Viewing profile — pwman

This has been the case since at least 2003... The agents also see you page history, search terms, can cobrowse with you to show you things. Anything to make them quicker and more e…

Have you had your levels checked by your doctor? My doctor said I was low for a year, as they came up I started sleeping much better -- can't see many other differences.

That's not how AppArmor works provided you lock down your server software properly -- say the server running is NTP -- that NTP server is only able to read /etc/ntp/* and /usr/sbin…

LastPass

A request to https://1min-ui-prod.service.lastpass.com was necessary to attack this, that request has a referring URL sent by default by Chrome / Firefox / Safari.

Considering your size you should definitely checkout a trial of LastPass Teams: https://www.lastpass.com/teams Full Disclosure: Work for LastPass

Interesting, I hadn't heard of Password Alert -- we should definitely share notes if you're open to it -- I'd love to be able to generalize what we're doing to other domains if we …

Yes, we're pushing the notification to a new tab (which can't be blocked or interfered with) once it goes through QA -- likely early next week. Also even multifactor now must be ne…

LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in Janua…

LastPass doesn't have access to your symmetric key, it doesn't have access to your private RSA key either. It's all locally encrypted and locally generated. LastPass does have acce…

Washington DC has been doing it as long as I can remember: https://en.wikipedia.org/wiki/Slugging Basically pickup someone random so you can utilize HOV.

Heartbleed showed us that many certificate authorities reissue certificates from the original date they were first issued.

LastPass has AD Sync capability and has for years with large customers using it: https://enterprise.lastpass.com/enterprise-administration-ba...

Some of your sites are storing your password in plain text, see http://plaintextoffenders.com/ for a few. Once a single one of those is hacked your method is exposed and it goes fr…

Yes, but it's after 100,000 rounds of PBKDF2.

Understood -- you may want to consider a combination open source command line version + mobile + mac apps: https://github.com/LastPass/lastpass-cli If your coworkers aren't using s…

In fact LastPass didn't have it at first, but after dozens of impassioned pleas from people with disabilities we made the decision to add it with a very strong warning against usin…

Full Disclosure: I work at LastPass. > "Turning on 2FA did not worked most of the times" If you have a security issue here we'd appreciate a report at https://lastpass.com/security…

Mozilla used to be the best place in the world for extension developers -- it was natural to have your best extension on Firefox because you could release early and often. Active d…

Correct -- It's a pet peeve of mine when login processes obscure this saying invalid password when the sign up process doesn't -- if you're going to tell people usernames aren't av…

LastPass - https://LastPass.com/jobs - Fairfax, VA (DC metro, Dunn Loring metro stop) Our open tech roles are: - Software Engineer iOS - Software Engineer OSX - Junior Software Eng…

How are LastPass' organization features broken? Over 7,500 companies are using them successfully. https://enterprise.lastpass.com/enterprise-administration-ba...

It's not a 'we let them publish' it's a we respected their wishes in that we would hold off on talking about it until they published.

If we stole the thunder from security researchers by announcing about things they've found before they can we'd risk that they'd consider holding back. I feel it's the right move t…