diff --git a/Site/2013-05/what.html b/Site/2013-05/what.html index f941994e..012a38aa 100644 --- a/Site/2013-05/what.html +++ b/Site/2013-05/what.html @@ -72,7 +72,8 @@

In fact, just stop thinking about passwords at all.

Master Password users have no more passwords. They have a password. Their password is their single master key for unlocking all doors.

-

One, two, enter.

+ +

One, two, enter.

As a Master Password user, there are about three steps to entering any site:

  1. Enter your master password to unlock your Master Password app.
  2. @@ -118,7 +119,8 @@
  3. You can stop sharing the keys to your digital life with online password websites that promise all the military grade encryption while being gagged and tapped by a government agency.
  4. -

    I use this other password manager, and it's awesome.

    + +

    I use this other password manager, and it's awesome.

    I shall not endeavour to quarrel with the point on the awesome scale of your other password manager. That said, Master Password was designed from the ground up specifically because of the many flaws that existed in all the popular password managers at the time. And the times haven't changed for the better since.

    I'm going to provide an excessively brief description of the primary flaws other password managers suffer, which Master Password is free from. Please contact me if you have something to add, ask or correct.

    @@ -139,7 +141,8 @@ -

    What are Master Password's cons? Or is it flawless?

    + +

    What are Master Password's cons? Or is it flawless?

    Master Password also has cons. Let's be frank and list the cons that the other solutions generally don't suffer:

    Cons: Changing your master password requires you to update all your site passwords. A compromised or forgotten master password requires you to do the same.

    @@ -154,7 +157,8 @@

    Two factor authentication is defined as authenticating yourself with two methods that are so distinct that a single attack cannot compromise both. Many sites claim to use two-factor authentication but actually rely only on an extra password hidden in an app on your phone or computer. If an attacker can steal your master password, he can probably download the hidden password too. Or read in your two-factor response while you're typing it in. On top of that, you're using a password manager: after your "two-factor" authentication, you get a single password to perform another one-factor authentication with a site. As a hacker, I'd go for the weakest link to break your chain. -

    You speak of trust, how can I trust you?

    + +

    You speak of trust, how can I trust you?

    A very valid question, and arguably the most important one to ask!

    Trust is a very difficult thing to guarantee. Powerful entities will solicit your trust by appearing with it and coming well recommended. Trust can also be assured by legalese or contracts. If you have the means and energy to hold an entity responsible for his claims and actions, this might be sufficient for you.

    Most of us mere mortals cannot afford this level of trust enforcement, however. We're mostly left in the position of trusting claims blindly, in the hopes that companies will not violate those claims for fear of taking a seizable public-relations hit.