4 ms·
So Roboform has almost certainly thousands (of not millions) of users with weak passwords, and not only didn't they tell anyone, all they give is a shrug when a
by arp242 2y ago
So Roboform has almost certainly thousands (of not millions) of users with weak passwords, and not only didn't they tell anyone, all they give is a shrug when asked about it.
What a bunch of bozos.
- paulpauper 2y agoBecause the vast majority of ppl who use it will not be storing millions of dollars of crypto with it. Crypto changes the game totally.
- yreg 2y agoNo it doesn't. What kind of an excuse is that? When a password manager maker finds a vulnerability they should absolutely tell their users to regenerate their passwords!
- paulpauper 2y agodidn't the vendor fix it?
- yreg 2y agoThey are supposed to disclose the vulnerability after fixing it, so their users know they need to take action. That's what the original commenter rightly complained about.
- wepple 2y agoCrypto doesn’t change the game. Products that generate passwords should do so securely. You may be using it to protect extremely sensitive information that could have people killed - that’s more important than a few million dollars in imaginary money
- lazide 2y agoWhat if a few million dollars in imaginary money is more than enough to pay someone to kill some folks?
- arp242 2y agoPeople have bank passwords, social media accounts (which can be used in all sorts of nefarious ways), etc. Some may be 2FA protected, some may not be. Some may be protected by bad faux-2FA. Just because there aren't million at stake doesn't mean you can't bring someone to ruin.
- loumf 2y agoYou can try millions of passwords on a wallet without anything stopping you. You only get a few guesses on a bank site.
- Borealid 2y agoIf you only get a few guesses on a bank site, then you can inconvenience large numbers of users cheaply.
- lucasban 2y agoSure, but I’d take being inconvenienced over having my accounts compromised
- Gigachad 2y agoMost users are going to be already logged in on their phone apps so they won’t be affected. And the inconvenience is most likely going to be chucking up a captcha to prevent automated attempts.
- loumf 2y agoYou can do this without reverse engineering a password algorithm.
- PUSH_AX 2y agoI mean how weak are they really? These guys knew the algo and still struggled and pestered the user over and over for the other parameters. They also had what I would describe as an extreme motivation to crack this.
- GrantMoyer 2y agoThe fact that a password could be cracked at all means it was very weak. Strong passwords can't be cracked with any realistic amount of resources or motivation.
- loa_in_ 2y agoThere's a small chance that your password will be my first roll in a random generator.
- GrantMoyer 2y agoI used the absolute language "can't" intentionally, because frankly, in most contexts outside pure math it's more misleadling to state guessing a sufficiently long truely random password is possible than to say it's impossible. Humans can't really intuitively handle probabilities so small. It's the same reason we say heat "always" flows from higher to lower temerature.
- arp242 2y agoHard to say without details; but now that the weakness is known it may become a lot easier. It's one thing if you think it may work if you have the correct parameters but aren't sure, and quite another if you know it will work. Password managers are kind of a "defence in depth" thing; practical speaking, a passwords.txt opened with notepad is probably fine for many people. No one is in your computer checking your files. You have a password manager for when that does happen, just in case. And usually this tends to be a targetted attack, which can range from some country's secret service to a jealous spouse to a trolling sibling. If that extra protection is ineffective ... yeah, that's not great. This really is "better safe than sorry" type territory. Password managers (including Roboform) already do this by notifying users a password may be insecure after a leak. A lot of the time that's not really needed if your password is sufficiently secure, but "better safe than sorry". This is not all that different.
- ashconnor 2y agoIt was in the changelog. Anyway the major benefit of using a password manager isn't generating difficult to guess passwords. It's being able to generate unique passwords so when you're details end up on https://haveibeenpwned.com https://haveibeenpwned.com people can't take the password that's leaked and try it on all the other services you've used.