Am 19.08.23 um 22:32 schrieb Patron Saint:
> On Sun, 6 Aug 2023 07:10:49 -0400, DMP wrote:
>
>>> I guess my PostIt notes with the passwords written on it, is
>>> safe for another year :-/
>>>
>>> Paul
>>
>> As is my Rolodex :-)
>
> As is my keepassXC which works on all the common PC & phone platforms.
> https://keepassxc.org/download/

Passwordmanager? Not for money! They are the biggest risk to every
system. FF und OS yes third party no, never.

Excessive X-posts to Windows-groups eliminated.

--
Alea iacta est

On 8/19/23 10:49 PM, Jörg Lorenz wrote:
> Am 19.08.23 um 22:32 schrieb Patron Saint:
>> On Sun, 6 Aug 2023 07:10:49 -0400, DMP wrote:
>>
>>>> I guess my PostIt notes with the passwords written on it, is
>>>> safe for another year :-/
>>>>
>>>> Paul
>>>
>>> As is my Rolodex :-)
>>
>> As is my keepassXC which works on all the common PC & phone platforms.
>> https://keepassxc.org/download/
>
> Passwordmanager? Not for money! They are the biggest risk to every
> system. FF und OS yes third party no, never.

What's wrong with a more or less obscure text file? If some miscreant
gains access to my computer I'll be too dead to care. The serious
programmers I know wouldn't dream of trusting software they didn't write
themselves.

> Excessive X-posts to Windows-groups eliminated.

--
Cheers, Bev
Life's journey is not to arrive at the grave safely and in a
well preserved body, but to skid in sideways, totally worn out,
and shouting HOLY SHIT, WHAT A RIDE!!!

Am 20.08.23 um 08:05 schrieb The Real Bev:
> The serious
> programmers I know wouldn't dream of trusting software they didn't write
> themselves.

Unfortunately this is not a realistic option.

--
Manus manum lavat

On Sun, 20 Aug 2023 07:49:35 +0200, Jörg Lorenz <hugybear@gmx.ch>
wrote:

>Am 19.08.23 um 22:32 schrieb Patron Saint:
>> On Sun, 6 Aug 2023 07:10:49 -0400, DMP wrote:
>>
>>>> I guess my PostIt notes with the passwords written on it, is
>>>> safe for another year :-/
>>>>
>>>> Paul
>>>
>>> As is my Rolodex :-)
>>
>> As is my keepassXC which works on all the common PC & phone platforms.
>> https://keepassxc.org/download/
>
>Passwordmanager? Not for money! They are the biggest risk to every
>system. FF und OS yes third party no, never.

I don't agree with you, but I'd like to see your reasons for stating
that.

On 20.08.23 15:34, Ken Blake wrote:
> On Sun, 20 Aug 2023 07:49:35 +0200, Jörg Lorenz <hugybear@gmx.ch>
> wrote:
>
>> Am 19.08.23 um 22:32 schrieb Patron Saint:
>>> On Sun, 6 Aug 2023 07:10:49 -0400, DMP wrote:
>>>
>>>>> I guess my PostIt notes with the passwords written on it, is
>>>>> safe for another year :-/
>>>>>
>>>>> Paul
>>>>
>>>> As is my Rolodex :-)
>>>
>>> As is my keepassXC which works on all the common PC & phone platforms.
>>> https://keepassxc.org/download/
>>
>> Passwordmanager? Not for money! They are the biggest risk to every
>> system. FF und OS yes third party no, never.
>
>
> I don't agree with you, but I'd like to see your reasons for stating
> that.

https://www.heise.de/news/Umstrittene-KeePass-Schwachstelle-mit-Update-geschlossen-7489944.html

https://thehackernews.com/2023/05/keepass-exploit-allows-attackers-to.html

https://nakedsecurity.sophos.com/2023/02/01/password-stealing-vulnerability-reported-in-keypass-bug-or-feature/

https://keepass.info/help/kb/sec_issues.html

Others are worse.

--
Alea iacta est

On Sun, 20 Aug 2023 16:11:44 +0200, Jörg Lorenz <hugybear@gmx.ch>
wrote:

>On 20.08.23 15:34, Ken Blake wrote:
>> On Sun, 20 Aug 2023 07:49:35 +0200, Jörg Lorenz <hugybear@gmx.ch>
>> wrote:
>>
>>> Am 19.08.23 um 22:32 schrieb Patron Saint:
>>>> On Sun, 6 Aug 2023 07:10:49 -0400, DMP wrote:
>>>>
>>>>>> I guess my PostIt notes with the passwords written on it, is
>>>>>> safe for another year :-/
>>>>>>
>>>>>> Paul
>>>>>
>>>>> As is my Rolodex :-)
>>>>
>>>> As is my keepassXC which works on all the common PC & phone platforms.
>>>> https://keepassxc.org/download/
>>>
>>> Passwordmanager? Not for money! They are the biggest risk to every
>>> system. FF und OS yes third party no, never.
>>
>>
>> I don't agree with you, but I'd like to see your reasons for stating
>> that.
>
>https://www.heise.de/news/Umstrittene-KeePass-Schwachstelle-mit-Update-geschlossen-7489944.html
>
>https://thehackernews.com/2023/05/keepass-exploit-allows-attackers-to.html
>
>https://nakedsecurity.sophos.com/2023/02/01/password-stealing-vulnerability-reported-in-keypass-bug-or-feature/
>
>https://keepass.info/help/kb/sec_issues.html
>
>Others are worse.

That *was* an issue with Keypass, but it's been fixed. And a problem
with one password manager doesn't mean that all password managers are
equally bad or worse.

Moreover almost all software has a security issue from time to time.
That's the nature of software. It isn't perfect, and problems pop up
from time to time. As far as I'm concerned, what's most important is
not a program's getting a security problem, but how quickly it gets
fixed.

If I didn't use a password manager, I'd have to remember all the
different passwords I use. There's no way I could do that. Yes, I'm
not immune to all security issues, but I do whatever I can to minimize
the risk.

And regarding "FF and OS," although they are not simply password
managers, they have password mangers built into them. They are as
vulnerable to security issues as any other password managers are.

Paul wrote:
> I just don't see the rationale for grasping at every shiny
> piece of software that comes along. Password managers have
> a pretty spotty history at the best of times. The bar is high
> for those puppies.

What makes 'sense' is what Proton is doing in their 'overall' scheme or
mission.

They came up w/ a secure mail idea; they offered it free and wove it
into free/pay. They continued to enhance the 'value added' aspect of
that model via Tor and pgp, building their security reputation.

Then they expanded into VPN, free/pay, and did a good job of that. Now
there are more value added services, Calendar and Password mgr as part
of the larger package.

'Another' free pw mgr may not make sense from a 'freeware' perspective,
but as part of a much larger value added pay service it is another
attraction or 'leader' or 'bait' if one looks upon capitalism unkindly.

Proton has open-sourced most of what it does, because what it is really
selling is the support and service, not the software.

--
Mike Easter

Paul <nospam@needed.invalid> wrote:
> On 8/19/2023 5:52 PM, Mike Easter wrote:
>> Patron Saint wrote:
>>> Why would he bother faking aoie when there's nothing wrong with eternal
>>> september (especially given Paolo Amaroso shut down aioe.org long ago)?
>>
>> Maybe he chose to configure some unknown agent that way back in the past
>> when he was using aioe; and then didn't bother to change it when he went
>> to e-s.  A stale config line.
>>
>> Maybe he is/was an aioe 'supporter'/fan then.
>>
>> I think that same line content was so stamped by aioe back when msg/s
>> were posted via that server.
>>
>
> This particular pattern has been done before, which means
> odds are, the author of the post is a <cough> "regular".
>
> I just don't see the rationale for grasping at every shiny
> piece of software that comes along. Password managers have
> a pretty spotty history at the best of times.

Spotty how?

>The bar is high
> for those puppies.

Indeed, but they are plenty good options

On Sat, 19 Aug 2023 23:05:42 -0700, The Real Bev
<bashley101@gmail.com> wrote:

>On 8/19/23 10:49 PM, Jörg Lorenz wrote:
>> Am 19.08.23 um 22:32 schrieb Patron Saint:
>>> On Sun, 6 Aug 2023 07:10:49 -0400, DMP wrote:
>>>
>>>>> I guess my PostIt notes with the passwords written on it, is
>>>>> safe for another year :-/
>>>>>
>>>>> Paul
>>>>
>>>> As is my Rolodex :-)
>>>
>>> As is my keepassXC which works on all the common PC & phone platforms.
>>> https://keepassxc.org/download/
>>
>> Passwordmanager? Not for money! They are the biggest risk to every
>> system. FF und OS yes third party no, never.
>
>What's wrong with a more or less obscure text file? If some miscreant
>gains access to my computer I'll be too dead to care. The serious
>programmers I know wouldn't dream of trusting software they didn't write
>themselves.
>
>> Excessive X-posts to Windows-groups eliminated.

I keep my password/passphrase list in a PGP encrypted file which is
saved to a TrueCrypt volume on two of my external drives. The
passphrases to the PGP file and the TC file are lengthy but very
memorable to me. However, just in case of a glitch in memory, my
entire list of passwords/phrases is in a clear txt file in my 1400 lb
six foot high safe. No, the safe was not bought for merely my
password/phrase list. A whole lot of my wife's and my own life have
been stored in that safe for decades.

Even Schneier agrees with me about writing down your
passwords/phrases. However, I don't use my wallet to save them in. I
don't do the Internet except at my desktop. I don't need to carry
them around,

https://www.schneier.com/news/archives/2010/11/bruce_schneier_write.html
"And when people say don’t write your password down. Nonsense. Write
it down on a little piece of paper and keep it with all the other
small bits of paper you value—in your wallet.”

On 8/20/23 12:06 AM, Jörg Lorenz wrote:
> Am 20.08.23 um 08:05 schrieb The Real Bev:
>> The serious
>> programmers I know wouldn't dream of trusting software they didn't write
>> themselves.
>
> Unfortunately this is not a realistic option.

Nope. Hence obscure text files...

--
Ch rs, B v
My f ck ng k yb rd h s l st ts v w ls.

On 8/20/23 6:34 AM, Ken Blake wrote:
> On Sun, 20 Aug 2023 07:49:35 +0200, Jörg Lorenz <hugybear@gmx.ch>
> wrote:
>
>>Am 19.08.23 um 22:32 schrieb Patron Saint:
>>> On Sun, 6 Aug 2023 07:10:49 -0400, DMP wrote:
>>>
>>>>> I guess my PostIt notes with the passwords written on it, is
>>>>> safe for another year :-/
>>>>>
>>>>> Paul
>>>>
>>>> As is my Rolodex :-)
>>>
>>> As is my keepassXC which works on all the common PC & phone platforms.
>>> https://keepassxc.org/download/
>>
>>Passwordmanager? Not for money! They are the biggest risk to every
>>system. FF und OS yes third party no, never.
>
>
> I don't agree with you, but I'd like to see your reasons for stating
> that.

The same reason I don't trust the fingerprint reader at the gym -- which
malfunctioned most of the time, requiring the attending human to feed in
my phone number. If there had been no human backup I would have had to
simply flout authority and walk in -- not all that possible if you're
locked out of your accounts or your computer itself.

--
Ch rs, B v
My f ck ng k yb rd h s l st ts v w ls.

Am 20.08.23 um 20:17 schrieb The Real Bev:
> The same reason I don't trust the fingerprint reader at the gym

Next escalation: No biometric data outside my direct control. I still do
not have a biometric passport. I use face recognition on my smartphones
and fingerprint on my Macs.

Once you have given away your biometric characteristics you can never
make that undone. And they can be spread like your e-mail-address.

--
Alea iacta est

Jorg Lorenz <hugybear@gmx.ch> wrote:
>Am 20.08.23 um 20:17 schrieb The Real Bev:

>>The same reason I don't trust the fingerprint reader at the gym

>Next escalation: No biometric data outside my direct control. I still do
>not have a biometric passport. I use face recognition on my smartphones
>and fingerprint on my Macs.

>Once you have given away your biometric characteristics you can never
>make that undone. And they can be spread like your e-mail-address.

Best of luck on wiping down every surface you've ever touched. The
technology to compare, archive, and retrieve fingerprints has been
around since the 19th century.

On Sun, 20 Aug 2023 08:10:06 -0700, Mike Easter wrote:
> Paul wrote:
>> I just don't see the rationale for grasping at every shiny
>> piece of software that comes along. Password managers have
>> a pretty spotty history at the best of times. The bar is high
>> for those puppies.
>
> What makes 'sense' is what Proton is doing in their 'overall' scheme or
> mission.

You seem to understand Proton's mission, but me, not understanding it, I do
kind of agree with Paul that a free password manager has "issues" in that
if it is (what he calls) spotty, then you've just lost all your passwords.

Luckily, KeepassXC is venerable, as is VeraCrypt and the Mozilla Tor
Browser. What I'd like to see more "free stuff" is proxy-enabled browsers.

I use Epic & Opera proxy browsers (often called vpn browsers) but a lot of
cloudflare web sites are filtering the proxies out more and more over time.
> They came up w/ a secure mail idea; they offered it free and wove it
> into free/pay. They continued to enhance the 'value added' aspect of
> that model via Tor and pgp, building their security reputation.

The Proton Mail free account works well enough for low message content
(which is most of us, as it's something like 150 messages per day).

It's really slow on the Mozilla Tor Browser, surprisingly but at least it
has an onion address when you're logging in from the Mozilla Tor Browser.

> Then they expanded into VPN, free/pay, and did a good job of that. Now
> there are more value added services, Calendar and Password mgr as part
> of the larger package.

I'm not familiar with proton's free VPN. Usually the "free" offerings
require an account (which defeats the whole point of VPN) and worse than
requiring an account to track you, most free offerings are really fremium
in that you have to give them a credit card first. That's worthless.

Let me look it up to see if it requires an "account" & CC or not.
https://protonvpn.com/free-vpn

Darn. It requires an account (which pretty much makes its VPN worthless).
Worse, paradoxically it won't use a protonmail account.

Worse still, it wouldn't take a mailinator account, so I gave up.
> 'Another' free pw mgr may not make sense from a 'freeware' perspective,
> but as part of a much larger value added pay service it is another
> attraction or 'leader' or 'bait' if one looks upon capitalism unkindly.
>
> Proton has open-sourced most of what it does, because what it is really
> selling is the support and service, not the software.

It seems like you understand proton mail's strategy, which I have nothing
against, where I personally use the proton mail, but nothing else yet.

If you know of a throw-away email domain that the VPN will accept, let me
know as a VPN that you're logged into is just about the worse thing to do.

Patron Saint wrote:
> If you know of a throw-away email domain that the VPN will accept, let me
> know as a VPN that you're logged into is just about the worse thing to do.

At the time I wanted to get a free Proton VPN, I didn't have any trouble
finding a throwaway; but that is a 'dynamic' variable. Now the place I
used requires 'invites' and for all I know, maybe Proton doesn't even
take their email addies anymore. I don't really want to recommend it;
except to say that I didn't find it that hard to do.

(And) Depending on how 'obscure' and anonymous one wants to be, there
are all kinds of problems to overcome, not the least of which is
anonymizing your connectivity, such as 'free' connectivity which can be
hard to find.

--
Mike Easter

On Sun, 20 Aug 2023 14:23:52 -0700, Mike Easter wrote:
>> If you know of a throw-away email domain that the VPN will accept, let me
>> know as a VPN that you're logged into is just about the worse thing to do.
>
> At the time I wanted to get a free Proton VPN, I didn't have any trouble
> finding a throwaway; but that is a 'dynamic' variable. Now the place I
> used requires 'invites' and for all I know, maybe Proton doesn't even
> take their email addies anymore. I don't really want to recommend it;
> except to say that I didn't find it that hard to do.

Thanks for that observation, where I've used a variety of throwaway mails
in the past, but it was surprising that Protonmail VPN won't even take
their own domain.

As a secondary VPN perhaps (since it requires a login account no matter
what IP address you connect to it from) the Protonmail VPN might still be
useful as the bandwidth is presumed to be good (but "unlimited" doesn't
mean it's fast - it just means you can have as many (fast? slow?) bits as
you like).

In short, the main drawback of the Protonmail VPN is (a) you have to have
an account and (b) you have to have an email that they'll accept for that
account - but other than that, it seems like an OK deal.

Thank you for suggesting it as I know you have pointed to VPN rating
systems in the past (e.g., are they offshore) and you've pointed out no
matter what they say, they must keep logs (at least temporarily), etc.,
but my needs are mostly for the IP switching effect of the VPN as I'm not
running (yet) away from any TLA.

> (And) Depending on how 'obscure' and anonymous one wants to be, there
> are all kinds of problems to overcome, not the least of which is
> anonymizing your connectivity, such as 'free' connectivity which can be
> hard to find.

It turns out, pragmatically anyway, the free connections are more anonymous
(simply because there is nothing to trace to you except your IP address).

However, I'm very well aware you're a proponent of the "you are the
customer" aspect of free services, and while that may very well be, if you
use a VPN that doesn't have any link to you (other than to whatever IP
address you're connecting from) and if you use openvpn software (instead of
the proprietary VPN-servers' software) and if you use encryption as much as
possible (e.g., proxy-based and tor-based browsers - although the whole
point of system-wide vpn is to handle more than browsing, such as torrents,
email and nntp messaging) - then all they have to tie to you is (a) what IP
address you connected with (admittedly damning) and (b) what you do.

Mostly I use VPN for IP anonymity to the final Internet server (e.g., to
the torrent server or to the nntp server or to the email server, etc.).

Am 20.08.23 um 21:50 schrieb Adam H. Kerman:
> Jorg Lorenz <hugybear@gmx.ch> wrote:
>> Am 20.08.23 um 20:17 schrieb The Real Bev:
>
>>> The same reason I don't trust the fingerprint reader at the gym
>
>> Next escalation: No biometric data outside my direct control. I still do
>> not have a biometric passport. I use face recognition on my smartphones
>> and fingerprint on my Macs.
>
>> Once you have given away your biometric characteristics you can never
>> make that undone. And they can be spread like your e-mail-address.
>
> Best of luck on wiping down every surface you've ever touched. The
> technology to compare, archive, and retrieve fingerprints has been
> around since the 19th century.

When I consider to kill Trump I will certainly wear plastik gloves.

*ROTFLSTC*

--
Alea iacta est

Patron Saint <patron@saint.com> wrote:
> On Sun, 20 Aug 2023 08:10:06 -0700, Mike Easter wrote:
>> Paul wrote:
>>> I just don't see the rationale for grasping at every shiny
>>> piece of software that comes along. Password managers have
>>> a pretty spotty history at the best of times. The bar is high
>>> for those puppies.
>>
>> What makes 'sense' is what Proton is doing in their 'overall' scheme or
>> mission.
>
> You seem to understand Proton's mission, but me, not understanding it, I do
> kind of agree with Paul that a free password manager has "issues" in that
> if it is (what he calls) spotty, then you've just lost all your passwords.

Only if you use the worst examples of pw managers. Good ones will cache
your pw database locally or you're in control of where it is. No risk from
being "spotty".

Am 21.08.23 um 09:04 schrieb Chris:
> Patron Saint <patron@saint.com> wrote:
>> On Sun, 20 Aug 2023 08:10:06 -0700, Mike Easter wrote:
>>> Paul wrote:
>>>> I just don't see the rationale for grasping at every shiny
>>>> piece of software that comes along. Password managers have
>>>> a pretty spotty history at the best of times. The bar is high
>>>> for those puppies.
>>>
>>> What makes 'sense' is what Proton is doing in their 'overall' scheme or
>>> mission.
>>
>> You seem to understand Proton's mission, but me, not understanding it, I do
>> kind of agree with Paul that a free password manager has "issues" in that
>> if it is (what he calls) spotty, then you've just lost all your passwords.
>
> Only if you use the worst examples of pw managers. Good ones will cache
> your pw database locally or you're in control of where it is. No risk from
> being "spotty".

Very recent incidents with Opens Source pw-managers tell very different
stories.

Irrelevant x-postings to windows groups deleted.

--
Alea iacta est

On Mon, 21 Aug 2023 07:04:59 -0000 (UTC), Chris wrote:
>> You seem to understand Proton's mission, but me, not understanding it, I do
>> kind of agree with Paul that a free password manager has "issues" in that
>> if it is (what he calls) spotty, then you've just lost all your passwords.
>
> Only if you use the worst examples of pw managers. Good ones will cache
> your pw database locally or you're in control of where it is. No risk from
> being "spotty".

Remember, this proton mail thing is a new product so we have to assume it
can be spotty (i.e., perhaps one of the worst examples of pw managers).

Also there are two pw manager fundamental models, local and cloud storage.
Model 1 = keepassxc => nothing leaves the local device, no account exists
Model 2 = lastpass => everything is stored in an account on their servers

While there is an inherent ease-of-use advantage to storing all your
passwords on someone else's server (in an account that they can lock you
out of at any time), there's also a _different_ inherent advantage of
storing all your passwords in a file you completely control and simply sync
between your own devices only (& where you might forget your own password).

Which of those two types is this new "Proton Pass" password manager?

Am 22.08.23 um 11:25 schrieb Patron Saint:
> Model 2 = lastpass => everything is stored in an account on their servers

An absolute NoGo!

--
Alea iacta est

Patron Saint wrote:
> Remember, this proton mail thing is a new product so we have to
> assume it can be spotty (i.e., perhaps one of the worst examples of
> pw managers).

Proton pass is open source and has been audited by

> This report describes the results of a security assessment of the
> Proton complex, more specifically covering the Proton Pass mobile
> applications and browser addon, as well as the web application
> and backend API endpoints. The project, which included
> a penetration test and a wider review of the security posture, was
> carried out by Cure53 in May 2023.

https://drive.proton.me/urls/AS97HV90MW#1RzmiLrBTUg4

There is a rather extensive Conclusions in there, which I don't know
which issues have been addressed.

I don't use PP so I have no experience w/ it, but it is a browser
extension available for multiple browsers Brave Firefox Edge Chrome and
Android & iOS.

--
Mike Easter

Patron Saint <patron@saint.com> wrote:
> On Mon, 21 Aug 2023 07:04:59 -0000 (UTC), Chris wrote:
>>> You seem to understand Proton's mission, but me, not understanding it, I do
>>> kind of agree with Paul that a free password manager has "issues" in that
>>> if it is (what he calls) spotty, then you've just lost all your passwords.
>>
>> Only if you use the worst examples of pw managers. Good ones will cache
>> your pw database locally or you're in control of where it is. No risk from
>> being "spotty".
>
> Remember, this proton mail thing is a new product so we have to assume it
> can be spotty (i.e., perhaps one of the worst examples of pw managers).
>
> Also there are two pw manager fundamental models, local and cloud storage.
> Model 1 = keepassxc => nothing leaves the local device, no account exists
> Model 2 = lastpass => everything is stored in an account on their servers

There's also a third model where you pay for a service via an account and
you also keep control of your files. You can put them on a cloud service of
your choice.