Post to undo mistaken mod. Doh.

Apps can't read the database on non-rooted phones. So yes, you need physical access so you can root the phone first to get at the data.

And that's brilliant, but what I'm saying is a private key is just a long password. They fall into the same password-factor space of 'something you know'. By thinking that a private key makes you any more secure than a password on the basis of anything other than password length is wishful thinking.

I believe you're also free to set your Gmail password to be 100 characters, making it effectively 'unguessable'.

It's a good idea, and Google already do this. Scroll to the bottom of gmail and on the right there's a link that opens a windows giving a list of current open logged in sessions, as well as a history of sessions, giving datetime, IP address and type (Mobile, browser, IMAP, etc.).

And where does the iPhone store the encryption key protecting those passwords? On the device? Makes it a little bit useless then.

Go look at a blackberry to see disk encryption done properly - the key is not stored on the device, it's the derived from the user passphrase.

Given that a certificate is effectively just a very very long structured password, what stops me pinching the cert off the phone and using that to sign into the relevant service? A certificate doesn't solve the problem, it just changes the terminology slightly. It's still bits and bytes stored on the phone that can be used as a secret to access a service as a user.

If you want a device-specific password, Google already support that for their services through their two-factor authentication with application specific passwords.

Blackberry's do exactly this. It works well, but a lot of people argue against the convenience. The thing about security controls is that they're rarely convenient, so it's always a trade-off.

I think you fundamentally misunderstand what's going on here.

Unfortunately, port forwarding (specifically dynamic - using putty as a SOCKS proxy) is 95% of what makes PuTTY useful to me. Hell, it's what makes SSH useful - an SSH client which doesn''t support these functions is, in my view, not a terribly useful piece of software.

Ladies and Gentlemen, we have a brand new research technique!! Forget about all that time-wasting and expensive business of double-blinded randomized trials, and the complex process of producing 'evidence', lets just put videos of untested treatments on Youtube and see how many thumbs up votes they get. We could combine this revolutionary technique with that other ideal indicator of treatment performance called 'Just asking people'. Why we've bothered with complex trials for all these years is a true mystery.

Brilliant!

I think his point was more subtly that people who want to kill themselves are considered insane by default, unless they can convince a judge that they're not.

You might very well disagree with that, but that's not the same thing as saying that *everyone* is considered insane by default. Which is the whole point. Catch-22.

Or, more likely, the IT guys don't have enough budget to spend on making wifi a little bit faster. Unless you want them to suddenly stop caring about the exchange server. Or the SAN. Or any backups - Actions on all of which might be as the result of legal requirements due to local law or ongoing legal cases involving the company.

But hey, better wifi. That's the most important thing, right?

I've not had to log into a stackoverflow site since the first time I logged in, about 3 months ago.

I conclude "You're doing it wrong".