171–180 of 322 posts
When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth. For me, my password…
> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)
I don't want to say the concerns are entirely unwarranted, but I really don't think it's a big deal for the vast majority of people.
Wondering how Enpass Performs
Earlier quoted context omitted.
Can we not simply overwrite the the data when we're "done" with it and then not worry about when it's actually unallocated by the GC?
Depends on the type and language. For example, in Java strings are immutable. Therefore you can’t really write over it.
question for those who know: for those of us in apple ecosystem, is just relying on their keychain an acceptable alternative to a third-party password manager company?
(A) signing into iCloud (Requires Apple ID Password) + approving the new device on an existing device that has Keychain access
or
(B) signing into iCloud (Requires Apple ID Password) + performing SMS 2FA + entering the device passcode of your primary device
The threat model here is where a nation-state actor enlists the full cooperation of Apple and gets Apple to hand over your encrypted iCloud Keychain, then gets Apple to siphon your Apple ID password next time you sign in. They could then use those two pieces of information to brute force the passcode on your encrypted Keychain data. If you have an 8+ digit passcode, or an alphanumeric passcode, that makes it exponentially harder to brute force.
With the long passcode, your only remaining threat would be Apple shipping malicious hidden code or an RCE in their product that allows them to force your device to approve new devices non-interactively, which would allow them to approve a malicious device the next time you approve your own new device for access to iCloud Keychain.
Or perhaps it's more likely that, when you're setting up a new device, Apple sends over the name of your new device, but with the public key/CSR of their own device, since iOS doesn't show a key fingerprint during device approval or anything.
0: https://support.apple.com/guide/security/secure-icloud-keych...
Earlier quoted context omitted.
Can we not simply overwrite the the data when we're "done" with it and then not worry about when it's actually unallocated by the GC?
Depends on the type and language. For example, in Java strings are immutable. Therefore you can’t really write over it.
I'm not sure I see the issue, you just implement a memory-safe string class that manages arbitrary bytes, it's slower but that wasn't the goal.
When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth. For me, my password…
On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.
Earlier quoted context omitted.
I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer. Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked to…
>> Key points: - Refresh the website list from the extension before starting I didn't understand any of your explanation of how to migrate from Lastpass to 1Password.