2 Jan
2019
2 Jan
'19
5:38 p.m.
Hi,
I've a question.
The List-System is sending the reminder once a month.
It includes the password unencrypted.
Is this a good idea?
Regards,
--
https://joergsorge.de
2 Jan
2 Jan
6:26 p.m.
On Wed, 2 Jan 2019 16:38:43 +0100, mailing(a)joergsorge.de wrote:
I've a question.
The List-System is sending the reminder once a month.
It includes the password unencrypted.
Is this a good idea?
Subscribers can turn off the monthly reminder.
That the password is unencrypted is ok, because you anyway use passwort
rotation ;). Aren't you?
9:31 p.m.
On 1/2/19 5:25 PM, Ralf Mardorf wrote:
On Wed, 2 Jan 2019 16:38:43 +0100,
mailing(a)joergsorge.de wrote:
Undoable for all my 300 different passwords. Unless someone knows how to
automate this.
Jeremy
I've a question.
The List-System is sending the reminder once a month.
It includes the password unencrypted.
Is this a good idea?
Subscribers can turn off the monthly reminder.
That the password is unencrypted is ok, because you anyway use passwort
rotation ;). Aren't you? 
9:37 p.m.
On 2019-01-02 20:31, Jeremy Jongepier wrote:
Undoable for all my 300 different passwords. Unless
someone knows how to
automate this.
Jeremy
Use a password manager like *pass*, that way you only need to remember
one password.
https://www.passwordstore.org/
pass the standard unix password manager
With pass, each password lives inside of a gpg
encrypted file whose
filename is the title of the website or resource that requires the
password. These encrypted files may be organized into meaningful
folder hierarchies, copied from computer to computer, and, in
general, manipulated using standard command line file management
utilities.
pass makes managing these individual password files extremely easy.
All passwords live in ~/.password-store, and pass provides some nice
commands for adding, editing, generating, and retrieving passwords.
It is a very short and simple shell script. It's capable of
temporarily putting passwords on your clipboard and tracking password
changes using git.
You can edit the password store using ordinary unix shell commands
alongside the pass command. There are no funky file formats or new
paradigms to learn. There is bash completion so that you can simply
hit tab to fill in names and commands, as well as completion for zsh
and fish available in the completion folder. The very active
community has produced many impressive clients and GUIs for other
platforms as well as extensions for pass itself.
--
Set Sakrecoer
9:40 p.m.
On 2019-01-02 20:37, Set Hallstrom wrote:
Use a password manager like *pass*, that way you only
need to remember
one password.
I might have misunderstood your requirement, anyways, pass has a useful
tool to update a big bunch of passwords:
https://github.com/roddhjav/pass-update#readme
--
Set Sakrecoer
10:02 p.m.
On Wed, 2 Jan 2019 20:40:26 +0100, Set Hallstrom wrote:
On 2019-01-02 20:37, Set Hallstrom wrote:
Automation for 300 passwords seems to be not that easy to do.
Sometimes at least one special character is required, sometimes no
special characters are allowed at all, sometimes the password needs to
be longer than x and shorter than y character, sometimes it needs to be
longer than y characters, let alone that the "repeat the password
field" doesn't allow to paste the password. So to generate the password
you already need to set a lot of rules and than you need a way to
automatically log in and outmanoeuvre paste suppression. For mailman
mailing lists it might be possible to auto-generate an email with
set authenticate [<oldpassword>]
password [<oldpassword> <newpassword>] [address=<address>]
or what ever else might be the correct syntax and to automatically send
it using msmtp or any other sendmail program.
--
pacman -Q linux{,-rt{,-securityink,-cornflower,-pussytoes}}|cut -d\ -f2
4.20.arch1-1
4.19.10_rt8-0
4.19.8_rt6-0
4.19.5_rt4-0
4.18.16_rt9-1
Use a password manager like *pass*, that way you
only need to
remember one password.
I might have misunderstood your requirement, anyways, pass has a useful
tool to update a big bunch of passwords:
https://github.com/roddhjav/pass-update#readme
3:18 p.m.
On Thu, 03 Jan 2019 13:17:09 +0100, Daniel Swärd wrote:
On Wed, 2019-01-02 at 21:02 +0100, Ralf Mardorf wrote:
I doubt it's intended as a security enhancement. What makes you
think that this should be related to security? My guess is, that
email providers and other suppress "paste" for "repeat your email
address, password or whatsoever" that their users do this gazillion
times a week, so that thousands of users would accidentally copy some
random thing two times from the buffer. Two times the same means, that
it does pass the comparison between the first field and the repeat
field. This would result in users sending thousands of requests to the
support. "My user name is idiot. I don't know what address I used to
subscribe. Please help!" If it's not a random email address, then maybe
a random password, so they at least cause server loead, since they need
to request a password reset. That's just my guess, perhaps I'm
mistaken.
and outmanoeuvre paste suppression
Suppressing paste must be the most idiotic "security enhancing" feature
ever.
2 Jan
2 Jan
9:47 p.m.
On 1/2/19 4:38 PM, mailing(a)joergsorge.de wrote:
Hi,
I've a question.
The List-System is sending the reminder once a month.
It includes the password unencrypted.
Is this a good idea?
From a security point of view no. You can't fully trust the path your
mails are traveling. And if your fetching your mail with standard IMAP
on port 143 or even POP3 then it's definitely insecure. We could disable
this feature, I'd be very much in favor for doing so.
Jeremy
10:14 p.m.
On 1/2/19 2:47 PM, Jeremy Jongepier wrote:
On 1/2/19 4:38 PM, mailing(a)joergsorge.de wrote:
Although LA* are relatively safe lists and I'm not sure the damage
someone could do with my passwords, I'll tip my hat ++ in favour
of doing that. As long as we have standard 'forgot your password?'
retrieval, I hope we would all be OK with this logical move.
Tim.
Hi,
I've a question.
The List-System is sending the reminder once a month.
It includes the password unencrypted.
Is this a good idea?
From a security point of view no. You can't fully trust the path your
mails are traveling. And if your fetching your mail with standard IMAP
on port 143 or even POP3 then it's definitely insecure. We could disable
this feature, I'd be very much in favor for doing so.
Jeremy
10:44 p.m.
On Wed, 2 Jan 2019 15:14:44 -0500
Tim <termtech(a)rogers.com> wrote:
On 1/2/19 2:47 PM, Jeremy Jongepier wrote:
Yes. I'd be quite happy with that.
--
Will J Godfrey
http://www.musically.me.uk
Say you have a poem and I have a tune.
Exchange them and we can both have a poem, a tune, and a song.
On 1/2/19 4:38 PM, mailing(a)joergsorge.de wrote:
Although LA* are relatively safe lists and I'm not sure the damage
someone could do with my passwords, I'll tip my hat ++ in favour
of doing that. As long as we have standard 'forgot your password?'
retrieval, I hope we would all be OK with this logical move.
Tim. Hi,
I've a question.
The List-System is sending the reminder once a month.
It includes the password unencrypted.
Is this a good idea?
From a security point of view no. You can't fully trust the path your
mails are traveling. And if your fetching your mail with standard IMAP
on port 143 or even POP3 then it's definitely insecure. We could disable
this feature, I'd be very much in favor for doing so.
Jeremy
10:55 p.m.
On 2019-01-02 15:14:44 (-0500), Tim wrote:
On 1/2/19 2:47 PM, Jeremy Jongepier wrote:
> On 1/2/19 4:38 PM, mailing(a)joergsorge.de wrote:
> From a security point of view no. You can't fully trust the path
> your mails are traveling. And if your fetching your mail with
> standard IMAP on port 143 or even POP3 then it's definitely
> insecure. We could disable this feature, I'd be very much in favor
> for doing so.
I have now disabled this default option for both
linux-audio-user and
linux-audio-dev.
The reminder is indeed superfluous and send in non-secure way.
Best,
David
--
https://sleepmap.de
3 Jan
3 Jan
2:18 p.m.
On Wed, 2019-01-02 at 21:55 +0100, David Runge wrote:
On 2019-01-02 15:14:44 (-0500), Tim wrote:
Thank you David. :-)
/Daniel
On 1/2/19 2:47 PM, Jeremy Jongepier wrote:
> On 1/2/19 4:38 PM, mailing(a)joergsorge.de wrote:
> From a security point of view no. You can't fully trust the path
> your mails are traveling. And if your fetching your mail with
> standard IMAP on port 143 or even POP3 then it's definitely
> insecure. We could disable this feature, I'd be very much in
> favor
> for doing so.
I have now disabled this default option for both linux-audio-user and
linux-audio-dev.
The reminder is indeed superfluous and send in non-secure way.
3:52 p.m.
On Thu, 03 Jan 2019 13:18:34 +0100, Daniel Swärd wrote:
On Wed, 2019-01-02 at 21:55 +0100, David Runge wrote:
JFTR David disabled it as the default, so if somebody subscribes "Get
password reminder email for this list?" is set to "No". Anybody
who is already subscribed to the list, still has to disable it manually.
I have now disabled this default option for both
linux-audio-user and
linux-audio-dev.
The reminder is indeed superfluous and send in non-secure way.
Thank you David. :-)
4 Jan
4 Jan
5:12 p.m.
On Thu, 2019-01-03 at 14:52 +0100, Ralf Mardorf wrote:
On Thu, 03 Jan 2019 13:18:34 +0100, Daniel Swärd
wrote:
Ah, right. That I obviously missed... :-D
/Daniel
On Wed, 2019-01-02 at 21:55 +0100, David Runge
wrote:
JFTR David disabled it as the default, so if somebody subscribes "Get
password reminder email for this list?" is set to "No". Anybody
who is already subscribed to the list, still has to disable it
manually. I have now disabled this default option for both
linux-audio-user
and
linux-audio-dev.
The reminder is indeed superfluous and send in non-secure way.
Thank you David. :-) 
1 Feb
1 Feb
5:14 p.m.
About a month ago I logged in and set the "Get password reminder email
for this list?" option to "No" and ticket the "Set globally"
checkbox,
but this afternoon I still received a reminder email containing my
password...
I just logged in now and the option is still set to "No".
Am I missing something obvious here?
Cheers // Bent
On 01/02/19 21:55, David Runge wrote:
On 2019-01-02 15:14:44 (-0500), Tim wrote:
On 1/2/19 2:47 PM, Jeremy Jongepier wrote:
> On 1/2/19 4:38 PM, mailing(a)joergsorge.de wrote:
> From a security point of view no. You can't fully trust the path
> your mails are traveling. And if your fetching your mail with
> standard IMAP on port 143 or even POP3 then it's definitely
> insecure. We could disable this feature, I'd be very much in favor
> for doing so.
I have now disabled this default option for both
linux-audio-user and
linux-audio-dev.
The reminder is indeed superfluous and send in non-secure way.
Best,
David
_______________________________________________
Linux-audio-user mailing list
Linux-audio-user(a)lists.linuxaudio.org
https://lists.linuxaudio.org/listinfo/linux-audio-user
5:25 p.m.
On Fri, 1 Feb 2019 16:14:39 +0100, Bent Bisballe Nyeng wrote:
About a month ago I logged in and set the "Get
password reminder email
for this list?" option to "No" and ticket the "Set globally"
checkbox,
but this afternoon I still received a reminder email containing my
password...
I just logged in now and the option is still set to "No".
Am I missing something obvious here?
Hi,
are you only a member of this linuxaudio.org mailing list or are you
subscribed to other linuxaudio.org mailing lists, too?
The reminder I received is for LAU and LAD [1]. So if somebody
subscribed to more than just one list, it might be required to set the
option to "no" for all linuxaudio.org mailing lists *?*.
Regards,
Ralf
[1]
On Fri, 01 Feb 2019 05:01:16 -0500, mailman-owner(a)lists.linuxaudio.org
wrote:
This is a reminder, sent out once a month, about your
lists.linuxaudio.org mailing list memberships. [...]
^
^
linux-audio-user(a)lists.linuxaudio.org [...]
https://lists.linuxaudio.org/options/linux-audio-user/ralf.mardorf%40alice-…
linux-audio-dev(a)lists.linuxaudio.org [...]
https://lists.linuxaudio.org/options/linux-audio-dev/ralf.mardorf%40alice-d…
5 Feb
5 Feb
4:31 p.m.
I assumed that was what the "Set globally" was for...
I have now tried logging into each of them and the password reminder
option is disabled on all of them, so something is still wrong somewhere.
On 02/01/19 16:25, Ralf Mardorf wrote:
On Fri, 1 Feb 2019 16:14:39 +0100, Bent Bisballe Nyeng
wrote:
About a month ago I logged in and set the
"Get password reminder email
for this list?" option to "No" and ticket the "Set globally"
checkbox,
but this afternoon I still received a reminder email containing my
password...
I just logged in now and the option is still set to "No".
Am I missing something obvious here?
Hi,
are you only a member of this linuxaudio.org mailing list or are you
subscribed to other linuxaudio.org mailing lists, too?
The reminder I received is for LAU and LAD [1]. So if somebody
subscribed to more than just one list, it might be required to set the
option to "no" for all linuxaudio.org mailing lists *?*.
Regards,
Ralf
[1]
On Fri, 01 Feb 2019 05:01:16 -0500, mailman-owner(a)lists.linuxaudio.org
wrote:
This is a reminder, sent out once a month, about
your
lists.linuxaudio.org mailing list memberships. [...]
^
^
> linux-audio-user(a)lists.linuxaudio.org [...]
> https://lists.linuxaudio.org/options/linux-audio-user/ralf.mardorf%40alice-…
>
> linux-audio-dev(a)lists.linuxaudio.org [...]
> https://lists.linuxaudio.org/options/linux-audio-dev/ralf.mardorf%40alice-d…
2123
days inactive
2157
days old
linux-audio-user@lists.linuxaudio.org
17 comments
9 participants
participants (9)
-
Bent Bisballe Nyeng -
Daniel Swärd -
David Runge -
Jeremy Jongepier -
mailing＠joergsorge.de -
Ralf Mardorf -
Set Hallstrom -
Tim -
Will Godfrey