3 ms·
Would you avoid using any password storage where either the system itself or the underlying foundation has had serious vulnerabilities at some point? Or only b
by tuwtuwtuwtuw 5y ago
Would you avoid using any password storage where either the system itself or the underlying foundation has had serious vulnerabilities at some point?
Or only bad vulnerabilities triggered using JavaScript? Or would you only accept a history with vulnerabilities if security researchers were paid properly for the work they invested into finding the issues?
- pydry 5y agoI tend to prefer open source but slightly obscure open source with a few unpaid maintainers and a very high attack surface? Yeah, I'd avoid that too. I have much more confidence in open source password storage that doesnt try to autofill. Theres much less that can go wrong. This is how I store banking passwords. A serious vulnerability puts me off but not as much as a tepid ass response that tries to downplay the severity of a really bad problem. That makes me consider the software radioactive.
- SAI_Peregrinus 5y agoKeePass (and the forks like KeePassXC) doesn't try to autofill passwords. There's a separate browser plugin (different download, not installed or recommended by default) for KeePass that did, and that's where the vulnerability was.
- pydry 5y agoI was alluding to this when I said "slightly obscure". I still use KeePass, but not that plugin.