Re:Gopass – The Team Password Manager
by zaroth on Tuesday November 26, 2019 @10:53AM
(#21639324)
Obscurity can be a useful technique for defense in depth, or even just reducing the noise of drive-by attacks to make it easier to identify the “real” ones. For example, putting SSH on a non-standard port.
But encrypting metadata isn’t “obscurity” at all. It’s strongly protecting sensitive personal information. And it’s table-stakes for a password manager.
“Obscurity” refers to obfuscating data in a way that’s easily reversible by knowing a trick or method. Like the FortiNet XOR with a static key.
“Secured by a high entropy secret and a trusted algorithm” is not obscurity, unless, for example, the key is packaged with the data it is meant to protect in a cute way.
But encrypting metadata isn’t “obscurity” at all. It’s strongly protecting sensitive personal information. And it’s table-stakes for a password manager.
“Obscurity” refers to obfuscating data in a way that’s easily reversible by knowing a trick or method. Like the FortiNet XOR with a static key.
“Secured by a high entropy secret and a trusted algorithm” is not obscurity, unless, for example, the key is packaged with the data it is meant to protect in a cute way.