skylab/MasterPassword
2
0
Fork 0
Code Releases Activity

track outbound links.

Browse Source
This commit is contained in:
Maarten Billemont
2014-07-18 12:03:27 -04:00
parent 31b2f22ded
commit 60ecd8181e
7 changed files with 41 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
Site/2013-05/security.html
View File

@@ -40,10 +40,10 @@
<li><a href="faq.html">FAQ</a></li>
<li><a href="algorithm.html">Algorithm</a></li>
<li><a href="support.html">Support</a></li>
<li><a href="http://github.com/Lyndir/MasterPassword/">Source (GPL)</a></li>
<li><a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">Source (GPL)</a></li>
</ul>
<ul class="nav pull-right">
<li><a href="irc://irc.freenode.net/#masterpassword">#masterpassword (freenode)</a></li>
<li><a href="irc://irc.freenode.net/#masterpassword" onclick="_gaq.push(['_trackPageview', '/outbound/irc']);">#masterpassword (freenode)</a></li>
<li class="divider-vertical"></li>
<li><a href="MasterPassword_PressKit.zip" onclick="_gaq.push(['_trackPageview', '/outbound/presskit']);">⬇ Press Kit</a></li>
<li><a href="http://itunes.apple.com/app/id510296984" onclick="goog_report_conversion('index-fixed-header');_gaq.push(['_trackPageview', '/outbound/itunes']);" class="img"><img src="img/appstore.svg" /></a></li>
@@ -170,7 +170,7 @@
<h3 class="inline">Master Password solves the <em>strong passwords</em> problem</h3>
<p>by generating passwords for you with extremely high entropy. We've found that humans are exceedingly bad at coming up with good passwords, especially when they need a new one every week for a new site they sign up with. Master Password therefore takes the guesswork out of it and generates high-entropy, memorable passwords. High entropy means that when a hacker obtains all of <a
href="http://www.washingtonpost.com/business/technology/linkedin-eharmony-deal-with-breach-aftermath/2012/06/07/gJQAwqs5KV_story.html">LinkedIn's password hashes</a>
href="http://www.washingtonpost.com/business/technology/linkedin-eharmony-deal-with-breach-aftermath/2012/06/07/gJQAwqs5KV_story.html" onclick="_gaq.push(['_trackPageview', '/outbound/linkedin']);">LinkedIn's password hashes</a>
again, they won't be able to brute-force your real LinkedIn password from it.</p>
<p>If you used an evenly distributed custom 8-character alphanumeric password (<code>p4sSw0rD</code> doesn't count), it would only take a powerful attacker <em>1.7 days</em> to brute-force your password from a leaked hash. If you used Master Password's default <em>Long Password</em> instead, it would take that same attacker <em>1.4 years</em> of non-stop focus on your password, assuming they already know you used Master Password. If they don't,
that time goes up to <em>26 billion years</em>. If you used Master Password's <em>Maximum Security</em> type, it would take up to <strong>422460722753999994880 years</strong>.</p>
@@ -217,11 +217,11 @@
<h3 class="inline">Master Password minimizes the parties</h3>
<p>you need to trust by implementing a completely stateless solution that requires <em>no storage</em> (you don't need to trust your hard disk or hardware), requires <em>no backups or syncing</em> (you don't need to trust that all your passwords are safely backed up and synced across your devices so they're actually available to you), requires <em>no cloud services</em> (you don't need to trust that your Internet connection is safe, or a cloud provider won't lose your
data or <a href="http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data">secretly send it to your or a foreign government</a>).
data or <a href="http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data" onclick="_gaq.push(['_trackPageview', '/outbound/prism']);">secretly send it to your or a foreign government</a>).
<h3>Trust is the most common failure point.</h3>
<p>Most other solutions that get strength right don't care so much about the trust front. They figure, if you're going to pay them for their app, you might as well trust them with all your passwords too. This really shouldn't be an implicit assumption. They're <strong>your passwords</strong>, and nobody else should have a say.</p>
<p>Knowing what happened to <a href="http://www.pcworld.com/article/2046264/after-lavabit-silent-circle-also-shuts-down-email-service.html">Silent Circle and Lavabit</a>, knowing how extremely powerful and persuasive governments and share-holders can be, you would be well advised to consider very carefully giving the keys to your digital identity to a separate entity.</p>
<p>Knowing what happened to <a href="http://www.pcworld.com/article/2046264/after-lavabit-silent-circle-also-shuts-down-email-service.html" onclick="_gaq.push(['_trackPageview', '/outbound/lavabit']);">Silent Circle and Lavabit</a>, knowing how extremely powerful and persuasive governments and share-holders can be, you would be well advised to consider very carefully giving the keys to your digital identity to a separate entity.</p>
</div>
<div class="hlvl">
@@ -407,8 +407,8 @@
<footer><div class="muted content">
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com">Maarten Billemont</a>, <a href="http://www.lyndir.com">Lyndir</a> (&copy; 2011-2013).</em></p>
<p><a href="http://gorillas.lyndir.com">Gorillas</a> ● <a href="http://deblock.lyndir.com">DeBlock</a> ● <a href="http://github.com/Lyndir">GitHub</a> ● <a href="http://thanks.lhunath.com">Send Thanks</a></p>
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/lhunath']);">Maarten Billemont</a>, <a href="http://www.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/lyndir']);">Lyndir</a> (&copy; 2011-2013).</em></p>
<p><a href="http://gorillas.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/gorillas']);">Gorillas</a> ● <a href="http://deblock.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/deblock']);">DeBlock</a> ● <a href="http://github.com/Lyndir" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">GitHub</a> ● <a href="http://thanks.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/thanks']);">Send Thanks</a></p>
</div></footer>