1Password detects "suspicious activity" in its internal Okta account

• pass-import

  404 779 8.1 Python

  A pass extension for importing data from most existing password managers

• prevent-exfiltration

  1 0 10.0 JavaScript

5. Server validates signature and timestamp

The security issue is in step 1. WebCrypto can generate non-extractable private keys and store them in indexeddb. However, this assumes no malicious code flips the “extractable” flag before the pair is generated. So this strategy is trust-on-first-use.

[0] - https://chromestatus.com/feature/5097603234529280

[1] - https://github.com/kevlened/prevent-exfiltration/blob/main/i...

• Scout Monitoring

  www.scoutapm.com featured

  Free Django app performance insights with Scout Monitoring. Get Scout setup in minutes, and let us sweat the small stuff. A couple lines in settings.py is all you need to start monitoring your apps. Sign up for our free tier today.

  

Suggest a related project