281–290 of 322 posts
I have multiple folks I know using KeePass with the kdbx synced on Google Drive or similar. The authentication is a combination of a 1KB key file (manually copied onto each device via sneakernet) and a long password.
Earlier quoted context omitted.
Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…
> Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. If you are worried, you can store the password in a byte array and zero that out. But further, a buffer overflow is practically impossible with a GCed language (especially a popular one). A programmer using a GCed language cannot write code which has a buffer overflow. That must come from a bug…
Earlier quoted context omitted.
If you want to go down this route, we know nothing of the real world from strict deductive reasoning because the axioms strict deduction flows from do not apply to the real world, but to mathematical universes where absolute truth is accessible to us. In reality, all statements we could use as premises are only probably true to a certain level of confidence, having themselves been constructed from inductive reasoning…
Absolutely we can't get very far with logic without relying on some axioms, and those axioms can't themselves be proven. But I don't think it follows that we need to accept every axiom someone proposes, such as what counts as a good enough authority. You and I probably agree on the basic existence and persistence of objects, for example, and we might as well pretend that we agreed to treat that as axiomatic ahead of…
Nobody's saying we do, and I think there's a good middle ground we all actually inhabit where the director of the CDC, for example, is an authority on diseases when speaking in an official capacity, but we don't give a damn what they think about the latest movies. This isn't a difficult concept until we try to formalize it, really, at which point I'm sure we can run off into a bramble of paradox and bizarre conclusions we "must" accept in order to satisfy certain kinds of logical consistency.
> I'm less sure that we'd have the same list of which people count as infallible-enough experts in which areas.
This is a problem and we've seen it be a problem quite severely in recent years. Part of the problem is certain political groups following people with absolutely no recognizable expertise in anything except making money from people who don't recognize logical argumentation as even potentially useful: If it doesn't validate their pre-existing ideas, it's not only wrong, it's a trap laid by the enemy, and anyone who promotes it must be punished. Take that mindset, add some over-simplified and incorrect models of reality, and you have people who refuse to accept reasonable sources of authority for self-contradictory and purely emotional reasons.
Finally, logic has come a long way since Aristotle, and using some kind of consistent attempt at statistical reasoning is no less valid than declaring some probably-true statements to be axioms or postulates and reasoning deductively from there. Like diagnosing a disease: You can't use deductive logic to determine why you're having flu-like symptoms, you must use some kind of reasoning based on relative frequency of diseases and, possibly, incorporate the results of various tests in a more inductive fashion. "George Santos lies a lot" is a perfectly valid piece of evidence to incorporate into a worldview, just like "The seasonal influenza is more common than some horrendous infection which also initially presents with flu-like symptoms" is.
I used Google Passwords for a long time before deciding to move to something not OS dependent. My first pick was LastPass. I used it for maybe one month, but found their browser extension and Android app pretty bad. So I decided to move to BitWarden. I am very glad that I did this, otherwise I would have been changing all my passwords like a maniac.
You gave them your passwords. What makes you think your passwords are safe?
If you follow this. Keep your passwords in triplicate because if you fat finger the mouse over a cell it can evaporate (experience speaking here). Three copies means very little chance of losing a password. And keep a backup of course.
Share the spreadsheet among your team. It's very easy to add and delete users.
Yes I know this seems cheezy but sometimes the simplest way is the best. Good for up to about ten team members in my experience.
This is why we need good OS-level password managers. Phones and now computers have dedicated security chips which are infinitely more secure than any cloud solution. Such an easy market to grab that it boggles me why Apple and Google aren't aggressively going for it.
Apple and Google both have solid options here, and I'm a happy user of Google's. But I also wouldn't want either of them to push their solutions aggressively, for competition reasons.
If you're a small operation it's not stupid to keep your passwords in a google spreadsheet. Google accounts are seeing attempted cracks 24/7 for the last fifteen years (or more) by nation states and it's been a long time since any of their accounts have been hacked. Remember when someone spliced their optical fiber under the Atlantic Ocean? That's what Google is up against. If you follow this. Keep your passwords in…
Hopefully this will stop the replies to comments complaining about stupid password rules: "Just use a password manager". Why would you ever trust someone else with something like this?
Earlier quoted context omitted.
It's a matter of trust and good faith. You could apply the same dichotomy to actual FOSS programs.
I do. Having source code available does6 mean anything if you can't verify the source yourself, or if the source can't be community certified. There's no point in a backend being open source, if nobody can verify what is running there. There's no point in an iOS app being open source if the app is distributed through the app store, as we have no way to verify that it is what it says it is. Meanwhile if I'm running De…
Precisely. By not showing their source code, they implicitly state that they don't care about whether you trust them or not when it comes to source code. It is not a meaningless distinction. Bitwarden for example lists being open-source as a plus in security. You may not personally see it that way, but a big part of the industry does.
Earlier quoted context omitted.
Still doesn't explain why it's all not at least source-available. I'm not going to complain if they don't use open-source licenses such as MIT or (A)GPL, but straight up not making the source code publicly readable at all is a big strike against it.
Making it opensource is no guarantee at all(if there could be any), for instance it could be more dangerous: anyone could spot a security hole and take advantage of it without reporting it, there is no guarantee there would be a responsible disclosure.