Do you need 3rd party AV ?

[#1]

---

@7up wrote:

While you've decrypted that text file it can be copied by another process and whisked off out the door via a tcp connection to any hacker who's managed to get into your system.

That's not happening on my systems though. I use Linux on my laptop and FreeBSD and OpenBSD on my desktop and servers.

Your password length has just saved any hacker from trying the first X combinations unto the end of 15 characters. In essence telling someone your password length saves them a lot of time and effort - especially when using a gpu to generate different combinations.

How long it takes to crack a password entirely depends on the method of and combination of things used to generate the random numbers. Using md5, which is a hash function, to generate random numbers would be idiotic. md5 can be cracked in minutes or hours using GPUs depending on the size of the string. Using OpenSSL or GPG however is an entirely different story, regardless of whether you know the password length because it would still require performing X number of calculations to crack the password. And the biggest government agencies in the world can't even do that, so much so that they want to mess with things like Intel RdRand to weaken it's output.

As for losing your usb stick, that is causing yourself trouble and in reality you should keep copies of your file somewhere.

---

Losing a USB stick is no different than losing a book or a notepad the passwords are written down in. However, my USB stick containing my passwords is attached to my keyring and in 30+ years I've never misplaced a set of keys. I do however shake and rattle when plugging it into devices to access websites.

[#2]

It’s all very well using a password manager, be it a book, commercial software, excel file, or even something you have written yourself for maintaining your passwords client side. But the plain text of it still ends up in the application, prior to being sent down the wire. It may be that that wire is encrypted but it is still present in its vanilla form.

As I said in a previous post it really is all down to trust. If you have an issue with trust as regards software then do you trust the software you’ve just entered your vanilla text password in to, from where it could be stolen? Not just the password either, but the login username and the service to which it pertains is all there ready for the harvesting, from an exploitable application, and there is nothing to protect you in that scenario, which as we all know is a very real possibility.

[#3]

---

@7up wrote:

Years ago despite people like yourself claiming that linux was super secure it transpired that it was the most hacked OS on the planet due to the number of webservers being attacked that were running various linux distros.

Microsoft vulnerabilites; 5151: https://www.cvedetails.com/vendor/26/Microsoft.html

Linux vulnerabilities; 1934: https://www.cvedetails.com/vendor/33/Linux.html

Look at the number of the "gain privilege" column totals. Or I can save you the trouble. MS: 589 Linux: 245. An even more important breakdown that isn't stated there would be the number of remote vs physical access privilege escalations there are. Linux has a high number with 245, but many of them require physical local access to the device, not remote. Those metrics ARE available to see when you investigate the above pages further though.

Look at the number of the "# of exploits" column totals for the above two links. Or again I can save you the trouble. MS: 196 Linux: 33.

Microsoft 196 vulnerability list; see the "access" column: https://www.cvedetails.com/vulnerability-list/vendor_id-26/hasexp-1/Microsoft.html

Linux 33 vulnerability list; see the "access" column: https://www.cvedetails.com/vulnerability-list/vendor_id-33/hasexp-1/Linux.html

Remote means you do not require physical access to the machine for the exploit. Local means you do. The Linux kernel has ONE remote exploit for ipv6 (something created by the IETF, not Linus Torvalds and the Linux Kernel programmers). Back in 2008. On the 2.6 kernel. We're now up to kernel 4.x.

Also note the "gained access level" column. In particular how many times the word "admin" appears. It appears twice for Linux (again, on the 2.6 kernel). It appears considerably more for Microsoft.

Top 50 vulnerable list; Microsoft 1st. Linux 8th: https://www.cvedetails.com/top-50-vendors.php

Linux is a kernel. Not an operating system. The suite of tools on top of Linux are what make an operating system. That's why Richard Stallman has his "GNU/Linux" meme.

Back in the day most Linux servers were exploited because of the software on top (actually they still are). SSH was one such piece of software. That exploit even famously made it's way into the Matrix Reloaded film. Other forms of attacks were on web serving software (such as Apache) or website software (written in PHP), that does not detract from Linux kernel security.

The thing about open source software is people can see bugs and holes and patch them before they get spotted by others and a CVE is even required. Most of the time however, security researches find a bug or hole and create a proof of concept, they notify the software authors, the software authors write and issue a patch and then the security researcher announces their exploit and the CVE for it. But it doesn't matter, since the software has already had a patch rolled out. The only people who sit on exploits are 'the bad guys'.

Closed source software on the other hand doesn't have to announce anything. Microsoft only announces CVEs when they're highly critical, or already being exploited. As we saw with WannaCry, they will also willingly sit on patches they have created for security holes they know exist and are critical, and SHOULD have deployed to all versions of their OS the vulnerability was related to. But only did so when the risk of public relations disaster blow back became so bad they had to release them.

It turned out that windows suffered far less hacks though it suffered from more viral / malware attacks.

Food for thought..

Are you implying that viral and malware attacks are any less severe than kernel based attacks?

[#4]

---

@Anonymous wrote:

It’s all very well using a password manager, be it a book, commercial software, excel file, or even something you have written yourself for maintaining your passwords client side. But the plain text of it still ends up in the application, prior to being sent down the wire. It may be that that wire is encrypted but it is still present in its vanilla form.

As I said in a previous post it really is all down to trust. If you have an issue with trust as regards software then do you trust the software you’ve just entered your vanilla text password in to, from where it could be stolen? Not just the password either, but the login username and the service to which it pertains is all there ready for the harvesting, from an exploitable application, and there is nothing to protect you in that scenario, which as we all know is a very real possibility.

---

Trust is a big part of it. Especially with closed source software.

At least on the open source side, you can read through the source code of the software you are using. However, even then there is still a matter of trusting the software that compiles said software. And that goes all the way back to the 1980s and Ken Thompson's speech "Reflections on trusting trust".

https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well-installed microcode bug will be almost impossible to detect.

It shows how long this debate in particular has been going on for in the tech community. If you don't trust the output binary, how can you trust the compiler binary? Also interesting that in 1984 he was talking about infecting malicious code into hardware microcode, which has become a very real problem with modern computer systems and all the little individual pieces of hardware within a computer that require their own chips and firmware.

[#5]

My replies in blue (sorry but this forum is such a pain!)

---

@Anonymous wrote:

---

@7up wrote:

While you've decrypted that text file it can be copied by another process and whisked off out the door via a tcp connection to any hacker who's managed to get into your system.

That's not happening on my systems though. I use Linux on my laptop and FreeBSD and OpenBSD on my desktop and servers. That does make you a harder target using not so popular OS's

Your password length has just saved any hacker from trying the first X combinations unto the end of 15 characters. In essence telling someone your password length saves them a lot of time and effort - especially when using a gpu to generate different combinations.

How long it takes to crack a password entirely depends on the method of and combination of things used to generate the random numbers. Using md5, which is a hash function, to generate random numbers would be idiotic. md5 can be cracked in minutes or hours I only use md5 now for file checksums. For site logins i use sha-1 although i do need to upgrade away from this at some point.. using GPUs depending on the size of the string. Using OpenSSL or GPG however is an entirely different story, regardless of whether you know the password length because it would still require performing X number of calculations to crack the password. And the biggest government agencies in the world can't even do that, so much so that they want to mess with things like Intel RdRand to weaken it's output.

As for losing your usb stick, that is causing yourself trouble and in reality you should keep copies of your file somewhere.

---

Losing a USB stick is no different than losing a book or a notepad the passwords are written down in. However, my USB stick containing my passwords is attached to my keyring and in 30+ years I've never misplaced a set of keys. I do however shake and rattle when plugging it into devices to access websites.

---

Shake n rattle lol. Despite what you say you should still keep yourself a spare copy of that file somewhere safe just in case. Not doing so is like not backing up any of your other data - it's just not the done thing.

[#6]

---

@Anonymous wrote:

It’s all very well using a password manager, be it a book, commercial software, excel file, or even something you have written yourself for maintaining your passwords client side. But the plain text of it still ends up in the application, prior to being sent down the wire. It may be that that wire is encrypted but it is still present in its vanilla form.

---

A good point and even at the other end the plaintext password could be intercepted by a rogue tech who has modified the code. Thats why using a PWM is a good idea because you don't need to use that same PW for other services and thus that rogue tech is limited to their particular site / application.

Ebay often demands that i login using a pin number they've sent to my phone. This used to be a rare thing but in the last few weeks it's happened almost every time i've logged in.

[#7]

Here is another quick review of the latest Windows Defender:

https://www.youtube.com/watch?v=aZ8tTXxPxZk

[#8]

The video is not a true test , who in their right mind would run a ransomeware file deliberately ?

First of all you take steps to prevent it getting on your PC first ,

also where is the comparison video using another AV ?

[#9]

I use AVG for the simple reason Windows Defender refuses to update on my Windows 7. After 2 or 3 hours it still hangs there thinking about it.