131–140 of 587 posts
Will never understand why people use managed password management services when things like the KeePass KDBX format exist.
when you have an employee leave your company can you reroll or disable all their work account passwords in keepass? (no; this is good for the user and not useful for the org, but that’s the use case.)
If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts
Earlier quoted context omitted.
i use diceware. my mothers maiden name is sternness-ardently, and i am a proud graduate of blade-purge-satin-dash elementary! …apparently.
Just today we received an email with a password reset request from a person who: could not login into the customer portal because he lost/forgot the password could not perform the password recovery procedure because his answer for the security question is some nonsense like 'blade-purge-satin-dash' *shrug_emoji*
Will never understand why people use managed password management services when things like the KeePass KDBX format exist.
The Verge has more information [1] "This comes just months after LastPass confirmed that hackers had stolen some of its source code in August and had access to LastPass’ internal systems for four days before getting detected. It looks like this new attack is connected, as Loubba says it determined that hackers gained access to user data “using information obtained in the August 2022 incident.”" https://www.theverge.c…
Earlier quoted context omitted.
Same. I use random passwords for any required security questions. It is funny when you call customer support and they ask you to verify a security question though.
Have you ever tried to see if they'd let you bypass the question? I've wondered if saying "it's a bunch of gibberish" could work.
Earlier quoted context omitted.
What's the alternative? 1. Have people manage their own secrets storage? Most people don't have the time or ability do this securely either. I'd rather pay someone else to secure infra, code, distribution, encryption, backups, etc. for me. 2. Reuse the same password on every site? One site gets hacked and now you're screwed. 3. Memorize a unique, long password for every site? Not feasible. Third-party/commercial pass…
Passwords suck. Move on to something better.
Earlier quoted context omitted.
Most of them are build without having decrypted passwords or keys for them on server, so attacker would need to get to the point where they can craft malicious update to the client (or exploit the client)
1. Get access to build infrastructure (e.g. via supply chain attack) 2. Inject code in build to export user's passwords to remote server after update is installed