Hacker News Reader

Comment by bargl | Hacker News Reader

I honestly can't do it justice. See what Steve has to say. http://blog.lastpass.com/2010/07/lastpass-gets-green-light-f....

Also consider linking to a yubikey. https://helpdesk.lastpass.com/security-options/multifactor-a...

EDIT: DO NOT FOR ANY REASON DO THIS >for this reason I recommend writing your passwords down on a piece of paper you keep in your wallet or purse.

I cannot respond directly to Munin but anyone who suggest that is going to lead you to this http://www.telegraph.co.uk/news/uknews/crime/10276460/David-...

Someone could get a hold of your wallet and take a pic of your passwords then put them back and you'd never know you'd been compromised. And Lastpass uses the trust no one mentality so you don't have to trust them. They never see your password it's encrypted using your password and yubikey if you have one.

View on HN

Bruce Schneier thinks it's OK to keep your password on a piece of paper in your wallet.

https://www.schneier.com/blog/archives/2005/06/write_down_yo...

But, of course, don't write the password to an encrypted drive on a piece of paper that you keep with the drive.

That's also from 2005... Which isn't to say that it isn't still relevant. Most people don't understand that you really do need random passwords, which means that you must figure out how to create them properly.

Sure write them down if they don't matter, but don't write your bank account password down, or your google account. Especially if you have your ID in your wallet it'd be pretty easy to find you and get all your passwords if you lost your wallet. If you DO write them down, leave some portion of your password off.

I.E. your password is "password*&^&" only write down "password" and append the rest from memory.

It depends what the alternatives are, and what threats you face.

Steve Gibson has some flaws, and you really shouldn't be listening to him for any kind of security advice. If you have obsolete hard drives you might find his spinrite product useful.

Anyone remember his theory that removing raw socket access in Windows XP will stop the impending doom of spoofed packets and mass DDoS?

http://www.theregister.co.uk/2001/06/25/steve_gibson_really_...

Someone can photograph my wallet picture?

Then they could go to my computer and photograph my LastPass which, as this thread explains, is perfectly 'secure' to leave without a master password on 'trusted' machines.

Literally identical threat, IMO, being personally targeted for password theft.

If they can get my wallet, they can get to my desktop, I imagine.

Reply on news.ycombinator.com