I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…
Consider https://salty.pw/ The idea is good, just not sure about SHA-256...
How do you deal with sites that don't accept the passwords generated by salty?
I guess the point people (including me) are making is that it should pay off to do the right thing and report a bug that is capable of killing your (core) business. While OP obviously is a honourable person, others might not be and are more interested in getting money than doing the right thing. Of course it's illegal/wrong to sell an exploit to third parties, but that doesn't stop people from doing illegal things as…
This doesn't make any sense logically. We don't need to pay people to prevent them from committing felonies. The suggestion that we do is actually pretty offensive to people who find vulnerabilities. Most of us --- in fact, the overwhelming majority of us --- are not torn at all about whether we should sell flaws to the black market. (This is of course orthogonal to the fact that the black market does not want these…
So you don't believe there are blackhats out there? Because somebody has to be breaching online services and it's rather unlikely it's a godly entity doing that.
Felonies exist and people still commit them. Should they? God no. But people with a lower moral code exist and they can be flipped to do "good work" if there's enough money for them (and I think you should get more money in general for your important work anyway). I find the notion of your profession only consisting of good people highly offending to the rest of the world.
Great catch and everyone should know there is an easy way to parse URLs in JS. Just create an anchor element and let the browser parse it for you. Like so: var parser = document.createElement('a'); parser.href = " http://example.com:3000/pathname/?search=test#hash "; parser.protocol; // => "http:" parser.hostname; // => "example.com" parser.port; // => "3000" parser.pathname; // => "/pathname/" parser.search; // => "…
Disclosure: I work for AgileBits, makers of 1Password. For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)
URL constructor looks great! Just wish it was stable. I normally don't have to worry about IE very much anymore anyways.
They sold their future. The next bug will be sold to the highest bidder.
People find and disclose bugs regularly even where there isn't a bounty. Most (at least 99.99%) developers don't want to see a useful, successful product fail even if they can personally gain from it. The likelihood that an exploit for Lastpass will be discovered by an attacker and sold to a nefarious actor is very small. Further to that though, we now know that this problem is fixed in LastPass. We don't know about…
Bounties aren't just monetary motivation - they show that the company understands security and responsible disclosure. For example, I've found pretty bad flaws in some white label web-based CCTV DVR software (privilege escalation and session hijacking). I went to the company website and couldn't even find a technical support contact. Given there's no bug bounty or other evidence they take security seriously, I don't want to risk sending this to the wrong person and receiving legal threats etc so it will remain undisclosed.
This doesn't make any sense logically. We don't need to pay people to prevent them from committing felonies. The suggestion that we do is actually pretty offensive to people who find vulnerabilities. Most of us --- in fact, the overwhelming majority of us --- are not torn at all about whether we should sell flaws to the black market. (This is of course orthogonal to the fact that the black market does not want these…
So you don't believe there are blackhats out there? Because somebody has to be breaching online services and it's rather unlikely it's a godly entity doing that. Felonies exist and people still commit them. Should they? God no. But people with a lower moral code exist and they can be flipped to do "good work" if there's enough money for them (and I think you should get more money in general for your important work an…
The people who are not the majority of researchers would be... Wait for it... A minority of researchers.
I'm a LastPass user but not really in love with it. If I were to switch, which is best and WHY? I need it to support chrome and Android.
I like 1Password. They were expensive and required separate licenses for desktop and mobile when I bought. I don't know the current pricing model.
They have a good product, nice blog articles explaining various technical decisions they made, and a fast customer support in terms of listening feedback.
This doesn't make any sense logically. We don't need to pay people to prevent them from committing felonies. The suggestion that we do is actually pretty offensive to people who find vulnerabilities. Most of us --- in fact, the overwhelming majority of us --- are not torn at all about whether we should sell flaws to the black market. (This is of course orthogonal to the fact that the black market does not want these…
No, you pay people to bother looking in the first place. Criminals will always be looking, but the odds of finding vulns against a company that pays decent bounties should be far lower than against one paying a pittance, since more people should be looking due to the greater potential reward. Also, in this case, I think that the amount of damage the company has avoided due to the vuln leaking through non-responsible…
And somebody looked, so clearly the bounty worked! But the cost to find a bug has practically nothing to do with the impact of the bug. The incentive is to find bugs, not a particular world ending bug.