Comment by wastewastewaste

5 days ago

which password manager were you using that it got hacked?

9 comments

wastewastewaste

Reply
zbentley  5 days ago

Not GP, but I've seen this happen a few times with $work managed password managers. From memory and in no particular order, the reasons for the breach were:

- User account with access to the SaaS password manager was compromised.

- User account with access to the SaaS password manager was compromised.

- User account with access to the SaaS password manager was compromised.

- Password safe file (keepass) was compromised/leaked and its (medium-strength) master password was presumably brute-forced.

EDIT forgot one:

- Password manager was used by a user-facing web backend, which unlocked it with an unscoped read-everything master password. Web backend was hacked, predictable consequences ensued.

  • mentalpiracy  5 days ago

    These examples are very different than your provider being hacked.

    Ideally you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?

    • zbentley  5 days ago

      > These examples are very different than your provider being hacked.

      I am not GP. GP said:

      > I say "no thanks, they're going to get hacked" and then six months later... they get hacked.

      I interpreted that to mean "they (the passwords) were compromised" not necessarily "they (the password vault provider) were compromised".

      > you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?

      Correct.

      2 replies →