EVE General Discussion

Removing this functionality motivate players to have a easy-to-guess password or to store them in a file if it is too complex to be remembered, so I seriously doubt that it is safer.

I use an encrypted file to store a « |°7?'eIxfP [+ 10 others]»-like password but I am sure that one day I will get rid of it as I am tired to launch the software, decrypt it, each time I need to change character...

While you are right that this may encourage people to lower their overall security by not following password best practices, it's not something I really think giving people the option to insecurely store their password on their local machine. And inherently, any method we'd implement for encrypting the password *would* be insecure. It's just not something that can be done safely.

Having only one factor of authentication is the inherent problem in this case. Rather than shift the insecurity from the user to the local machine, like storing a password would, we can improve the overall security by giving an option for two factors. I greatly prefer that option. And it's something we're still working on supporting.

We're still waiting for some backend changes to fall in place before we can make a move on this. While I'd love for it to be out already, 2-factor authentication relies inherently on our new authentication solution, which is being rolled out at the best speed we can. But there's a lot of different factors that plays into that, such as regulatory requirements we need to ensure we follow.

Trust me, it's something I want to see in ASAP. I talked to several people about it as recently as just last week. It's coming, trust me

If you find yourself in danger of using a simple to remember and easy to crack password, just remember that phrases are much easier to remember and harder to crack than just about anything else.

thequickbrownfox (for example) is infinitely harder to crack than god2012.

By the way, if god2012 is your password, you should be shot.

Not relevant to this use case.

Any software capable of accessing and decoding a password encrypted using machine-specific encryption such as DPAPI is equally capable of recording keystrokes, filtered by such things as the foreground window class name.

Single initial login followed by caching a one-way machine + ip specific login token is preferable. But storing suitably encrypted reversable passwords is no more insecure than your friendly local web browser storing your password anyway to log into EVE Gate.

Username, backwards.

So clever...

If you are concerned about your data stored on your computer, then i suggest using TrueCrypt for your computer and do a full system encryption - if you are the only one, who uses it.

After then no one will be able to decrypt your drive it nowadays ...
* without the knowledge of your TrueCrypt password
* without interface access to your up and running system (Hint for the advanced user: memory dump for key extraction)

Well, finally some virus on the local machine could read out your data, .. but if there's a virus on your computer, it can do anything, even read your typings on the keyboard.

Be carefull:
* never ever forget your TrueCrypt password. There is absolutely no recovery or backdoor to it.
* keep operation system boot data healthy, because reparing an not bootable encrypted system gets more elaborate than repairing an non-encrypted one. Even the build-in recovery console won't work anymore!

You 'share' your windows machine with people you don't trust?

Think the problem is way bigger than you understand.

thanks for this post OP. I've clean up some stuff in the Settings folder :D