444 karma · joined January 1, 2013
The thing I guess I would say bothers me about your post is you just say well, if a person gets access to a machine it is basically all over which isn't necessarily the case. Even if they get root access we don't want to make it easy, right? Thats why we encrypt databases or in certain cases storage at rest so even if the hacker has root access it is sure going to be hard.
1Password can never absolutely protect against an attack when an attacker has root. But they can make it harder then just dumping out lo0. Level of effort does account for something.
Thank you for responding. The reason I wrote this up is not to let people oh my god the world is ending but to let them know, hey if you are using the browser extension there is clear text passwords being sent over the loopback, if you don't like that then don't use their extensions.
You have made very well informed arguments about how hard it is to protect if someone has access to your machine, specifically elevated. But the argument to me seems kind of like "well, it's hard to protect against then so we just decided to not do anything at all." It seems like one other password manager company did something, so why wouldn't you?
Can you explain why it would require a pairing request every time? Couldn't you just pair it once and then be done with it? Can you explain the other approaches?
When I go into a company I make sure we put a policy in place that to review an employees emails / web traffic / devices we need to have Legal and HR sign off on it unless the person being investigated is part of one of those groups then it is one group and an executive.
This covers me from legal/HR fallout and it covers the employees because they know we aren't just sneaking around looking at their stuff, it creates trust.
We grabbed quite a few names due to people misspelling the domain so we could direct them to the proper site, never really cared about the <name>sucks.com stuff.
In DDoS attacks you have three models: On-Prem: Buy hardware and big fat internet pipes to filter traffic (expensive / time \ resrouce intensive) Hybrid: On-Prem devices that can mitigate X/Mbps and then starts announcing your routes after X to their cloud scrubbing centers which can filter it at a much higher capacity (best option) Cloud: Full on filtering by a provider where all your traffic goes through their scrubbing centers full time (usually adds latency, extremely expensive)
The hybrid model is the best and what most companies are going to as it allows you to filter smaller attacks out with little cost as well as scaling up to large 100 Gb/s+ attacks without having to buy massive amounts of hardware/transit.
Also from your FAQ what the hell is "strong level encryption", can you not name it? Can you go into the extreme technical details of what encryption you are using, how data is protected in memory and at rest?
Also to note Google Fiber uses a lot of nLayer/GTT for their eyeball traffic.
www.arbor.net
www.radware.com
www.voxility.com
I think any company has the right to change their business model and/or product offerings. The one thing I'm a bit confused about is why are they decreasing their free storage tier and taking away the camera roll bonus? To me that just seems like a really bad PR move. In a similar fashion Box did the same type of thing way back in the day and while that was their right I still won't use them to this day.
--- /dev/sda1 (device 20.0 GiB) ioping statistics --- 13 requests completed in 12.5 s, 161 iops, 647.9 KiB/s min/avg/max/mdev = 213 us / 6.2 ms / 18.2 ms / 6.0 ms
This is pretty bad, everything on AWS is under a millisecond.
I submit feedback through the feedback links in the panel and on the product forums. Since you folks don't offer any other way of communicating.
Also any idea if your folks are ever going to let people set RDNS records for their IPs? It has been requested but no one at GCE seems to communicate.