In the context of previous allegations about Kaspersky and Russian intelligence, there's some chance these errors were intentionally introduced.
https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations...
Kaspersky Password Manager: All your passwords are belong to us
51–60 of 122 posts
Re: Kaspersky Password Manager: All your passwords are belong to us
#52Ok, we know that Math.random() is bad, and they recommend using window.crypto.getRandomValues(). But the docs for getRandomValues() raise concerns too: - getRandomValues() is not guaranteed to be running in a secure context. - There is no minimum degree of entropy mandated by the Web Cryptography specification - User agents are instead urged to provide the best entropy they can when generating random numbers, using a…
If you don't fully trust getRandomValues, you can collect entropy in JavaScript and then hash everything you got using something like Blake2b. Touch/mouse inputs time and positions can give a few bits of entropy for example.
Re: Kaspersky Password Manager: All your passwords are belong to us
#53Earlier quoted context omitted.
Bitwarden has the best UI/UX of any password manager I have used, by far. In particular it puts LastPass (which I switched from) to shame. I rarely use the premium features, but I pay for premium anyway to support the project. Costs a dollar a month, so barely noticeable.
it can be a bit club-footed on the mobile platform. but yeah its my password manager of choice as well.
Agreed, works on Android, but it's clumsy.
Re: Kaspersky Password Manager: All your passwords are belong to us
#54Earlier quoted context omitted.
KGB was renamed and split into four agencies (FSB, SVR, FAPSI and FSK) that were later merged down back to FSB and SVR. There are still KGB people working there that didn't even have to move their offices. The country is now ran by a clique of ex-KGB hardliners but I guess that does not count because it was renamed in 1991.
So it's not KGB anymore right? And not a KGB School right? And your Picture has nothing todo with kaspersky right?
It was when he was enrolled in it (1980) and when he graduated from it (1987).
That's how education worked back then. If you wanna study cryptography, you go The Technical Faculty of the KGB Higher School, now known as Institute of Cryptography, Telecommunications and Computer Science (FSB still runs it).
One could say it's even comparable to National Intelligence University: https://en.wikipedia.org/wiki/National_Intelligence_Universi...
> In June 2021, the University officially transferred from the Defense Department to the Office of the Director of National Intelligence to better serve the diverse and varied needs of its students and the United States intelligence enterprise.
Re: Kaspersky Password Manager: All your passwords are belong to us
#55I use Bitwarden and it's open source. Switched over from LastPass and haven't regretted it since
I have to use 1password for work and hate the UI compared to bitwarden
I mostly like Bitwarden but I really miss the 1password feature where it shows your password in big text with each character numbered. I have a few accounts that do that dumb "give us the 5th, 12th and 21st characters" thing.
Re: Kaspersky Password Manager: All your passwords are belong to us
#56> After a bit less than two years, this vulnerability has been patched on all versions of KPM. Vulnerability has been assigned CVE-2020-27020.
Pretty terrible bug to be unpatched and presumably uncommunicated for 2 years. Ouch.
Re: Kaspersky Password Manager: All your passwords are belong to us
#57I use Bitwarden and it's open source. Switched over from LastPass and haven't regretted it since
Wouldn't be a HN password manager thread without someone randomly plugging Bitwarden when it has nothing to do with the actual topic :)
It is like being a Haskell developer (monads all the way down) or emacs/vim user.
Re: Kaspersky Password Manager: All your passwords are belong to us
#58Earlier quoted context omitted.
I looked into Bitwarden for work, but there's no password reset option for admins. I don't know how many times people have forgotten their password manager's password and I've had to reset it. Without that feature, Bitwarden is a non-starter for a corporate environment.
It was just added last week https://bitwarden.com/blog/post/admin-password-reset-is-out/
I hope this makes it into bitwarden_rs, which is what we use at work, soon. That and/or the ability to disable personal vaults would go a long ways for us.
Re: Kaspersky Password Manager: All your passwords are belong to us
#59The title is misleading. Yes, the passes are generated using a crappy and predictable seed value, but the passes are stored in a vault, and good luck breaking into that vault providing you use a strong master password, like a six-word diceware passphrase.
Re: Kaspersky Password Manager: All your passwords are belong to us
#60get your dice keys. https://dicekeys.com/