密碼守則第一�：��把密碼寫下來。

剛剛看到一篇有關 Agatra 的報導，本來也是看看而已，��接下來�在 keso 那邊也看到他寫了一篇，我��真地去看了一下這到底是什麼�西；原來這昅

“Agatra stores the passwords as encrypted
information throughout the login process. We use the Agatra password as a key
to unencrypt the passwords the users enter. As a result, there’s no way to
unlock the site passwords without possessing the “key” (i.e., the Agatra
password). We have no access to the users “Agatra” password in unencrypted
format, and thus we have no access to user passwords either. In this way, even
if someone with less than honorable intentions gains access to our server, they
would still need all the individual “keys” (Agatra passwords) to gain access to
the site passwords.”

I was left with the impression it’s encrypted locally, and that’s certainly feasible, but it is possible that’s not happening here.

I’d give both of those a big “Hell, no!” in response. If I trust anything to store my passwords other than my brain, I’d keep them in a desktop app (as a Mac user, I use KeyChain) and then encrypt the filesystem wherever the app stores them.

No way would I store passwords in a place where someone could discover SQL injection, XSS or session hijacking.

Tom

Avec Agatra, plus besoin de retenir vos logins et passwords sur Internet !
Une fois connecté à Agatra, vous êtes immédiatement identifié sur les sites de votre choix (Gmail, Hotmail, vos forums préférés, etc…)

Agatra retient tous vos comptes (log…