From a3ebcf060855b6e0caae7832569c2ec03d932295 Mon Sep 17 00:00:00 2001 From: Maarten Billemont Date: Sun, 12 Oct 2014 12:03:57 -0400 Subject: [PATCH] Fix a few spelling mistakes. --- Site/2013-05/css/main.css | 3 +++ Site/2013-05/security.html | 8 ++++---- Site/2013-05/what.html | 12 ++++++------ 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/Site/2013-05/css/main.css b/Site/2013-05/css/main.css index 5764fa15..bea72aea 100644 --- a/Site/2013-05/css/main.css +++ b/Site/2013-05/css/main.css @@ -508,4 +508,7 @@ table .box.green { header h2 { font-size: 2em; } + header .moviecontrol { + top: 1em; + } } diff --git a/Site/2013-05/security.html b/Site/2013-05/security.html index c0a1dfd7..8682885a 100644 --- a/Site/2013-05/security.html +++ b/Site/2013-05/security.html @@ -296,7 +296,7 @@

The Master Key

The first part of the process it to obtain a very strong "token" of your personal identity. We call this token your master key, because it is very much like the one and only main key that opens all your doors. It is a personal key, it represents your identity.

The master key is derived from your name and your master password, and thrown away as soon as it's no longer needed to minimize the risk of loss.

-

Since it's vital that nobody else can gain access to your master key, it's important that the process of deriving the key is unsurmountably difficult. An attacker could try a brute-force attack against your master key or password by convincing you to make an account on his website, and then guessing at your master password or your master key until he finds one that gives him your password for his fake site.

+

Since it's vital that nobody else can gain access to your master key, it's important that the process of deriving the key is insurmountably difficult. An attacker could try a brute-force attack against your master key or password by convincing you to make an account on his website, and then guessing at your master password or your master key until he finds one that gives him your password for his fake site.

These are two different types of brute-force attacks and we need to make sure to defeat both of them.

To defeat a brute-force attack against your master key, we make sure the master key is sufficiently high in entropy. Since the master key is a 256-bit key, an attacker would now have to make up to 2256 guesses, or try 115792089237316195423570985008687907853269984665640564039457584007913129639936 master keys before finding the right one. Even at an ambitious rate of 2 billion tries per second, it would take several times the age of the universe to try all of them.

A brute-force attack against your master password is more feasible, since your master password will be tiny compared to such a huge master key.

@@ -348,9 +348,9 @@

Custom passwords

- are sometimes still a necessity. You may want to store a password you've been using for a long time in your manager, or your boss may have set an unchangable password on your computer for you to use. Since Master Password's passwords are a mathematical result of your unchanging master password, it is impossible for it to be used with passwords that are created via another way.

+ are sometimes still a necessity. You may want to store a password you've been using for a long time in your manager, or your boss may have set an unchangeable password on your computer for you to use. Since Master Password's passwords are a mathematical result of your unchanging master password, it is impossible for it to be used with passwords that are created via another way.

The Master Password application however functions as a hybrid password manager, implementing both the Master Password algorithm and a vault-like password solution. In the second mode, Master Password uses your master key to encrypt custom passwords and store the encrypted result in a vault. Since we use the master key for this process, the result is a vault that is much harder to break into than that used by many other vault-based password solutions (specifically - because the encryption key is a large key derived from your master pasword using scrypt key derivation). As a result, this trade-off has been mitigated.

+ because the encryption key is a large key derived from your master password using scrypt key derivation). As a result, this trade-off has been mitigated.

@@ -367,7 +367,7 @@ the "something you know", they'll still need to obtain the "something you have" before they can break in. The most popular example of a two-factor solution is a bank card: Your PIN number is the secret you know, but with the PIN alone a thief can't get to your money. They'll need to first steal your card as well.

A vault-based password manager is often considered two-factor, since it relies on your vault password as well as access to your vault file. Most security experts disagree, however. To be truly multi-factor, the security factors should come from separate categories:

diff --git a/Site/2013-05/what.html b/Site/2013-05/what.html index 2b46f761..06ed6bf3 100644 --- a/Site/2013-05/what.html +++ b/Site/2013-05/what.html @@ -112,14 +112,14 @@

More complicated than what, exactly? Using robert17 for all your sites? Well, yes. That's also rather the point.

The point is to eliminate the many sources of insecurities related to password authentication, and yet keeping the process surprizingly trivial. What you get in exchange for these two extra first-time only steps is very robust, unique passwords which are not hackable even from a site's leaked password hashes, in addition to the freedom to forget all about passwords. Entirely.

I use this other password manager, and it's awesome.

-

I shall not endeaver to quarrel with the point on the awesome scale of your other password manager. That said, Master Password was designed from the ground up specifically because of the many flaws that existed in all the popular password managers at the time. And the times haven't changed for the better since.

+

I shall not endeavour to quarrel with the point on the awesome scale of your other password manager. That said, Master Password was designed from the ground up specifically because of the many flaws that existed in all the popular password managers at the time. And the times haven't changed for the better since.

I'm going to provide an excessively brief description of the primary flaws other password managers suffer, which Master Password is free from. Please contact me if you have something to add, ask or correct.

While each of these services have many great pros, I will only mention those that Master Password lacks.

@@ -156,12 +156,12 @@

You speak of trust, how can I trust you?

A very valid question, and arguably the most important one to ask!

-

Trust is a very difficult thing to guarantee. Powerful entities will sollicit your trust by appearing with it and coming well recommended. Trust can also be assured by legalese or contracts. If you have the means and energy to hold an entity responsible for his claims and actions, this might be sufficient for you.

-

Most of us mere mortals cannot affort this level of trust enforcement, however. We're mostly left in the position of trusting claims blindly, in the hopes that companies will not violate those claims for fear of taking a seizable public-relations hit.

+

Trust is a very difficult thing to guarantee. Powerful entities will solicit your trust by appearing with it and coming well recommended. Trust can also be assured by legalese or contracts. If you have the means and energy to hold an entity responsible for his claims and actions, this might be sufficient for you.

+

Most of us mere mortals cannot afford this level of trust enforcement, however. We're mostly left in the position of trusting claims blindly, in the hopes that companies will not violate those claims for fear of taking a seizable public-relations hit.

I propose that none of these forms of trust are sufficient adequate.

In fact, Master Password is what it is because it aims to avoid any requirement of trust in the solution's author. Master Password requires no services or proprietary storage format. I've published Master Password's algorithm for you to inspect and licensed to you the full source code to the implementations for you to use.

What that gives you, is the ability to either inspect and learn how Master Password works or to take this information to a professional (be it an academic, mathematician or payed developer) and have him do this for you.

-

While at first glimpse, this may not seem terribly useful to you - particularly when you don't have the skillset to perform this verification yourself - but it's actually a pretty big deal to show your naked self as proof of having nothing to hide. If you want to go all the way, you could even build the application from scratch rather than rely on the binaries provided by our distributions.

+

While at first glimpse, this may not seem terribly useful to you - particularly when you don't have the skill set to perform this verification yourself - but it's actually a pretty big deal to show your naked self as proof of having nothing to hide. If you want to go all the way, you could even build the application from scratch rather than rely on the binaries provided by our distributions.

This is the closest we can get to voiding any need for trust in Master Password, and it's more than you're likely to find in most other popular password solutions.