Live data from Hacker News

Security Update

stackoverflow.blog

91–100 of 207 posts

Re: Security Update

#91

Earlier quoted context omitted.

Pretty sure every single modern browsers has that. The downside with using chrome is handing all your browsing history and bookmarks to Google.

Unless they on-the-fly decrypt your chrome sync (which would require non-encrypted password storing), the stuff you sync to Google is encrypted with your Google password, and if you're paranoid, you can encrypt the sync with a separate password.

[deleted]

Re: Security Update

#92
post #86
post #66

Earlier quoted context omitted.

The attack surface of a browser makes it a perfect target - I would not advise storing any critical passwords with the browser or in close reach to the browser.

You're going to be entering these passwords into a browser most of the time so if a compromised browser is your problem, no password manager is really going to help you.

That depends on time between compromise and detection. With password manager you'll lose only passwords for sites you actually logged in to. While with browser, you'll lose all passwords instantly.

Re: Security Update

#93

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

Emails can be sensitive if they are corporate and patent trolls are the buyers.

Re: Security Update

#94

Earlier quoted context omitted.

Why offline? (And how do you sync?)

For me, I sync by plugging my phone into the USB port and copying the .kdbx file over. I've never needed anything fancier, let alone had a reason to send my password database out over the internet.

Wow I see. Props to you... on my end it's so much of a hassle to find a cable and grab my phone and connect it to my computer every single time I update my password database.

Re: Security Update

#95

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

They have job listings, information about listings I have applied to, and a copy of my resume with contact information.

Re: Security Update

#96

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

Downvotes are also private. They're probably not that valuable of an asset for either side, but I can imagine unpleasant situations here and there if they happened to get leaked.

Re: Security Update

#97

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

Maybe .. the careers/jobs part in particular?

Re: Security Update

#98

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally…

Emails can be sensitive if they are corporate and patent trolls are the buyers.

They can also be sensitive for people who ask rather personal questions on the site...

Re: Security Update

#99
post #75
post #8

Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys. The service could be hardened (like Stripe) to ensure the data is stored securely, and dete…

You've just invented from first principles Single Sign On, OAuth, SAML, and Identity Providers. You can rent it from AWS, of course. It's called Cognito. https://aws.amazon.com/cognito/ You can also offload that responsibility for user data/credentials to Google/Facebook et al as you see many places with "Login with Facebook", making your users pay in privacy-invasion instead of bearing the burden of properly securin…

Not just a privacy invasion but also a single point of failure/an account shutdown.
Post reply on HN