tonic-music
Joined 8 years ago
Karma
35
Submissions
30
Member since
Jul 15
Recent submissions
Comment · 8 years ago
Comment · 8 years ago
How is the user able to recover a lost password using only their secondary 2FA device? This page on your website suggests that you can remove the master password on anyone's fault if they authenticate via their 2FA device.
https://support.logmeininc.com/lastpass/help/recover-your-lo...
Comment · 8 years ago
They claim they'll keep it alive but Embrace, Extend, Extinguish is in their blood.
Comment · 8 years ago
You can see why... Actual geniuses are attracted to the hard problems and are usually called massive nut jobs at first.
Comment · 8 years ago
Want.
Comment · 8 years ago
No, you should feel smart. This is what the free in free software is all about. Making it work for others and hosting it is your work. Go commercialize it and make your money!
Comment · 8 years ago
Spanish
Comment · 8 years ago
I think we all know about view source. The risk lies exactly where you described it. I've never heard of being able to diff a running web page against a set of source repositories. Perhaps another HN reader will go invent that.
Comment · 8 years ago
Where is this Windows app of which you speak? I don't see it linked on your website.
Comment · 8 years ago
Just sent this bug report (from the Android client, lol). Will post their response here:
What is the official response to this report?
https://eprint.iacr.org/2018/1121.pdf
I'm not a cryptography expert but I am a web developer and even I can figure out that typing my password into a web app reveals my private key to you if you want to steal it.
The author is right in one respect: the online and self- updating nature of the web app makes it impossible for anyone to verify what code you're really running.
Reading this report also makes me question your response to the recent hack/extortion incident. Now, I'm not really convinced about your response.
There's nothing in my PM account that's secret and I don't really care if you were hacked. I use PM to avoid being tracked for advertising. But I do agree with the author of this paper that you shouldn't make these security claims which aren't true.
Thanks in advance for your response.
-- D
Comment · 8 years ago
Very interesting, especially in light of the recent claimed hacks to ProtonMail. I've just switched to PM recently and, while I'm no cryptography expert, it did seem unlikely that typing my password into a browser app could ever be considered very secure -- certainly not "invisible" to PM since, as the author points out, you can't see or validate the code running in the browser.
Comment · 8 years ago
Disgusting. Another reason to delete your Google account.
Comment · 8 years ago
Too bad smart contracts aren't.
It's also perfectly acceptable to offer a free version as source only for those folks who want to compile and update it on their own -- then charge for the compiled version with automatic updates.