5 ms·

Yearlong supply-chain attack targeting security pros steals 390K credentials

• fsflover 2y ago
  This is why Qubes OS exists, providing security through strong hardware isolation. The attacker would only get the access to an empty VM. Split-ssh seems particularly relevant here: https://forum.qubes-os.org/t/split-ssh/19060 https://forum.qubes-os.org/t/split-ssh/19060
  • SahAssar 2y ago
    Another way is to use a hardware key for your ssh keys. I use a yubikey for ssh and for encrypting my passwords (via passage). Of course they could still steal my session tokens or try to backdoor my browser to catch my passwords when I enter them, but its a higher bar to clear.
    • fsflover 2y ago
      This will only protect your ssh keys, whereas Qubes can protect all your data and passwords.
• aftbit 2y ago
  Wow I wonder how many other npm and pypi packages are out there that started out as good simple solutions for a real problem and have now been migrated to become evil malware.