full-disclosure - Re: pgp passphrase

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200403231924.04050.caraciola@gmx.net>
From: caraciola at gmx.net (Caraciola)
Subject: Re: pgp passphrase

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


...
> And if I 0wn your box, do you not think that my keylogger can get your 
> passcode?  Good grief!  If the box is hacked, I can get any information I 
> need from you to screw you up further.  Passcodes or anything else you have 
> *or* type are trivial to obtain once I have root on the box.
> 
> I'm a bit surprised that I have to point this out.
> 
> Paul Schmehl (pauls@...allas.edu)
...

One measure to enhance security would be externel storage of keys, on a smart 
card like in secure internet banking where an external reader has to  have a 
keypad, so a pass doesn't travel anywhere on the computer ... with banking 
there are only numbers as pass, but the principle seems sound enough.

Caraciola

- -- 
 Full-Disclosure - We believe in it.
 Charter: http://lists.netsys.com/full-disclosure-charter.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFAYIC+ANzMondHN+cRAmAuAKCKUVGLo5mbizClnaeKYGJKUt/v3wCgjK7L
tp2pKEqsgON7jBmOm5B9cpc=
=gFLY
-----END PGP SIGNATURE-----