twovests

twovests wrote

Reply to comment by Dogmantra in Beware the Google Password Manager by voxpoplar

This is definitely a fair question. It's not entirely verifiable by onesself, and there's a lot weird security things to consider.

I also use 1Password. In terms of trusting someones server, that's actually a big reason they use end-to-end encryption. It means the server holds encrypted data, but not the means to un-encrypt. So, if 1Password's servers were compromised and the encrypted password vaults were downloaded, it'd still be extremely difficult and expensive to extract someones passwords from it. (They have a blogpost on this.) There'd be easier ways to get that information from someone. Relevant XKCD.

In terms of trusting code, it's rather difficult. There are open-source components that people may look at, but it's possible to sneak things in to code in a litany of ways. (Most popular: Ken Thompson's "compiler hack", 1984).

I don't know if I'm more tech savvy than you, but I can't verify any of this on my own. I do have some cryptography experience and I can vouch that 1Password's methods seem 1. Good, and 2. Rad as fuck. But my faith is in the vocal, extremely-critical, and never-satisfied tech community that is always prepared to rip to shreds any security company that fails.

Anyways, all this rambling aside, passwords are outdated but we still need them, and password managers are the only real option around the flaws of passwords. MFA / 2FA is also very very good, so even if your passwords are lost, they'll need to do more to get into your accounts. I use 2FA, so I could list my passwords here and still feel safe.

2

twovests wrote

Reply to comment by devtesla in Beware the Google Password Manager by voxpoplar

Yeah, Google is kind of like this unknowable extremely complex eldtritch being that you can't comprehend all at once, has tentacles in all manner of affairs, and is kinda fucked up.

1Password (and other managers!) has a single, solitary focus. I'd expect if it's compromised, it's less of a mistake on their end and more of a new piece of security research. (Or, on a personal level, malware.)

I think security keys are a really good thing and I hope we can all settle on USB C soon so they can be ubiquitous. Physical keys for electronic doors are really easy for almost anybody to understand, even people with no technology knowledge.

4

twovests OP wrote

Reply to comment by hollyhoppet in Do we have a ToS or privacy policy? by twovests

But aren't there like, legal requirements jstpst has to meet? Like GDPR and stuff like that?

I don't suspect y'all of anything crummy, but if it's not a concern for us and if we've been running with dozens (hundreds?) of users for so long, I guess I'll be fine too.

3

twovests OP wrote

Reply to comment by voxpoplar in Why is JavaScript only used on websites and webapps? by twovests

Oh I love these "weird JS behavior" talks and they're probably the reason I felt "Hmmm" in the first place about JS. (And the dependency issues you mentioned)

So while Javascript doesn't exactly make it hard to write good code, it makes it extremely easy to write incredibly awful code

This is an impactful takeaway

2