Boston Linux & UNIX was originally founded in 1994 as part of The Boston Computer Society. We meet on the third Wednesday of each month, online, via Jitsi Meet.

BLU Discuss list archive


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Discuss] Reusing Passwords on Different Sites Should be OK



> From: Bill Ricker [mailto:bill.n1vux at gmail.com]
> Sent: Thursday, September 17, 2015 10:11 PM
> 
> Reusing passwords requires the users to know that the encryption is of a
> safe variety.? Most users are not qualified to tell good crypto from bad
> crypto.? Heck, most programmers can't be qualified to use good cypto
> correctly.
> Password Encryption done client-side must be handled very carefully to
> avoid replay attacks yet still actually validate something.? Sounds like a half-
> hearted attempt at Challenge-response.
> tl;dr No.

Everybody knows they shouldn't login to anything over http://
We've all been trained to use https:// and ensure we have green checkmark security shields or whatever.
Because thousands of random unknown employees maintaining the routers on the Internet could access the http traffic.

When you login via HTTPS, to google, facebook, twitter, and thousands of other sites, there are still thousands of unknown employees maintaining the load balancers and web servers at the other end, who could access the traffic.

It is a no-brainer. You should not send your password or encryption keys, even over https. You need to prove you know your secret without exposing it.



BLU is a member of BostonUserGroups
BLU is a member of BostonUserGroups
We also thank MIT for the use of their facilities.

Valid HTML 4.01! Valid CSS!



Boston Linux & Unix / webmaster@blu.org