ejcx

18 ms·

151.
by ejcx 9y ago
I can not believe Joe Sullivan would just sit there during this. There has to be so much more to this story. I can not imagine he would be on board with negotiating with the hacker, and cannot imagine him sitting idly for a year after the c
152.
by ejcx 9y ago
These types of findings are such bullshit. They use "vulnerable" javascript libraries. I implore any reader to go out and find a vulnerability of non-P5 severity on 10% of these websites through these "vulnerable libraries&qu
153.
by ejcx 9y ago
No it is not at all. This is what the whole debacle was a few months ago when you removed most of the download links from your website. https://twitter.com/cryptovillage/status/884205077459738624
154.
by ejcx 9y ago
I'm a bugcrowd customer too, but offering a prize to say you are secure is a fallacy. It's also not how bugbounties work... Example: - https://moxie.org/blog/telegram-crypto-challenge/ The fact remains
155.
by ejcx 9y ago
It's both. My guess is the product offering and pricing changes are part of the same push for recurring revenue
156.
by ejcx 9y ago
Former LastPass employee here. Looks to me like 1Password is going full LastPass. First fully hosted passwords. Now support for extension only (which is way worse security wise). SaaS margins and recurring revenue is better, and I guess the
157.
by ejcx 9y ago
> This kind of thing doesn't stop people. I think it just means you end up with fewer good products to use. To be more clear. This won't stop the vast majority of people. They want to use good products. If it's good, they
158.
by ejcx 9y ago
That's what people have said about passwords with password managers, private keys with keybase, their servers and legal documents with AWS and docusign, their banking with online banking, etc etc. The list goes on and on. This kind of
159.
by ejcx 9y ago
Again, I think this decision has nothing to do with Ransom HPKP and everything to do with how it's not a usable standard, and people who try to use it correctly fail.
160.
by ejcx 9y ago
I will be VERY upfront that I DO blame Scott Helme for this. I mentioned this in 2/2016 as well[0] It's fair. There was a lot of buzz about Ransom HPKP. The whole thing was doomed from the start, and I was pretty upset every time
161.
by ejcx 9y ago
I think this has very little to do with you. Hpkp was championed by a lot of security people, who in turn got a lot of people to foot gun themselves (Scott Helme even admitted that he is oftentimes one of the first people called by people w
162.
Public Key Pinning Being Removed from Chrome(groups.google.com)
261 points by ejcx 9y ago|107 comments
163.
by ejcx 9y ago
It might have been okay but yeesh I hate that navigation apps do this. They will randomly reroute you through a labrynth to save you a minute. Happened to me all the time when I lived in Dc/Nova and I learned not to listen to the app
164.
by ejcx 9y ago
I worked at LastPass for a while as one of the few engineers. People hated our UX, and we honestly didn't even get close to the UX that 1password offered while I was there (They are working on it now). LastPass killed it because they h
165.
by ejcx 9y ago
If you're using microservices and care about security, do yourself a favor and use a monorepo. A lot of improving security is about changing things in small ways but across the entire fleet. If you have microservices without a monorepo
166.
by ejcx 9y ago
There is absolutely no breach here. Absolutely not. Suggesting so is ridiculous. The word breach is a very special one and this is not it.
167.
by ejcx 9y ago
This reaction is nonsense. These are all vendors that circle pays. It's an industry wide bad practice and a risk, but forcing password changes or notifying people is quite frankly ridiculous.
168.
by ejcx 9y ago
Ive only done security in SaaS in my career. This text file is pretty useleas. Disclosure is very out of place, and indicates to me that it's pretty much just for companies with a bug bounty I'm a bit negative, but I don't wa
169.
by ejcx 9y ago
If you don't get your technicians license and have the opportunity to, I think you're crazy. It's something in tech that doesn't get enough love anymore. It's immensely valuable and actually a fun change of pace fro
170.
by ejcx 9y ago
It's been locked for two weeks, has been closed for 8 months, is something Google is aware of and has been discussed for months. Your title is click bait. There's nothing new going on here
171.
by ejcx 9y ago
Someone already posted our tool, chamber, that we use to manage secrets in parameter store at Segment. Here is a blog post we published with all the details about exactly how it works: https://segment.com/blog/the-right
172.
by ejcx 9y ago
You're just moving the problem around... Access isn't "cut off" by revoking an env key. The actual secret has not changed. I think, just like vault, this is missing the point wrt secrets management for services. Sorry to
173.
by ejcx 9y ago
Sorry. I'm really not sold that this is suitable for applications to use. The core problem to secrets management is service identity. Managing encrypted data is not hard, it's actually really easy. It's the identity that is h
174.
The Right Way to Manage Secrets(segment.com)
2 points by ejcx 9y ago|0 comments
175.
by ejcx 9y ago
I almost never heard anything negative about vault until I did a presentation on all the troubles I had with it. Here are the slides about the issues I had: https://docs.google.com/presentation/d/1ipP2eB9pW5j3WDvzC
176.
DigitalOcean Security Notice: Default password in 1-click mysql installs(twitter.com)
3 points by ejcx 9y ago|0 comments
177.
by ejcx 9y ago
3x revenue for a SaaS business that is probably growing at 100% yoy makes no sense. I have no idea why people continue to cite this. Even public SaaS companies aren't getting valuations so low.
178.
by ejcx 9y ago
I won't begin to pretend that I'm a lawyer, but ESEA was fined $1MM for this not too long ago: https://www.theregister.co.uk/2013/11/20/esea_gaming_bitcoin...
179.
by ejcx 9y ago
OP will undoubtedly not have more info. It's not snake-oil. I used to work there. There's a real TLS connection.
180.
by ejcx 9y ago
> Very vague on details. No links to exact researchers or their findings. That's the whole point. When you are dealing with a major security incident (anything impacting a countries ID cards would count), one of the first things you

More ›