full-disclosure - Re: password.incleartext.com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <35333.1302124217@localhost>
Date: Wed, 06 Apr 2011 17:10:17 -0400
From: Valdis.Kletnieks@...edu
To: Romain Bourdy <achileos@...il.com>
Cc: full-disclosure <Full-Disclosure@...ts.grok.org.uk>
Subject: Re: password.incleartext.com

On Wed, 06 Apr 2011 22:38:56 +0200, Romain Bourdy said:

> So let's say I store password using PGP for *recovery*, encrypted with my
> own keys as sender and recipient , I can recover plaintext passwords
> whenever I want to, but is it unsecure ?

At that point, the security is exactly equal to the security of the keyring
your private key is on (plus whatever security is in the combo of your
passphrase and the means used to enter it).  If it's on a well-hardened
laptop, probably pretty secure.  You put the keyring on a multi-user
system where you don't trust the root user, you get what you deserve.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/