Page 6 of 15 « First 45 6 78 Last »
Reply
Thread Tools
scudderfish is offline scudderfish
2010-01-18 , 13:04
Posts: 61 | Thanked: 36 times | Joined on Feb 2006 @ Harpenden
#51
Originally Posted by SubCore View Post
saving as a hashed string might be enough to soothe concerns here, and should be fairly easy to implement.
But the app needs to decode the encryption so it can send it to the IM service (hopefully over an SSL connection). If the app can decode it, then the app has access to the encrpytion key. If the app has access to it, so does the user. If the user has access so does the bad guy with physical access to the device. It's obfuscation, not encryption, and all soothing concerns does is engender a false sense of security which can lead to less overall security.
 

The Following 7 Users Say Thank You to scudderfish For This Useful Post:
feydrutha is offline feydrutha
2010-01-18 , 13:04
Posts: 68 | Thanked: 36 times | Joined on Dec 2009
#52
Originally Posted by SubCore View Post
you know, if you go to "file:///home/user/.ssh/id_rsa", you can see the PRIVATE key file of the N900's user! omg!
Yes, but in my case at least it is encrypted... that's why I have to type a passphrase to log in to servers from my phone ;-)
 
GameboyRMH is offline GameboyRMH
2010-01-18 , 13:04
Posts: 692 | Thanked: 264 times | Joined on Dec 2009
#53
Originally Posted by Stskeeps View Post
Bring it on, show us I'm willing to bet that we will be able to dissect anything you come up with due to the physical access to device.
I agree, any password storage method short of a software that accesses a TPM module will still be breakable on an open OS...but it wouldn't be as trivial as looking at the contents of just one file. And yes the iPhone and Android phones probably use plain text storage as well, but that's hardly an excuse.
 
Rob1n is offline Rob1n
2010-01-18 , 13:05
Posts: 3,617 | Thanked: 2,412 times | Joined on Nov 2009 @ Cambridge, UK
#54
Originally Posted by ruskie View Post
A salted md5 hash would probably more or less avoid many of the concerns.
Except the concern of actually working. The issue with these passwords is that the N900 has to actually submit them to the relevant servers. A non-reversible encryption process will break this.

As has been pointed out, with PR1.1 these passwords do not appear to be being saved to the accounts file (for new accounts), so this may already have been "solved".
 

The Following User Says Thank You to Rob1n For This Useful Post:
PhilE's Avatar
PhilE is offline PhilE
2010-01-18 , 13:06
Posts: 71 | Thanked: 65 times | Joined on Oct 2009 @ Brighton, UK
#55
there's too many stupid excuses coming up in this thread, if it was apple iphone it would already be on the lunch time news about it.
there is no other device in my possession what allows the exploit of passwords via a simple type of few words in a web browser and saying dont let it out your hands is not a solution. How is easy would it be for family and friends to spy on each other and yes it does happens amongst insecure people..
lastly how easy would it be for someone to code something to feed that data to a server?
Sigh....

I should be working, but I simply can't let that pass...

Firstly, I don't care about iPhones.

Secondly, there are several devices potentially in your possesion where I could retrieve your stored passwords if I physically had that device in my hands or on a desk in front of me.

Your Windows machine? Boot it up with any Linux distro on a USB stick, run the right program and I have all your local user logins and passwords.

You're a firefox user? Try running one of your stored passwords through this:

Code:
#!/usr/bin/perl -w

use strict;
use MIME::Base64;

if ( !defined(@ARGV->[0]) ) {
print "usage: $0 base64_password\n";
} else {
my $test = decode_base64(@ARGV->[0]);
print $test . "\n";
}
As I already pointed out, as soon as you no longer have physical access to your data, it doesn't matter what security measures you have in place, your data will be compromised eventually, given a sufficiently determined crook and a sufficiently valuable set of data.

Presumably if you lost you car keys and your car got stolen as a result, you'd be blaming the manufacturer for that, too?
__________________
Phil Edwards
Brighton, UK
 

The Following 11 Users Say Thank You to PhilE For This Useful Post:
R-R's Avatar
R-R is offline R-R
2010-01-18 , 13:07
Posts: 739 | Thanked: 242 times | Joined on Sep 2007 @ Montreal
#56
The only solution here is to have a keyring setuped correctly, but if it uses a 5 chars numerical-only key, there is not much gained either.

Not news, move along, nothing to see...
__________________
Please vote for the following Bugs:
 

The Following 2 Users Say Thank You to R-R For This Useful Post:
range is offline range
2010-01-18 , 13:07
Posts: 337 | Thanked: 160 times | Joined on Aug 2009 @ München, DE
#57
Originally Posted by Venomrush View Post
My question now is where does .rtcom-accounts\accounts.cfg get its data from to the backup and whether or not that's protected as well?
Just in case you still have not noticed: That does not have to do *ANYTHING* with or with not backing up the device.
 
mece's Avatar
mece is offline mece
2010-01-18 , 13:09
Posts: 1,111 | Thanked: 1,985 times | Joined on Aug 2009 @ Ċbo, Finland
#58
as I mentioned before, having a keyring type solution would definately be more secure for this. i.e. encrypting the password file and opening it for logging in with a password. but then you'd have to type in the password every time you want to log in to anything. that done right would protect the passwords to a certain degree.

I guess hashing the password is a simple way to make people feel secure, and it does give some protection against opportunist laymen.
__________________
Class .. : Meddler, Thread watcher, Developer, Helper
Humor .. : [********--] Alignment: Pacifist
Patience : [*****-----] Weapon(s): N900, N950, Metal music
Agro ... : [----------] Relic(s) : N95, NGage, Tamyia Wild One
Try Tweed Suit for your hardcore twittering needs
http://twitter.com/mece66
I like my coffee black, like my metal.
 
NvyUs's Avatar
NvyUs is offline NvyUs
2010-01-18 , 13:11
Posts: 1,885 | Thanked: 2,008 times | Joined on Aug 2009 @ OVI MAPS
#59
Originally Posted by PhilE View Post
Sigh....

I should be working, but I simply can't let that pass...

Firstly, I don't care about iPhones.

Secondly, there are several devices potentially in your possesion where I could retrieve your stored passwords if I physically had that device in my hands or on a desk in front of me.
the thing is you need to use software to get my passwords off me on my other devices in the form of jailbreaking my iphone and symbian devices to get to relevent files or install some unsigned software.
on the n900 zero effort as to be put in to get them.
my mom could do it by reading this thread and needing no software at all lol
 
feydrutha is offline feydrutha
2010-01-18 , 13:11
Posts: 68 | Thanked: 36 times | Joined on Dec 2009
#60
Originally Posted by GameboyRMH View Post
Seriously, it's about 3 more lines of code to encrypt it!
It's maybe 1 line of code to encrypt it, but where do you keep the encryption/decryption key? If it is also sitting unencrypted on the device, you might as well leave the whole thing in plain text as it makes 0 difference in terms of real security. Encryption is not some kind of magic that only lets good guys access stuff.

To provide real security you would have to ask the user for a passphrase to decrypt the password file... either every time the password needs to be used (highly impractical) or the first time, and then cache it for a certain amount of time or until reboot. This is what ssh-agent does for ssh key decryption passphrases.

A general solution offering a compromise between security and practicality would be to store this type of information in plain text, but inside an encrypted partition that is mounted at startup (after the user provides a passphrase). This is what I do on my Ubuntu pc, using ecryptfs. Not sure how easy it would be to port something like this to maemo. My guess: not so easy ;-)

Paolo
 

The Following 5 Users Say Thank You to feydrutha For This Useful Post:
Reply
Page 6 of 15 « First 45 6 78 Last »

Tags
conversations, debate, email, fremantle, instant message, instant messaging, maemo, maemo 5, modest, password, passwords, plain text, security, telepathy

« Previous Thread | Next Thread »

 
Forum Jump


All times are GMT. The time now is 14:33.

Contact Us - Home - Archive - Top