Nastypouch

@epixoip@infosec.exchange @Casper042@mastodon.social @squelch41@retrochat.online @Goutham@techhub.social @bgeerdes@mastodon.cloud @Jerry@hear-me.social @abhivm@mastodon.social @SOOKIE@tech.lgbt @jally@bbq.snoot.com @eclectic_citizen@convo.casa @sherridavidoff@infosec.exchange @jstangroome@infosec.exchange @BenAveling@infosec.exchange @NilsRenaud@m.g3l.org @thor@mast.ttk.is @arpcomics@mastodon.online @cambraca@musicians.today @pkellner@techhub.social @Nazo@hachyderm.io @davelee212@hachyderm.io @CivilDev@hachyderm.io @edbro@swecyb.com @yeleek@infosec.exchange Since you mention Tavis, it's worth noting that he found an "astonishingly bad" vulnerability in 1Password and actually *recommended* LastPass (if one was determined to use a cloud-based solution) because they had a competent security team: https://twitter.com/taviso/status/1167404993260818434?s=20&t=y6PdkfVHC81v1Gglfe6-kA

@epixoip@infosec.exchange Regardless of the competence of the people working on it, I don't think cloud-hosted passwords are a good idea because of the relative value in compromising one of the providers or finding vulnerabilities in the code. The core functionality of a password safe is simple and easier to get right, and I think where we're tending to run into trouble is when we see third parties start to try to provide all-in-one syncing/autofill/hosted password management solutions.

@epixoip@infosec.exchange It's entirely possible his perspective has changed since then of course, but I don't think "I know the 1Password engineers know what they're doing" addresses the more fundamental problems of providing this sort of software. The question isn't *if* vulnerabilities are found, it's how the team will respond when they inevitably are.