4 ms·
That TPM hack was really impressive engineering. But I kept scrolling through to figure out what the next step was and it turns out the VPN software establishes
by INTPenis 5y ago
That TPM hack was really impressive engineering. But I kept scrolling through to figure out what the next step was and it turns out the VPN software establishes a tunnel before authentication as a "feature".
So while the TPM hack was very impressive, this article only gives me a sense of safety for our own corporate laptops.
- mattashii 5y agoWell, only insofar that you trust that your own corporate laptops don't contain sensitive data on the disk. I am really happy to know my laptop isn't vulnerable to this (luks-based system), but I am very concerned with the potential (in)security of my collegues' laptops due to common use of corporate laptop hardware for software development and technical customer support.
- imwillofficial 5y agoSend this article to your security team. Hopefully they will appreciate the backup.
- INTPenis 5y agoTrue we have only started using password managers in the last 6 years or so. But what I meant was that a proper VPN with forced MFA setup and strict ACL makes most of those credentials useless.
- outworlder 5y ago> this article only gives me a sense of safety for our own corporate laptops. Keep in mind that it was a sanitized laptop with no actual data on it, built for the test. A random employee's laptop? Probably has all sorts of goodies. Don't get complacent.
- exhilaration 5y agoA random employee's laptop? Probably has all sorts of goodies. Don't get complacent. Like a PASSWORDS.txt file on the desktop which said employee uses as a password manager.
- killjoywashere 5y agomore like Passwords.doc, synced to at least two cloud back-up services.
- shapefrog 5y agoNo cloud backups allowed on a corportate laptop, got to email it to yourself instead. Or my personal super advanced, high security method - keep it in the 'drafts' folder.
- vxNsr 5y agoIt should be noted that if you were able to compromise the OS login credentials you also have access to most browser password managers, and as a feature many 3rd party managers also let you unlock with the user password… so in this case those are compromised too.
- MonaroVXR 5y agoBitwarden needs to be unlocked after your browser is being closed. It's the stock setting.
- arpa 5y agoFirefox uses a master password for its password store and stores them in own encrypted sqlite database. Chrome stores them using system keyring, which is ok in linux, not so fine in windows.
- Swannie 5y agoBut Firefox doesn't require the password on reboot - or to even access the plaintext password in the password manager! So just fire it up, and access the passwords. The on disk encryption is pretty redundant.
- arpa 5y agoWe must have been using different firefoxes, as I have to enter my master password quite often (even after locked screen).
- Terretta 5y ago> this article only gives me a sense of safety for our own corporate laptops Because you don’t use any “enterprise-grade” commercial security solutions on them, no tele-support, no lights out remote management, no antivirus or anti malware, no firewall, no VPN, no nothing? Because if you have any of that, you almost certainly have holes like this one.