Nastypouch

@epixoip@infosec.exchange It's entirely possible his perspective has changed since then of course, but I don't think "I know the 1Password engineers know what they're doing" addresses the more fundamental problems of providing this sort of software. The question isn't *if* vulnerabilities are found, it's how the team will respond when they inevitably are.

@epixoip@infosec.exchange @Casper042@mastodon.social @squelch41@retrochat.online @Goutham@techhub.social @bgeerdes@mastodon.cloud @Jerry@hear-me.social @abhivm@mastodon.social @SOOKIE@tech.lgbt @jally@bbq.snoot.com @eclectic_citizen@convo.casa @sherridavidoff@infosec.exchange @jstangroome@infosec.exchange @BenAveling@infosec.exchange @NilsRenaud@m.g3l.org @thor@mast.ttk.is @arpcomics@mastodon.online @cambraca@musicians.today @pkellner@techhub.social @Nazo@hachyderm.io @davelee212@hachyderm.io @CivilDev@hachyderm.io @edbro@swecyb.com @yeleek@infosec.exchange Since you mention Tavis, it's worth noting that he found an "astonishingly bad" vulnerability in 1Password and actually *recommended* LastPass (if one was determined to use a cloud-based solution) because they had a competent security team: https://twitter.com/taviso/status/1167404993260818434?s=20&t=y6PdkfVHC81v1Gglfe6-kA

@epixoip@infosec.exchange Regardless of the competence of the people working on it, I don't think cloud-hosted passwords are a good idea because of the relative value in compromising one of the providers or finding vulnerabilities in the code. The core functionality of a password safe is simple and easier to get right, and I think where we're tending to run into trouble is when we see third parties start to try to provide all-in-one syncing/autofill/hosted password management solutions.

@epixoip@infosec.exchange You're right that the security of your password manager shouldn't ever depend on whether or not the vault is available to others, but my criticism has never been about that. Any solution that injects custom JavaScript into your browser to fill passwords is a bad one and has a host of security concerns that probably can't be fully addressed.