sullof

That sounds great.

Also, you could use an extension to generate the signature. The password, in this case, would never be passed to the client.

You can inspect the website and detect a backdoor. It is not easy, but nobody would risk to be caught doing that. On the server side, we have no possibility of knowing what happens.

That sounds interesting.

It is not for team, right now. But I can add features in that direction if there is interest from the community.

If you are interested in checking a completely different approach, you can look at Secrez https://github.com/secrez/secrez. It is a CLI secret manager that supports git repo for distribution. Using other packages in the suite, Secrez allows direct communication between local desktop accounts using SSL tunneling. Disclosure: I wrote it.

Hello, this is Francesco, the author of Secrez. Just in case you have any question.

Original author here, ask me anything. Thanks

Any comment, critic, pull request is much appreciated.

I think that the author says that he doesn't think there will be a "hub". And, personally, I agree on this.

Why do great VCs have websites that sucks?

Sometimes I have the impression that some entrepreneurs like to say that there is a bubble because so they can say: "Yes, he raised all that money, or had that big exit, but not because he is better than me, only because there is the bubble".

This is from yesterday: http://twitter.com/#!/passpack/status/114181283097214977

I seem that this article contains a lot of good points about Javascript cryptography. The error of the author is that he is unable to see a reason to build a secure application based on Javascript because his prejudices are too strong. I am the founder of Passpack. We use Javascript cryptography from 2006. We have 16,000 active users and nobody ever reported loss of data. I think that if you are conscious of all the issue connected with browsers and their problems, you can build a good system that is able to protect not only the security of the users but also their privacy. And the privacy can not be protected with a server-based cryptography system.

I was interested to know if someone other than Passpack uses the "Big Friend" approach to improve the security. Do you know other examples?

Before that a developer, I am a song-writer. When you write a song, you start listening a lot of music. After, you put all that music in a side of your brain and forget it. After, you sing and sing untill you sing something totally different.

I agree. In fact, I specified that using the browser is good in some cases with the caveat that there is at least a master password protection. But a good password manager is always a better idea. Of course everyone chooses the one that best fits his needs, but the important thing is that you use one. 1password is a great product for consumer and individuals.

@kpozin, obviously I was replying to kylekramer :)

Maybe. But it seems to only be connected to sync. Do you know if there is a way to simply protect your stored passwords without start sync?

I don't think that there is a one-size-fits-all product. I am a cofounder of Passpack, an online password manager for workgroups. So for me I've found my optimal solution (I built it!), but that doesn't mean it is optimal for every use case. Sometimes I also use the browser's password manager, for example for some non critical sites. Firefox's built-in password manager has good security measures. However since I prefer to browse with Chrome, and Chrome does not have a master password protection, that leads me to rely entirely on Passpack. So as a first step, I think Chrome should add a master password to protect the stored passwords. There's little point in adding sharing features if basic in-browser protection is still missing.

I work in two separate office for most of my time (in Sunnivale and Mountain View), primarily at home during weekend, and in some coffee shop when I am in San Francisco or in other places.

I think that using password schemes is bad. Because in order to be useful, the method needs to be fast, simple and replicable. Suppose that someone creates a fake website in order to grab one of your smart passwords. If he understands that you use a method, he will try to deconstruct the method based on the fact that his website surely is included in some manner in the password itself. Also, since many people who use these methods tend to divulge them to the community, there isn't even a need to create a fake website to understand your passwords. The only solution that really works is to use a password manager. My favorite obviously is Passpack, because I am a co-founder, but regardless of which software you choose the important thing is that you use it. My advice is not to relay on any clever schemes because you may be in for a bad surprise.

Great work!