221–230 of 587 posts
Earlier quoted context omitted.
I can never recommend 1Password enough. When it comes to hosted options, they are hands down the best. Worth pointing out that they also have integrated 2FA, if you're satisfied with first and second factor living in the same spot. https://1password.com
This costs a monthly subscription.
Earlier quoted context omitted.
I never pick a real answer to my security questions. It just seems pointlessly dangerous.
Years ago for my university student account, you were allowed to provide the question. I figured I would never need to use it, so I set the question to "Dicks?". I was very immature and thought that was funny. A few years later after the semester break I forgot my password. I had to email IT to reset it, and they replied "Please provide the answer to your security question: Dicks?". And I had to reply "Yes no problem…
Earlier quoted context omitted.
I can never recommend 1Password enough. When it comes to hosted options, they are hands down the best. Worth pointing out that they also have integrated 2FA, if you're satisfied with first and second factor living in the same spot. https://1password.com
> if you're satisfied with first and second factor living in the same spot It’s no longer “2FA” then.
Years before these systems came out I thought of building a similar zero trust style system and I realized the level of attack that I would be putting myself under and the insecurity of JavaScript due to extensions, mitm, and client side malware made it ridiculously unpalatable. You would have nation state attackers coming after you as well as your nation state demanding you grant access to them. It felt pretty braze…
> I realized the level of attack that I would be putting myself under and the insecurity of JavaScript due to extensions, mitm, and client side malware made it ridiculously unpalatable This doesn't really make sense. These threats apply equally to people just memorizing and typing in their passwords into web forums. If the user's browser is compromised there is literally nothing to be done.
Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.
I can never recommend 1Password enough. When it comes to hosted options, they are hands down the best. Worth pointing out that they also have integrated 2FA, if you're satisfied with first and second factor living in the same spot. https://1password.com
The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open source? "How many years of experience do you have in open source?"
(Probably because the recruiter had a list of tech and skills required and simply went through it.)
Anyway, I went with it and eventually got a coding assessment. The docx document told me to implement a little deck of cards in Java using classes and inheritance. This was for a senior position.
I did not do that and withdrew my application.
Earlier quoted context omitted.
Bitwarden is better, but Vaultwarden (the self-hosted version written in Rust) is the absolute best option. Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords. Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via pub…
Can you give some idea why Bitwarden is better?
Earlier quoted context omitted.
What's the alternative? 1. Have people manage their own secrets storage? Most people don't have the time or ability do this securely either. I'd rather pay someone else to secure infra, code, distribution, encryption, backups, etc. for me. 2. Reuse the same password on every site? One site gets hacked and now you're screwed. 3. Memorize a unique, long password for every site? Not feasible. Third-party/commercial pass…
The alternative to fully cloud-based solutions would be a local, open source kdbx client (Keepass, KepassXC, etc) with the password database situated on a cloud storage (Dropbox/Google Drive/etc). This way, one gets the best of both worlds.
Earlier quoted context omitted.
1. Get access to build infrastructure (e.g. via supply chain attack) 2. Inject code in build to export user's passwords to remote server after update is installed
This is a good point, but on the other hand, couldn't any application be hijacked in the same way to include a keylogger/upload plaintext password DBs stored locally by browsers/etc? Somehow this hasn't happened on a mass scale that I'm aware of.