HackerTrans
TopNewTrendsCommentsPastAskShowJobs

throwaway15908

no profile record

Submissions

Ask HN: Save, Public Password Vaults?

1 points·by throwaway15908·3 jaar geleden·13 comments

comments

throwaway15908
·3 jaar geleden·discuss
Sounds like a good way to weed out middle management ;)
throwaway15908
·3 jaar geleden·discuss
> correlated to progressivism

how?

also, there are better correlations to crime, than cop hatred, like darn communism is the first i can think of
throwaway15908
·3 jaar geleden·discuss
>how this token relates to the vault, nor how decrypting the token is a necessary dependency to decrypting the vault.

That is actually a good point i didnt fully understand myself, let me check ...

The only thing i could find quickly is https://keepass.info/help/base/keys.html

I dont know how these factors are combined. Damn. Ill keep digging. Thanks.

> Kerckhoffs's principle

An attacker from the outside needs to know 2 passwords, one for the one time decryption of the token and my master password for the vault every time.

EDIT:

Hashed. If a key file does not match any of the formats above, its content is hashed using a cryptographic hash function in order to build a key (typically a 256-bit key with SHA-256). This allows to use arbitrary files as key files.

From the link above. So my 8kb keyfile gets reduced to sha256 and used as an additional key. So this is not really a gain. A attacker does not need to guess all the random 8kb blobs, possible, just all sha256 hashes, just.

Any suggestions to overcome this reduction?

EDIT2:

There is no overcoming. When the additional key file is fixed length in the end, size of the token does not matter, its not that future proof is my conclusion.

I have to rethink this approach. Thank you so much.
throwaway15908
·3 jaar geleden·discuss
Ok, fine. I still dont feel comfortable, but here is the link.

https://github.com/proxemy/dotfiles/blob/master/scripts/toke...

The vault is regular kdbx with an additional password file.

Thank you for your time btw.
throwaway15908
·3 jaar geleden·discuss
But an attacker can never tell if the current guess to crack the token is the right one. Its just random noise in the end.
throwaway15908
·3 jaar geleden·discuss
I am not a cryptographer, so please keep that in mind.

> An attacker that does have access to vault and token is given the ability to try brute force and to look for cracks that might allow decrypting the vault.

My reasoning for the token is, that an attack has to brute force both, the token and _after success,_ the vault. But the token is just a random blob with no HMAC and in my public repo is a script that directly tells you, that you will always get a random blob – correct password or not.

> to look for cracks

Is not possible afaik.
throwaway15908
·3 jaar geleden·discuss
I should have said that the token file is several kb in size, about 1/20 of my vault size, and of course random noise.

I am aware that future hardware or algorithms could bring down the cost of brute forcing it, thats why ive choose several kb size.
throwaway15908
·4 jaar geleden·discuss
I dont know why you get down voted because you are absolutely right.

I would go even further and demand regulators to define standards to enable migration or self hosting.
throwaway15908
·4 jaar geleden·discuss
Are you sure, there is no signal in background radiation? Someone should check.
throwaway15908
·4 jaar geleden·discuss
I really want to see that risk assesment.
throwaway15908
·4 jaar geleden·discuss
Its easy and it starts with language.
throwaway15908
·4 jaar geleden·discuss
Wouldn't it be feasible to replace this "get your own domain" part just by letting tor doing the lookup for some introduced .onion site. My reasoning is, that this could get much faster adoption rates and/but is also self hosted on a single client device.
throwaway15908
·4 jaar geleden·discuss
Degrading social care systems and social mobility is actually to blame for this. This is what OP is missing in his/her rant.
throwaway15908
·4 jaar geleden·discuss
Black people were discriminated in the US from the beginning. This discrimination continued long after civil rights reforms in public and private institutions.

Even if you could magically eliminate racism in every human brain on earth with a snap of your fingers, the socio-econimic factors, inherited from the beginning would continue to be disadvantageous for blacks. So the racism back then, even when not present in minds today, would persist. This is called systemic racism, because we discriminate indirectly, not by skin color but by education, vocabulary, human capital in general. And on top, racism will of course prevail in minds.

From that, you can easily advocate for some sort of compensation, some kind of counter discrimination, anti-racism.

I find that term troublesome too, because you actually asking for support for all poor people, not just blacks, but i would never call it a ideological label and bad, because i can see the reason behind it. Using it as a label and associating it with (group) identity is unfortunate but not my mistake.
throwaway15908
·4 jaar geleden·discuss
A system is either sustainable or not, this is independent of population.

The sustainable level of consumption is dependent on population.
throwaway15908
·4 jaar geleden·discuss
I was about to write "The Problem we both have is mislabeling" but then i realized that we dont have the same problem.

From my perspective, conservatives/rights often stand out with blatant and harmful falsehoods. Even in your last post is a central self contradiction.

>movements that get grouped under "woke" self-identify with vacuously positive labels that can't be negated

>If I go around telling people "anti-racism is bad", they're going to think I mean "racism is good"

Looks like your "anti-racism is bad" statement is not meant to be negated. I think, what you meant is "racism is bad but what you are doing is too", which, from my perspective, is not equivalent to "anti-racism is bad". Your mistake here is, that you use their "racism"-label and invert it, to make it suit you. By doing so, you reduce the conversation to labels and discard similarities between you (which is actually the most harmful part).

A slight difference in phrasing is deciding if i agree or disagree with you. Is it my fault or yours?
throwaway15908
·4 jaar geleden·discuss
From broad brain traits like sexual orientation down to smaller ones like spatial perception or emotional intelligence, a young brain has certain development windows in which a trait or ability can get more or less developed. You could even add in personality traits like competitevness or deference once you associate it with a gender role.

With "female brain structure" i mean traits that are commonly overrepresented in what you might see as a regular woman. I know its inaccurate but so is the opposite, by saying there are only 2 genders and men are all men. Gender is a spectrum in many dimensions and my example of male physique and female brain structure is just a simple counter example against this.
throwaway15908
·4 jaar geleden·discuss
So you agree with me, that left and woke is not the same thing.

Whats odd thou is, (1) there is no clear definition of wokeism, like its an arbitrary stereotype used by demagogues and (2), that woke is often displayed on the other side of right/conservative. This makes it a strong indicator of propaganda. A surface, people can project their negative emotions to, which is another red flag in terms of populism. Even you used it indirectly, to refer to your peers "not liking woke", which is why i asked.

I am not defending wokeism too. One core value of the left is equality and solidarity. When you define wokeism as some LGBTQ-stuff, it would be just a subset of these values. So being woke does not make you left.

This is my answer to, what is the difference between woke and left.
throwaway15908
·4 jaar geleden·discuss
I think, you are contrasting your peers to a propagandistic caricature.

Or how easy can you fit in that image "moderate" leftists like bernie sanders or noam chomsky?

What is the difference between woke and left?
throwaway15908
·4 jaar geleden·discuss
This is dangerous bs. Easy to swallow for the uneducated masses.

Putting all moral consideration aside, imagine you could totally depopulate two continents of your choosing. Why should any problem of modern economics be solved by that?

The concept of depopulation is simple enough to fit in a single sentence, it leaves out the real problem and its vast complexity (our linear economies and lifestyles attached to it), conveniently some one else is to blame and with all that, it is compatible to xenophobia. It ticks all boxes.

Of course, no problem would be fixed, the only thing you would buy with depopulation is time. The real problem is our unsustainable system, which is independent from any population count.

>We are too many people for what?

Is the question you fail to ask and answer. And going further this path of stupidly easy enemy stereotypes leads to all the societal atrocities you may have heard of.