51–60 of 67 posts
Personally I use 1Password for storing passwords and it allows sharing vaults between users so as my team grows we might actually consider using these.
passpack.com -- have been using it for a few years now and never looked back.
Earlier quoted context omitted.
They should point out that it's vulnerable to JavaScript injection, particularly if you use their servers. One simple change and suddenly they can get your key on your next access.
Yes, you are right we can modify our JS and get your keys. This vulnerability is in most of the commercial tools out there too. Thats why it is open sourced so you can run it in your own servers. Running it on your own heroku account is close to zero dollars.
Write it on a post-it, walk up to the person, give it to them, then take the post-it back. Passwords are designed to be human-interface memorized authentication tokens. Sharing it any other way than via human interaction just makes it a digital key, and real digital keys are much more secure than digital passwords. So share it via human medium, or rethink why you're using a password.
It's a work in progress, I have an online parser/rewriter for HTML, CSS, JavaScript that can handle moderately complex websites now, including Facebook. Might have something ready by the end of the summer.
Here's an album with some screenshots from last year: http://imgur.com/a/ekoO2
Earlier quoted context omitted.
Do you have a company Twitter account?
Yes/no, one exists but its unrelated to my job. Its probably worth noting that we also have sets of accounts that while password protected are essentially considered public. Those accounts are accessible to anyone who knows the well-known standard passphrase
"Passwords? No. We don't. Everything is a certificate or key."
...
"We have sets of accounts ... accessible to anyone who knows the well-known standard passphrase."
I'm working on a piece of software (SaaS, self-hosted) that acts as a reverse proxy and stores credentials. The goal is to avoid having to require users to know any secrets other than the ones you already trust them to have (a domain login, a Google Apps account, etc.) The goal is to have a single-sign on for the entire internet, and any topology of mapping users to accounts. Account per user could be used if you wan…
Earlier quoted context omitted.
Yes/no, one exists but its unrelated to my job. Its probably worth noting that we also have sets of accounts that while password protected are essentially considered public. Those accounts are accessible to anyone who knows the well-known standard passphrase
It kind of negates your first point. "Passwords? No. We don't. Everything is a certificate or key." ... "We have sets of accounts ... accessible to anyone who knows the well-known standard passphrase."