291–300 of 322 posts
Earlier quoted context omitted.
How good is browser addon in comparison to lastpass? This and vaultwarden being mature enough might be final push to make us move
I prefer it, but I haven’t used LastPass in about 3 years so I can’t give an up to date opinion.
Earlier quoted context omitted.
Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…
An interesting point and I wonder if there are thoughts on if the JVM should implement flags that do overwrite before gc (obv worse perf but some cases have use for it). Or at the least, let a program implement parts of the gc api and plug it in themselves.
This wouldn't help once you create your own objects however, e.g. JSON parse from a decrypted block.
Use of 3rd party password trackers has been a periodic concern for our organization. We do B2B business with banks , so the temperature is increased somewhat. There are kinds of credentials we have access to that genuinely terrify me. I've been debating building an in-house solution for managing secrets, if for no other reason than to get all of this information off of 3rd party computers. No serious proposals have b…
Really?!
That's the least secure option I can think about, including LastPass. No encryption whatsoever, and the whole setup relies on no one ever making copies or otherwise getting unauthorized access to the file. Audits could be tricky, too - Excel may save some temporary copies of this file somewhere (like in %TEMP%) without anyone realizing.
This stuff isn't rocket science (pass is a simple shell script, after all), but your comment sounds quite concerning. I mean, I know banks are notoriously backwards when it comes to technologies and information security, but this is just... wrong.
Earlier quoted context omitted.
Java has try-with-resources for this. Python has with . Unlike say C++ you do have to indent your code once for every such resource though which can be cumbersome.
Neither of these things are equivalent to destructors, however
with prompt_password() as password:
stuff
Earlier quoted context omitted.
Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…
> it cannot be read by exploiting a buffer overflow What does the attack that does this actually look like? Lastpass reads text off an html page and decides when to inject auto-fill prompts and/or enter in a password. Is it possible for a buffer overflow to be exploited there, that lets an attacker (who controls the site) gain access to a password for a different site? How does that work? Is there some other attack p…
I used Google Passwords for a long time before deciding to move to something not OS dependent. My first pick was LastPass. I used it for maybe one month, but found their browser extension and Android app pretty bad. So I decided to move to BitWarden. I am very glad that I did this, otherwise I would have been changing all my passwords like a maniac.
> I used it for maybe one month You gave them your passwords. What makes you think your passwords are safe?
Earlier quoted context omitted.
Apple and Google both have solid options here, and I'm a happy user of Google's. But I also wouldn't want either of them to push their solutions aggressively, for competition reasons.
Do you consider your passwords to be "disposable" or easily replaceable? I could never trust Google with hundreds of passwords. The thought of their AI going haywire and essentially locking me out of the internet is terrifying.
I think this is really unlikely; since https://news.ycombinator.com/item?id=34092956 I've been gathering lockout reports on HN and they're mostly things like adding a phone number to your account and then forgetting about that when switching numbers.
Earlier quoted context omitted.
Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…
> Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. If you are worried, you can store the password in a byte array and zero that out. But further, a buffer overflow is practically impossible with a GCed language (especially a popular one). A programmer using a GCed language cannot write code which has a buffer overflow. That must come from a bug…
Take 2 classes that reference each other, but nothing references either.
In your example they won't get cleaned up. You'll want a tree-based collector. If an object is no longer referenced from the tree it can be cleaned up.
Earlier quoted context omitted.
Absolutely we can't get very far with logic without relying on some axioms, and those axioms can't themselves be proven. But I don't think it follows that we need to accept every axiom someone proposes, such as what counts as a good enough authority. You and I probably agree on the basic existence and persistence of objects, for example, and we might as well pretend that we agreed to treat that as axiomatic ahead of…
> But I don't think it follows that we need to accept every axiom someone proposes, such as what counts as a good enough authority. Nobody's saying we do, and I think there's a good middle ground we all actually inhabit where the director of the CDC, for example, is an authority on diseases when speaking in an official capacity, but we don't give a damn what they think about the latest movies. This isn't a difficult…
Treat arguments from authority as indistinguishable from any other rule of reasoning, on the other hand, and there’s nothing to do but declare people who don’t share our view of authority irrational. And then I don’t know what the plan is.
It’s exhausting when people refuse to recognize well-established expertise, but I think it’s counter-productive that so many of us get defensive about it. Yelling at people to accept our authority figures isn’t working. It won’t ever work.