Why would any "enterprise" customers trust closed sourced AND small-time password manager?
Because they quoted the lowest price for support.
Backdoored password manager stole data from as many as 29K enterprises
11–20 of 117 posts
Re: Backdoored password manager stole data from as many as 29K enterprises
#12Earlier quoted context omitted.
FOSS won't help you very much unless you're willing to build your entire tool chain from vetted source. http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...
That's like saying that seatbelts don't help very much, unless you're willing to wear a motorcycling helmet, and install a roll cage in your car. In the worst-case scenario, no, your seatbelt won't help. I'm still going to wear one.
The difference is that the interior of your car is not typically an adversarial environment.
Re: Backdoored password manager stole data from as many as 29K enterprises
#13Why would any "enterprise" customers trust closed sourced AND small-time password manager?
It seems to me there's a trend around "enterprise" software having weaker supply chains than the more nimble and agile tools.
Perhaps mindset related? Larger teams needed to meet enterprise needs? Or simply more focus on the sales machine to close complex enterprise deals, and less focus on securing the pipeline through which the product is made?
Solarwinds is a great example of this - "big enterprise software" used by big enterprises, and yet their whole build infrastructure was compromised as it ran with less security thinking than your average open source project (which at least discards build environments each run).
Re: Backdoored password manager stole data from as many as 29K enterprises
#14Why would any "enterprise" customers trust closed sourced AND small-time password manager?
You does your risk assessment etc etc. For some those are not a combinatorial red flag - for you it seems they are. There are a lot of things to consider and not one of us here can possibly say they've got it all covered. No one ... ever 8)
This morning my home doorbell didn't ring and a phone alarm didn't wake someone up. Two almost unrelated fails. As a result we missed an appointment which we fixed an hour or so later.
Right let's do the analysis: Doorbell is a Doorbird. I've got it running on a ethernet connection via PoE. All my home IT stuff is on UPS. I have a decent router that I know very well. I don't skimp on my home gear and I have a quite large VMware esxi which runs my home servers and stuff. I use Home Assistant which has a Doorbird integration and when you press my doorbell all my Sonos speakers say: "Ding dong, there is someone at the door".
I got it wrong: I thought that my HA box spoke directly to my Doorbird or vv. No it doesn't - it is all done via their API and that means internets.
Today I wired up a simple door chime to my Doorbird which will ring regardless of internets. The chime cost £10. The Doorbird has a chime output which isn't latching but good enough to make a chime ... chime.
So that's what I do at home.
Re: Backdoored password manager stole data from as many as 29K enterprises
#15The best password manager is your own salting algorithm and memory.
Re: Backdoored password manager stole data from as many as 29K enterprises
#16Just to clarify the title. It was not a deliberate backdoor on the part of Passwordstate. It was a supply chain attack. There is some history to their security holes (most of the known ones being patched). https://twitter.com/juanandres_gs/status/1385689464329187329 https://github.com/NorthwaveSecurity/passwordstate-decryptor... A potential issue in the password management space is that Francisco Partners (owner of N…
Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?
this https://www.passwordstore.org/
its "just" a wrapper around gpg and git.
so add/crypt with the team and push. and you can do team shared keys if that's your thing.
oh, and passbolt is not terrible either.
Re: Backdoored password manager stole data from as many as 29K enterprises
#17Passwordstate doesn’t seem to have automatic update and the update process is mildly annoying, so I can’t imagine very many people were unlucky enough to update during the couple of days they were compromised.
Not saying this isn’t very concerning from Click Studios, just that the number is going to be a lot smaller than 29,000.
Re: Backdoored password manager stole data from as many as 29K enterprises
#18That's why I don't use password managers. That's giving one entity too much power over everything I own.
Re: Backdoored password manager stole data from as many as 29K enterprises
#19Just to clarify the title. It was not a deliberate backdoor on the part of Passwordstate. It was a supply chain attack. There is some history to their security holes (most of the known ones being patched). https://twitter.com/juanandres_gs/status/1385689464329187329 https://github.com/NorthwaveSecurity/passwordstate-decryptor... A potential issue in the password management space is that Francisco Partners (owner of N…
Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?
> Are there any good FOSS password managers that can do remote sync and team permissions?
Depending on what remote sync and team permissions looks like at your end, you could perhaps get there with KeePassXC [0] (password manager) and a separate sync tool (that did your sync and, effectively, your permissions management) such as Keybase KBFS [1] or SyncThing [2].
Re: Backdoored password manager stole data from as many as 29K enterprises
#20That's why I don't use password managers. That's giving one entity too much power over everything I own.
Do you simply remember hundreds of random passwords?