Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by g3orge | Hacker News Reader

Full thread

g3orge·

1Password is a great tool for that kind of stuff. I use it everyday, and it's very secure.

View on HN

If, by "very secure", you mean "keeps your list of sites on which you have accounts on in plaintext", then yes.

$ strings ~/Library/Application\ Support/1Password/1Password.agilekeychain/data/default/* | less

Who cares about the list of sites you have accounts? Unless you're paying for goat sex porn, the site names themselves are utterly boring and useless. Attackers already know you have an account on Amazon because you are a human being living in the developed world in the 21st century.

1Password is apparently unusable without a required master password (as it should be), so failing to also protect the site list with it was a serious and lazy mistake. If you have nothing to hide, that only means you aren't doing anything controversial, which I regard as a personal failing.

I love this response. :)

If you can't imagine a scenario where this is a Bad Thing, you aren't that imaginative. "Who cares?" is almost never the correct response to a bug report, especially a security-related one.

Does Keychain do this as well?

Yes.

:O so much for the concept of a password vault. I had better security than this when I was manually decrypting/encrypting a .txt file with my passwords with AES256

? what's your point, so there's a file that it stores on your hard drive. That's obvious. The passwords in that file are still cyphertext encrypted with your master password. Using "strings" doesn't give you anything that you can use to log in.

You need to pick a good password, but there's only 1 to remember (hence the name).

Did they store them in actual, real plaintext at one point? If so, that's not how it works now.

So are others like KeePass, LastPass etc.

Reply on news.ycombinator.com