3 ms·

Why would any "enterprise" customers trust closed sourced AND small-time password manager?

by 627467 6y ago

boomboomsubban 6y ago
Because they quoted the lowest price for support.
g_p 6y ago
It seems to me there's a trend around "enterprise" software having weaker supply chains than the more nimble and agile tools. Perhaps mindset related? Larger teams needed to meet enterprise needs? Or simply more focus on the sales machine to close complex enterprise deals, and less focus on securing the pipeline through which the product is made? Solarwinds is a great example of this - "big enterprise software" used by big enterprises, and yet their whole build infrastructure was compromised as it ran with less security thinking than your average open source project (which at least discards build environments each run).
- kristov 6y ago
  > It seems to me there's a trend around "enterprise" software having weaker supply chains than the more nimble and agile tools. Or enterprise tools are a more attractive target for attacks. Due to that they should be better at this, so still shame on the slack ones.
- swiley 6y ago
  IME enterprise software is chosen very poorly in general. Microsoft wouldn't be nearly as large now if it weren't for this.
gerdesj 6y ago
You does your risk assessment etc etc. For some those are not a combinatorial red flag - for you it seems they are. There are a lot of things to consider and not one of us here can possibly say they've got it all covered. No one ... ever 8) This morning my home doorbell didn't ring and a phone alarm didn't wake someone up. Two almost unrelated fails. As a result we missed an appointment which we fixed an hour or so later. Right let's do the analysis: Doorbell is a Doorbird. I've got it running on a ethernet connection via PoE. All my home IT stuff is on UPS. I have a decent router that I know very well. I don't skimp on my home gear and I have a quite large VMware esxi which runs my home servers and stuff. I use Home Assistant which has a Doorbird integration and when you press my doorbell all my Sonos speakers say: "Ding dong, there is someone at the door". I got it wrong: I thought that my HA box spoke directly to my Doorbird or vv. No it doesn't - it is all done via their API and that means internets. Today I wired up a simple door chime to my Doorbird which will ring regardless of internets. The chime cost £10. The Doorbird has a chime output which isn't latching but good enough to make a chime ... chime. So that's what I do at home.
cjohansson 6y ago
It may be just a matter of time until LastPass gets hacked, I would suspect that the attack surface is the browser plugin
- luckylion 6y ago
  From my interactions with LastPass' support, I'm not sure. They rely on security by obscurity in some parts, I wouldn't be surprised if they did in others.
- jfrunyon 6y ago
  LastPass was hacked just six years ago... how short our collective memory is https://blog.lastpass.com/2015/06/lastpass-security-notice/ https://blog.lastpass.com/2015/06/lastpass-security-notice/ As far as getting actual password data, yes, the attack surface is the clients, and as the most common client is presumably the browser plugin, it's probably the most likely to be attacked.

Why would any "enterprise" customers trust closed sourced AND small-time password manager?

by 627467 6y ago

Why would any "enterprise" customers trust closed sourced AND small-time password manager?

boomboomsubban 6y ago

Because they quoted the lowest price for support.

g_p 6y ago

It seems to me there's a trend around "enterprise" software having weaker supply chains than the more nimble and agile tools. Perhaps mindset related? Larger teams needed to meet enterprise needs? Or simply more focus on the sales machine to close complex enterprise deals, and less focus on securing the pipeline through which the product is made? Solarwinds is a great example of this - "big enterprise software" used by big enterprises, and yet their whole build infrastructure was compromised as it ran with less security thinking than your average open source project (which at least discards build environments each run).

kristov 6y ago
> It seems to me there's a trend around "enterprise" software having weaker supply chains than the more nimble and agile tools. Or enterprise tools are a more attractive target for attacks. Due to that they should be better at this, so still shame on the slack ones.
swiley 6y ago
IME enterprise software is chosen very poorly in general. Microsoft wouldn't be nearly as large now if it weren't for this.

gerdesj 6y ago

You does your risk assessment etc etc. For some those are not a combinatorial red flag - for you it seems they are. There are a lot of things to consider and not one of us here can possibly say they've got it all covered. No one ... ever 8) This morning my home doorbell didn't ring and a phone alarm didn't wake someone up. Two almost unrelated fails. As a result we missed an appointment which we fixed an hour or so later. Right let's do the analysis: Doorbell is a Doorbird. I've got it running on a ethernet connection via PoE. All my home IT stuff is on UPS. I have a decent router that I know very well. I don't skimp on my home gear and I have a quite large VMware esxi which runs my home servers and stuff. I use Home Assistant which has a Doorbird integration and when you press my doorbell all my Sonos speakers say: "Ding dong, there is someone at the door". I got it wrong: I thought that my HA box spoke directly to my Doorbird or vv. No it doesn't - it is all done via their API and that means internets. Today I wired up a simple door chime to my Doorbird which will ring regardless of internets. The chime cost £10. The Doorbird has a chime output which isn't latching but good enough to make a chime ... chime. So that's what I do at home.

cjohansson 6y ago

It may be just a matter of time until LastPass gets hacked, I would suspect that the attack surface is the browser plugin

luckylion 6y ago
From my interactions with LastPass' support, I'm not sure. They rely on security by obscurity in some parts, I wouldn't be surprised if they did in others.
jfrunyon 6y ago
LastPass was hacked just six years ago... how short our collective memory is https://blog.lastpass.com/2015/06/lastpass-security-notice/ https://blog.lastpass.com/2015/06/lastpass-security-notice/ As far as getting actual password data, yes, the attack surface is the clients, and as the most common client is presumably the browser plugin, it's probably the most likely to be attacked.