521–529 of 529 posts
Earlier quoted context omitted.
I can't parse this. Is your point that "closed source" is a synonym for "insecure"?
Closed source is a synonym for insecure if you accept secure means no blackbox processes.
Hey, this _just_ happened to me too....my password would be near impossible to guess and is not used elsewhere... Just deleted my last pass account! here's the info that came with the email Time Monday, December 27, 2021 at 1:41 PM EST Location São Paulo, SP 01323, BRAZIL IP address 160.116.88.235
Mine was from India, master password definetly unique and very strong. I'm still hoping for some bug that mass alerted every day login attempts instead of actually gaining access.
We need to find a common thread.
Earlier quoted context omitted.
Is there an official counter for phpBB RCEs/vulnerabilities that revealed user passwords? This has been going on for decades now. It's getting ridiculous.
There is such a counter, CVE databases. If you would actually take a look, you would realize you are spreading FUD. phpBB has been rewritten from scratch around 2008 with phpBB3 and hasn't had a single severe vulnerability since. That's 13 years.
I am merely giving my unprofessional opinion that phpBB(1+) has only caused harm. A significant portion of leaks seem to be attributed to it. They really could have done better, and their reputation is forever dead.
To make clear: I am sure that the current version of phpBB works just fine and isn't as disease ridden as we all know it to be. However, the fact that all of these issues have existed for so long means that perhaps we need to take a look at the software as a product and determine that its performance has not been good enough, and to expect similar performance in the future.
Earlier quoted context omitted.
> Instead they used js to do some sort of hashing type system locally. Just the other day a co-worker brought up this idea as an offhand remark. After bouncing it off those present, it took him all of twenty seconds to see why it might do harm and will do little good. You'd think a password manager would employ some security minded people who could shoot down ideas that bad immediately.
What were the counterpoints?
Any hash upgrade mechanism can be abused by a (possibly MITM) attacker to change a user's password while leaving you and the user none the wiser that specifically this occurred. If you need to lock someone out while their phone is beeping at them over their bank account being emptied, while not even making it look like their password was changed, that sounds like a fun way.
Lastly it's virtually the same as plaintext, since any salt will be known by even just a passive attacker. A true MITM won't even have to brute-force the hash.
Conclusion: Might do harm, will do little good.
Earlier quoted context omitted.
Because Bitwarden and KeePassX are open-source and auditable?
Audited is better than auditable
Earlier quoted context omitted.
There's a level of irony in complaining about LastPass's security, followed by suggestion people run their passwords through random third-party software that you wrote. Even if your code isn't malicious (which I believe), it opens up so many potential attack vectors. For anyone reading this, please use the official 1Password import functionality, not this: https://support.1password.com/import-lastpass/
There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C…
Earlier quoted context omitted.
Just because you put a warning label on a bad practice doesn't mean it's a good practice. Pumping your passwords through some random code on Github that has a "be smart" label doesn't make it a good idea. Would be so easy to imitate you, reupload the code with an exploit. For giggles, if I was making this into a hijack I'd leave all your warnings in and even make them bigger and more obvious, confident in the knowled…
BREAKING: There is no perfect security. > Would be so easy to imitate you, reupload the code with an exploit. Put your keyboard where your fingers are: do it by tomorrow morning and post here when you're done.
Earlier quoted context omitted.
Probably pretty low. I use 64 character passwords, or if there is a length limit, always the longest possible. That’s the beauty of using a password manager :)
Do you use 64 character master password?
Aesop, my author, makes mention of two mice and they were sisters dear 1234567890123456789012345678901234567890123456789012345678901234567890
70 and little effort