RE: Decrypting .dat files

Hi Philip,

In general, you're right, of course. The strength of the tool is only as
strong as the passphrase used to protect the data.

What Juergen may have had in mind was that a command-line tool may be used
to create a file with all the database entries decrypted. Such a file would
b a real security risk, since deleting the file by normal means still leaves
the data floating around on the disk if you know where to look. The
PasswordSafe application goes through some lengths to ensure that no more
data than is absolutely needed in a given moment is actually decrypted.

	Rony

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On 
> Behalf Of Philip Newton
> Sent: Thursday, November 11, 2004 3:33 PM
> To: Schreck, Juergen
> Cc: Dickerson, Cliff; [email protected]
> Subject: Re: [Passwordsafe-users] Decrypting .dat files
> 
> 
> On Thu, 11 Nov 2004 10:12:38 +0100, Schreck, Juergen
> <[email protected]> wrote:
> > I think this would be against all
> > purposes of pwsafe. If it would be so easy to decrypt the 
> database you could
> > hold your passwords in a plain textfile, too.
> 
> I though the main component of security lies in the choice of key, not
> in the specific algorithm.
> 
> After all, decrypting the database by starting pwsafe is also "easy"
> if you have the right passphrase; I do not see why a command-line
> decryption utility *that requires you to know the passphrase* is less
> secure.
> 
> Cheers,
> -- 
> Philip Newton <[email protected]>
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by:
> Sybase ASE Linux Express Edition - download now for FREE
> LinuxWorld Reader's Choice Award Winner for best database on Linux.
> http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
> _______________________________________________
> Passwordsafe-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-users
> 



-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_idU88&alloc_id065&op=click