4 ms·
I'd avoid using that too then.
by pydry 5y ago
I'd avoid using that too then.
- tuwtuwtuwtuw 5y agoWould you avoid using any password storage where either the system itself or the underlying foundation has had serious vulnerabilities at some point? Or only bad vulnerabilities triggered using JavaScript? Or would you only accept a history with vulnerabilities if security researchers were paid properly for the work they invested into finding the issues?
- pydry 5y agoI tend to prefer open source but slightly obscure open source with a few unpaid maintainers and a very high attack surface? Yeah, I'd avoid that too. I have much more confidence in open source password storage that doesnt try to autofill. Theres much less that can go wrong. This is how I store banking passwords. A serious vulnerability puts me off but not as much as a tepid ass response that tries to downplay the severity of a really bad problem. That makes me consider the software radioactive.
- SAI_Peregrinus 5y agoKeePass (and the forks like KeePassXC) doesn't try to autofill passwords. There's a separate browser plugin (different download, not installed or recommended by default) for KeePass that did, and that's where the vulnerability was.
- pydry 5y agoI was alluding to this when I said "slightly obscure". I still use KeePass, but not that plugin.
- boringg 5y agoWhat about 1password?
- ChrisMarshallNY 5y agoI've used 1Password for years. I recommend it to orgs I work with.
- TonyTrapp 5y agoKeePass is a free software, not a service that generates revenue. Why would you expect a free software developer that is entirely funded by donations (which most likely won't even cover development costs) to pay 10,000$ to a security researcher finding a bug in their software or you will stop using their software? This is completely unrealistic. Bugs happen, free software exists. You cannot stop using all free software that had a security bug in the past that wasn't awarded with 10,000$.
- pydry 5y agoI didnt say I did expect bounties from them. I just said I'd avoid using this software. The fact remains that autofilling passwords in-browser has a gargantuan attack surface and hence the potential to go very wrong. You have to really trust whichever software you use for this. I expected better from lastpass because I used to give them actual money. I'm not upset that some random keepass extension did this but I also wouldnt use it either.
- SAI_Peregrinus 5y agoKeePass doesn't come with the browser plugin, BTW. It's a separate, optional download.
- pydry 5y agoI know.