Hacker News Reader

Comment by malka | Hacker News Reader

I do not see more reasons to trust the OSX Keyring, than to trust a browser extension.

If you cannot trust OSX, there is no reason to trust a browser extension as it can be compromised... so why not stay at the lowest possible level.

Do you not trust the OSX Keyring because of apple? Or outside attackers?

If it is apple you don't trust in this regard, keychain is the least of your problems.

If it is outside attackers. At least they should need physical access to the machine to crack it, right? (If you don't back up that specific keychain to iCloud)

Both, actually. I Think encryption should involve specialized hardware, such as a smart card. That way, it would NEVER ever be exposed to a network.

In order to be used, it has to be exposed to the network.

not really. You could imagine a smart card with a software (the smart card itself runs the software)that would take bytes[] as an input and would output the encrypted bytes. The only 'network' communication would be between the card and the computer, and the computer would be unable to access the private key stored on the card.

Losing one of those things would not be fun.

Do you lose your house keys very often?

Not quite the same thing, but I have a little (physical) keypad that HSBC provided to generate codes to sign in online. It's small, and flimsy, and my almost-2-year-old is fascinated with it -- when she manages to get her hands on it, she presses buttons and talks on it like it's a tiny phone... it's adorable, but one of these days it's going to decide she has "failed" my passcode too many times and it'll brick itself.

And when I'm spending a month or two in Asia, for example, I have no illusions that I could possibly get another mailed to me, if it broke or was lost.

These are great in terms of security, and should be an option for people who need it, but shouldn't be obligatory (I wouldn't use this for my bank if I had a better option).

If OSX has a backdoor then the data can be compromised before it's encrypted. A smartcard would be useful for signing though.

You don't have to imagine them. They exist [0]. (Sorry, can't easily find a US link.) US government employees all have a CAC, as well, which is a crypto smartcard.

The key stays on the card. The card will do signatures and key generation, and also holds login/etc credentials. It works basically exactly like Malka says: bytes go in, signature comes out. It can likely do encryption as well, but you'd probably use it to generate a temporary key and then to sign the encrypted results, since the processor on cards is relatively weak.

0: http://www.acs.com.hk/en/products/17/acos5-64-cryptographic-...

At least in this case, there are a lot more eyes and attention on cracking OS X Keychain compared to this browser extension which most will forget about in a week or so.

There are similarly a lot more eyes and attention on keeping OS X Keychain safe.

Sorry, that was my point. There's a lot of effort going into cracking keychain, so there's a lot of attention on preventing these attacks from working.

Do you think it's better to put all your eggs in one basket, or in two baskets?

Private keys are not fungible, if you lose one you're done, game over. By putting them in more places you're making yourself strictly less secure.

Also, with that old and worn proverb about eggs and baskets, if having none of your eggs is equivalent in value to you for having only some but not all (i.e. you must have exactly all of them, or else you fail), then putting them all in one basket is better than putting in two (or more).

> By putting them in more places you're making yourself strictly less secure.

If you're trying to minimize baskets, though, then having two very-secure baskets is much better than having N baskets ever-growing because you can't trust in their sturdiness.

Which is to say, putting a USB with your private key on it in your safe-deposit box at your bank, for example, means being more assured about the fact that you'll have a backup copy, meaning you then feel safe excluding it from local hard-disk backups and synchronized remote backups/cloud storage, and have no reason to have it on any computers you aren't currently using for the sake of having somewhere to import it from. In a sense, you've added one vector of attack, but in practice, you've removed several.

Reply on news.ycombinator.com