06/21/toward-better-master-passwords/ Cheers, -j
[toc] | [prev] | [next] | [standalone]
| From | "Skybuck Flying" <skybuck2000@hotmail.com> |
|---|---|
| Date | 2015-10-21 08:16 +0200 |
| Subject | Re: Password crackers are not naive [Was: Firefox improvements.] |
| Message-ID | <b222d$56272dce$d47876e2$56789@news.ziggo.nl> |
| In reply to | #33031 |
Hmmm cool ideas. This gives me an idea. Psssst don't tell anybody. But I have a database of actual logins and passwords of a system ;) Could be interesting to try different password crackers and see which is best. Or organize a competition for people to write their own password generators. They would not even need to simply executables. Just a list of generated passwords would do. Then I would write some software to see which list(s) contain the most guessed passwords from the database. Could be a lot of fun. I would have to first check my older computers to see if that database is still there ! LOL. But I would recon there might be somebody in these newsgroups which actually already has a database ?! Perhaps a more recent one... mine is kinda old ?! Or even better... we could create a website... where people can enter their "hard to guess" passwords. And then see if the password crackers can make short work of that ! =D LOL That even more funny ! User(s) vs Cracker(s) ! =D Bye, Skybuck =D
[toc] | [prev] | [next] | [standalone]
| From | David Malone <dwmalone@walton.maths.tcd.ie> |
|---|---|
| Date | 2015-10-21 15:54 +0000 |
| Subject | Re: Password crackers are not naive [Was: Firefox improvements.] |
| Message-ID | <n08cfq$mou$1@synge.maths.tcd.ie> |
| In reply to | #33104 |
"Skybuck Flying" <skybuck2000@hotmail.com> writes: >Could be interesting to try different password crackers and see which is >best. https://contest.korelogic.com/ David.
[toc] | [prev] | [next] | [standalone]
| From | DecadentLinuxUserNumeroUno <DLU1@DecadentLinuxUser.org> |
|---|---|
| Date | 2015-10-21 11:57 -0400 |
| Subject | Re: Password crackers are not naive [Was: Firefox improvements.] |
| Message-ID | <kcdf2bhmvbfc3gp69r8vl4l327dbchr2js@4ax.com> |
| In reply to | #33108 |
On 21 Oct 2015 15:54:34 GMT, David Malone <dwmalone@walton.maths.tcd.ie> Gave us: >"Skybuck Flying" <skybuck2000@hotmail.com> writes: > >>Could be interesting to try different password crackers and see which is >>best. > >https://contest.korelogic.com/ > > David. Oh, look. The idiots are all still cross-posting and you wanted to blame me. Nice to see that you are all letting these guys know the err of their ways. Selective bullshit.
[toc] | [prev] | [next] | [standalone]
| From | dplatt@coop.radagast.org (Dave Platt) |
|---|---|
| Date | 2015-10-21 11:17 -0700 |
| Subject | Re: Password crackers are not naive [Was: Firefox improvements.] |
| Message-ID | <se1lfc-1ou.ln1@coop.radagast.org> |
| In reply to | #33104 |
In article <b222d$56272dce$d47876e2$56789@news.ziggo.nl>, Skybuck Flying <skybuck2000@hotmail.com> wrote: >Hmmm cool ideas. > >This gives me an idea. > >Psssst don't tell anybody. > >But I have a database of actual logins and passwords of a system ;) > >Could be interesting to try different password crackers and see which is >best. > >Or organize a competition for people to write their own password >generators. A cautionary tale: https://en.wikipedia.org/wiki/Randal_L._Schwartz with more details at http://www.lightlink.com/spacenka/fors/
[toc] | [prev] | [next] | [standalone]
| From | Rosario19 <Ros@invalid.invalid> |
|---|---|
| Date | 2015-10-12 09:56 +0200 |
| Message-ID | <m4pm1bhec94tv8taubms8ptk5ko009forj@4ax.com> |
| In reply to | #32713 |
On Sun, 11 Oct 2015 13:13:23 -0400, DecadentLinuxUserNumeroUno wrote: >On Sun, 11 Oct 2015 19:03:56 +0200, "Skybuck Flying" ><skybuck2000@hotmail.com> Gave us: > >>Oh and by the way... >> >>The intel community website... has the most annoying password requirements >>ever !!! > > You're a goddamned idiot, child. >> >>It must be 8 to 15 characters.. >>must contain lower and upper and a fokking digit or something and/or a >>special character ?! >> >>wtf ?! > > And now you show just how stupid you really are as it relates to >secure login crypto. More folks use the site for real business purpose, >and only childish idiots like you are too stupid to know what is going >on. >> >>This will not make it more secure at all... because people will probably put >>the special requirements at the back ! > > It doesn't matter, idiot. It still foils brute force search hacking >better. > > Grow the fuck up, you cross-posting retarded little piece of Usenet >troll dumbfuck. a brute force 'search' is recognoscibile from the receiver that can block that ip and account afther the 4th not good try in sequence, for some time... one hour or 2 or one day... and send email to administrator that one account can be under attack possibly with ip of who attack
[toc] | [prev] | [next] | [standalone]
| From | Jeffrey Goldberg <nobody@goldmark.org> |
|---|---|
| Date | 2015-10-18 01:25 -0500 |
| Message-ID | <d8gsagFp2hfU1@mid.individual.net> |
| In reply to | #32751 |
On 2015-10-12 07:56:09 +0000, Rosario19 said: > a brute force 'search' is recognoscibile from the receiver > that can block that ip and account afther the 4th not good try This is why it is important to distinguish between an on-line attack (as you describe) and an off-line attack. For an on-line attack, you just need passwords that aren't terrible or reused. As you correctly point out, these can be easily detected and throttled. It is for an off-line attack that all of the other stuff we've been talking about matters. When an attacker gains a copy of the servers password database, the passwords are typically stored as cryptographic hashes. Although hashes can't be reversed, one can test against them. Depending on how the passwords have been hashed, even a high end desktop computer can run hundreds of thousands of guesses per second. Cheers, -j
[toc] | [prev] | [next] | [standalone]
| From | "Skybuck Flying" <skybuck2000@hotmail.com> |
|---|---|
| Date | 2015-10-21 08:47 +0200 |
| Message-ID | <84303$562734f8$d47876e2$1227@news.ziggo.nl> |
| In reply to | #32711 |
I think the problem here with this "out of control" thread as some have called it is that "Brute Force" does not exist on a sequential computer. "Brute Force" can only truely exist on a parallel computer that can try all passwords at the same time. A sequential computer will have to start somewhere. And whereever somebody or something starts another person could accuse that of having "pre-knowledge" or assuming a "direction expectation", a bias. Start Up, Start Down, Start in the Middle it all has a certain bias when it comes to sequential computers ! ;) That's kind of a funny finding ! ;) I will leave it at that for now ! ;) At least when it comes to the start and search direction. Though brute force could also be defined differently as in terms of "passwords tried per second" or ammount of computations needed per password etc. So bottom line brute force as same said is a weakly defined term... to weak really ! ;) So want to call it dumb search, but then others object to it saying their brute force is kinda smarter haha ! :) Perhaps one nice definition of brute force could be to: "Spent huge ammounts of cpu time and real time on trying to find the password, relatively to the password length/number of possibilities" or "Eventually trying out all possible passwords where the starting point and direction is biased but not necessarily pre-known or whatever" ;) Bye, Skybuck =D
[toc] | [prev] | [next] | [standalone]
| From | "Skybuck Flying" <skybuck2000@hotmail.com> |
|---|---|
| Date | 2015-10-21 09:17 +0200 |
| Message-ID | <9ef72$56273c0e$d47876e2$1764@news.ziggo.nl> |
| In reply to | #32711 |
For the true password-freakers out there a document just arrived by France Researchers the title of the document louds (lol): " Monte Carlo Strength Evaluation: Fast and Reliable Password Checking " http://www.eurecom.fr/en/publication/4711/download/rs-publi-4711.pdf According to a newssite this document also claims that adding password rules is not sufficient (and weakens passwords it was claimed by news site). I scanned over this document there is some mention of these rules... and that it is indeed weak against modern attacks. Anyway... not going to spent too much time on it further... but it is a nice coincidence ?! ;) :) =D There ya go. Bye, Skybuck.
[toc] | [prev] | [next] | [standalone]
Page 14 of 15 — ← Prev page 1 … 12 13 [14] 15 Next page →
Back to top | Article view | sci.crypt
csiph-web