LinkedIn password database compromised

Thu Jun 7 15:29:16 UTC 2012

On Thu, Jun 7, 2012 at 6:36 AM, Peter Kristolaitis <alter3d at alter3d.ca> wrote:
> On 6/7/2012 9:22 AM, James Snow wrote:
>> On Wed, Jun 06, 2012 at 11:14:58PM -0700, Aaron C. de Bruyn wrote:
>>>
> "Imagine if the website has a lock on it, and you tell them what key you
> want to use by giving them a copy."
> "But if they have a copy of my key, couldn't they use it to open all of the
> other locks I've set up to use it?"
> "(explain public key crypto)"
> "(drool, distraction by the latest Facebook feature)"

You'd run into the same issue explaining how MD5, SHA1, salting,
etc... works to 'protect' their password.
Users don't care.
If putty were to pop up its password box when my mother signed in to
her computer and then I said something like "Don't worry, you won't
need to enter passwords while you surf the 'net now." and maybe showed
her the chrome extension icon thingy to click when she wants to paste
her 'password' (public key) into a new site, she'd be fine with it.

> The other problem with this approach is that, as bad as trusting remote
> sites to do security properly is, I'm not sure that putting a "one key to
> rule them all" on users' machines is that much better, given the average
> user's penchant for installing malware on their machine because
> "FunnyMonkeyScreensaver.exe" sounded like such a good idea at the time...

And how does our current system of usernames and passwords avoid
malware that logs keystrokes?

> I suspect we'd see a huge wave of malware whose sole purpose is to steal
> public keys (and you KNOW users won't password-protect their private keys!).
>   Plus, now you have the problem of users not being able to login to their
> favourite websites when they're using a friend's computer, internet cafe,
> etc, unless they've remembered to bring a copy of their private key with
> them.

Yep--that's the one big problem I can see with this 'solution' that I
don't have an answer for yet.
It would be difficult to get users to carry around a USB key or a
smartcard, or whatever to get them signed in while away from their
home computer.

-A