4 ms·
I generally agree but would you place your security in the hands of some 3rd-party providers such as password managers? If you do that then their problems insta
by _pdp_ 8y ago
I generally agree but would you place your security in the hands of some 3rd-party providers such as password managers? If you do that then their problems instantly become your problems.
I am not saying that password managers are without any merit and/or useful. All I am saying is that although security decisions are often made without much thought process there are situations where there are some hard requirements based on a multitude of factors which are not publicly discussed.
It is easy to brush it all off as a 3rd-party observer but in reality nothing is perfect and considering that a lot of the people on this forum are actual developers you must be well aware of the countless compromises you had to make that go against security best-practices... :) common on.
What Troy is discussing are cases of trivial matter of negligence - hardly breaking the bank and I can assure you that in many circumstances the security budget required to implement some of the necessary improvements outspend the annual fraud budget. This is hardly makes an argument if you need to justify your department running cost.
Yes shaming kind of works, sometimes... but honestly these companies have much bigger internal problems than reconsidering their whole stance on usefulness of password managers and the risk levels their are willing to accept.
- n4r9 8y ago> would you place your security in the hands of some 3rd-party providers such as password managers? I don't know if I can think of a better solution than an open-source password manager which encrypts and stores everything locally. Unless you have an incredible memory. > but honestly these companies have much bigger internal problems than reconsidering their whole stance on usefulness of password managers I guess Troy is just focusing on what he knows best.
- auslander 8y ago> I don't know if I can think of a better solution than an open-source password manager Sure, KeePass(XC) > I guess Troy is just focusing on what he knows best No, KeePass(XC), as you said, stores everything locally, no Troy needed.
- n4r9 8y agoNot sure if you're agreeing with me or not. Yes, I think KeePass is the best way and I use it myself with SyncThing to sync between machines. That's still trusting a third party to some degree: you're trusting that the code doesn't have many bugs that someone could exploit to bypass the master password. But it minimises the risk. The part about Troy was in response to the OP's claim about public shaming.
- auslander 8y ago> Not sure if you're agreeing with me or not. Yes, I think KeePass is the best way I do agree about KeePass. Its code survived in the open for that long. About "Troy is just focusing on what he knows best" - security is hard, be precise :)