Clipperz

Keep it to yourself - Online Password Manager

Mastodon:

[Clipperz @Clipperz]

@giuaniz Ciao Giovanni; il problema persiste ancora?
A noi risulta tutto in ordine. 🤔

[Clipperz @Clipperz]

https://t.co/rapdDepblJ

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Clipperz @Clipperz]

Our profile had been temporarily disabled when we had to specify the "Birth date"; we set it in November 2005 (when the project was started) but this triggered some 𝕏/Twitter policies, and all tweets posted before this account was considered 13 years old may have been deleted 🤷‍♂️

[Clipperz @Clipperz]

We keep pouring more love into `/epsilon` (still in preview mode):
https://t.co/XPHEug2Lpd

[Clipperz @Clipperz]

… as it is supposed to be.

[Clipperz @Clipperz]

In September, @andrus_a is going to be in Bologna to talk about a new project he's working on: https://t.co/RK9VrLwdDE #dflib
We are thrilled to finally be able to meet him, after having used @ApacheCayenne for so many years.

[Giulio Cesare 🏳️‍🌈🇪🇺🇮🇹 @gcsolaroli]

Early notice: on September 12th, in Bologna (Italy), there is going to be a nice meetup organized by @tmnd1991 that will include also a presentation of #dflib by @andrus_a

https://t.co/Kc18Fvtgwl

[Cryptography Tip @CryptographyTip]

The value of encryption https://t.co/Izyo223I8q

[Clipperz @Clipperz]

🤔

[Dan Shipper 📧 @danshipper]

There will eventually be a big opportunity to build a password manager explicitly to share passwords with AI agents

[Clipperz @Clipperz]

We have read many security books, but not this one.
Unfortunately at the moment we are busy working on the new version of our application and we have to postpone reading it. 🤪

[Ryan Els @ryanels]

Security by optimism and prayer 🙈

[Clipperz @Clipperz]

Some small improvements trickling down the devops pipeline:
- https://t.co/y9zDv6UaWi

[Clipperz @Clipperz]

Our new application version (`/epsilon`) is still in preview mode, but it's already spotting some new interesting features:
- https://t.co/M7dXie2b3d

[Clipperz @Clipperz]

The joys of web development: same application*, same action, different outcomes:
- Firefox
- Chrome
- Safari
🫠

Resizing the window fix the rendering issue, pointing to a possible 'media-query' issue.

[*] development version of the new /epsilon version

[Carl Vellotti 🥞 @carlvellotti]

peak product design

[Clipperz @Clipperz]

Now this may be a good reason to justify why our project is not more popular. 🤪

[Lars-Erik Roald @lroal]

@ChristinGorman An open source project with many bugs and inconsistencies is more popular than a flawless one.
It gains even more popularity as developers report bugs and create crazy workarounds. They get emotionally attached to it.

[Clipperz @Clipperz]

https://t.co/7BMOrDglSo

[Cryptography Tip @CryptographyTip]

STRONG encryption may not be sufficient for legal protection. Some laws require STANDARD encryption.

https://t.co/73E6aTujae

[Clipperz @Clipperz]

It has been a very long way, but it looks like we are going somewhere:
- https://t.co/o6PV4SJ8PF

[Clipperz @Clipperz]

Having an application first released in 2007 still online is an achievement we are pretty proud of; knowing that it is still useful to some of our users is super-duper. 🤩

[Clipperz @Clipperz]

While working on getting ready for the Public Preview of the new /epsilon version of the application, we pushed a wrong configuration that caused the old `/beta` version of Clipperz to be not accessible.

A user wrote us to report the issue and we quickly fixed it.