11-15-07 - 2

I'm using KeePass for all my passwords now. It's reasonably easy to set up and use, though the auto-import from Firefox is kinda broken. Anyway, it provides absolutely zero security against local machine spies such as keyloggers since it uses unsecure methods (either typing or the clipboard) to enter your data into web forms. It has no choice, Windows doesn't provide a way for apps to securely communicate with each other (I dunno maybe Vista improve this? you would also have to sign the apps so that they can know they are talking to the app they think they're talking to). Also Firefox could provide custom accessors to fix this as well, they could have their own PGP key inside firefox, make the public key public, and let other apps encrypt things with the public key and send them to Firefox, then internally decrypt with the private key and send it on the web, which perhaps you keep hidden at all times if you're on an https page (I imagine there must be a way to change your encryption algorithm without actually ever decrypting).

Anyhoo, the only thing it really does do is let you use a different strong password everywhere you go. That makes you secure from leaky sites spoiling your entire security. So one of the sites you go to is corrupt or just incompetent, they can't get to all your other sites. What with having money on poker sites of dubious integrity, that's a pretty useful protection.

Unfortunately that still doesn't protect you from the retarded fucking banks which seem to just lose hundreds of thousands of records on people all the time. It's so retarded that you can't change your social security number. You should be able to get a new one once a year. The government would keep a record of who corresponds to what numbers, but would only provide those records to law enforcement. Similarly with drivers licenses and credit card numbers. And anyway WTF why do I need all those different numbers, just one number is plenty. Being able to change it once a year severely reduces the risk of identity theft, and also makes it easy to catch them when they try to use someone's old data.

No comments:

old rants