Hacker News Reader

Comment by paulpauper | Hacker News Reader

Because the vast majority of ppl who use it will not be storing millions of dollars of crypto with it. Crypto changes the game totally.

View on HN

No it doesn't. What kind of an excuse is that?

When a password manager maker finds a vulnerability they should absolutely tell their users to regenerate their passwords!

didn't the vendor fix it?

They are supposed to disclose the vulnerability after fixing it, so their users know they need to take action. That's what the original commenter rightly complained about.

People have bank passwords, social media accounts (which can be used in all sorts of nefarious ways), etc. Some may be 2FA protected, some may not be. Some may be protected by bad faux-2FA.

Just because there aren't million at stake doesn't mean you can't bring someone to ruin.

You can try millions of passwords on a wallet without anything stopping you. You only get a few guesses on a bank site.

If you only get a few guesses on a bank site, then you can inconvenience large numbers of users cheaply.

Sure, but I’d take being inconvenienced over having my accounts compromised

Most users are going to be already logged in on their phone apps so they won’t be affected. And the inconvenience is most likely going to be chucking up a captcha to prevent automated attempts.

You can do this without reverse engineering a password algorithm.

Crypto doesn’t change the game. Products that generate passwords should do so securely.

You may be using it to protect extremely sensitive information that could have people killed - that’s more important than a few million dollars in imaginary money

What if a few million dollars in imaginary money is more than enough to pay someone to kill some folks?

Reply on news.ycombinator.com