Quote from: Eadeqa on June 03, 2014, 05:33:13 AM

Quote from: jkoil on June 02, 2014, 09:30:06 PM

The "randomness" is one characteristic, the other is the length. My passwords' randomness is enough due to certain things, which is used in the pw generation - which is not revealed here either

And length I certainly have enough.

Bottom line: Look at top of this page (bitcointalk.org). The connection is encrypted. How does that encryption work? The encryption key is exchanged between your computer and BTT server using cryptography that relies on random number generator. Otherwise your BTT password would go through internet (bouncing around dozens of servers) in plain text and could be easily stolen, along with your nem stake.

you already rely on CSPRNG to do everything online that is supposed to be secure. Nothing online is secure without CSPRNG.

Not a single thing.

Quote

Cryptocurrencies, decentralization, lower trust level ...
pw manager, centralization, higher trust level.

(ok, ofc some centralization and trust is needed somewhere sometimes, but ...)

You already trust a lot of things -- for example your operating system. How do you know it's not sending your info to NSA?'

There is no such thing as zero trust.

With Lastpass encryption is done locally on your computer. They only get encrypted blob. Key is derived from thousands of hashes (PBKDF2) so even in very unlikely scenario their server is hacked brute force attack would still be very hard, as their server doesn't have encryption key.

It's a question of convenience and security and it's much easier to stay secure if a user is using password manager (online backup, long random unique passwords for all sites, two factor authentication, auto fils and several other anti-key logger measures) .

"There is no such thing as zero trust."

That I was saying. There is needed trust, this online world requires it (now). But why unnecessarily increase the need of trust?
For the convenience? Yes, of course, but not for the most important issues, when it is decided e.g. about the security of 20% of your fortune. So much trust I do not have

Btw,
BTT account vs NEM stake
What is the scenario, when someone's NEM stake is stolen?
I've understood that already some BTT accounts were hacked, or pw lost, but that was
solved happily.

Stealing scenario 1:
- hacker (or evil organization) gets your BTT account
- NEM stake is delivered
- hacker use your BTT account to inform a wrong target for the stake
- the stake is delivered to hacker's target, not to yours

- You realize that you have been robbed and inform the NEM organization
- What is the situation? Is the NEM stake totally lost?
or can the original BTT user still prove that he would be the correct owner
of the NEM stake (eg. by sending 1 NXT from his NXT account, which may be not hacked)