On Thu, Aug 8, 2013 at 8:56 AM, Kyle Maxwell <[email protected]> wrote:
> Must every app data store reinvent the wheel rather than use operating > system functionality? > > Agree in theory, but do all operating systems have standard data stores that are encrypted with the user's password? They don't. > On Thu, Aug 8, 2013 at 10:42 AM, R. Jason Cronk <[email protected]> > wrote: > > I'll bite. You design your systems for the threats your users face. As > many > > have mentioned, the threat most users face is from a spouse, partner, > > business associate, sibling, parent, children. Password fields don't > display > > typed text to protect against shoulder surfers. It clearly doesn't > protect > > again other adversaries such as keyloggers or others with access to the > > browser DOM. In this light, I think it is reasonable to encrypt the site > > passwords with a master password or at least have require a master > password > > to display the cleartext. It could always have an option to disable or > use a > > blank default master password for those who don't face the threats > > illustrated above. > > > > Really, however, we need to move to a post password model, that combines > > security and useability. > > > > My 2 cents. > > > > Jason >
-- Liberationtech list is public and archives are searchable on Google. Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at [email protected] or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
