News for hackers. Stuff that matters.

A comment on Steel – Open-source command-line password manager. Parent comment

Re:Steel – Open-source command-line password manager by swombat on Monday October 19, 2015 @03:22AM (#10411579)
So anything that monitors your clipboard (basically every spyware worth its salt) will have a copy of all your passwords then? That doesn't seem very secure.
[ Parent | on HN ]
Re:Steel – Open-source command-line password manager by teekert on Monday October 19, 2015 @04:14AM (#10411739)
That is the case for all password managers... A big loop hole imo but one that has to be weighed against having simpler, more similar passwords for services.
[ Parent | on HN ]
Re:Steel – Open-source command-line password manager by heinrich5991 on Monday October 19, 2015 @05:13AM (#10411891)
If you have a browser password manager, monitoring the clipboard will do nothing.
[ Parent | on HN ]
Re:Steel – Open-source command-line password manager by draven on Monday October 19, 2015 @05:46AM (#10411955)
That only works for passwords you use on the web though.
[ Parent | on HN ]
Re:Steel – Open-source command-line password manager by swombat on Monday October 19, 2015 @08:11AM (#10412353)
Which includes the vast majority of exploitable passwords. Passwords that only work on my local machine are of less concern when it comes to being hacked by a random keylogger software.
[ Parent | on HN ]
Re:Steel – Open-source command-line password manager by draven on Monday October 19, 2015 @04:39AM (#10411797)
The only workaround I can think of is: don't use the clipboard then.

With pass you can also display the password on the console so you can retype it, but if you're running in an X session you're potentially screwed anyway.

[ Parent | on HN ]
Re:Steel – Open-source command-line password manager by Widdershin on Monday October 19, 2015 @05:53AM (#10411971)
If you wanna get real paranoid, displaying it on your screen isn't the best idea.

https://en.wikipedia.org/wiki/Van_Eck_phreaking

[ Parent | on HN ]
Re:Steel – Open-source command-line password manager by agumonkey on Monday October 19, 2015 @04:18AM (#10411752)
Reminds me that I tried to see if Emacs did anything to input in password-reading mode, and the content was in clear, only the rendering was obfuscated.
[ Parent | on HN ]