Login
You're viewing the mastodonapp.uk public feed.
  • Nov 3, 2026, 12:30 PM

    Heads up: A password management app/platform called Msecure from mSeven Software says it recently learned of suspicious activity associated with its app. Here is the important part of their advisory:

    "Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."

    There isn't much else to the notice. I've pasted the entire thing below anyway.

    "Important Security Notice

    mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.
    Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.
    We regret any inconvenience that this may cause.

    Sincerely,
    The mSeven Software Team"

    💬 8🔄 88⭐ 44

Replies

  • 💬 0🔄 0⭐ 0
  • 💬 4🔄 1⭐ 0
  • Nov 3, 2026, 12:43 PM

    @thatnateguy @ebourgess @briankrebs I’ve heard the opposite of BitWarden. We have to use it at work and it’s pretty awful. Search is terrible, organisation by folders is weird and janky, unusable latency logging in waiting for email to arrive that often never do…

    💬 1🔄 0⭐ 0
  • Nov 3, 2026, 2:50 PM

    @Drarok @thatnateguy @ebourgess @briankrebs Bitwarden has something I really like: ssh agent mode where it asks for confirmation on every key access. So you can have agent forwarding to your server and rest assured that your key is not abused without your knowledge. Most other managers either don't do ssh agent or behave like having all your files in the agent. The one I recommend against is Dashlane. They had some really dumb choices that got me loads of phishing attempts.

    💬 0🔄 0⭐ 1
  • Nov 3, 2026, 12:50 PM

    @thatnateguy @briankrebs been hearing a lot about Keepass, but what's stopping me is that I have to self host it. How are you handling it? On your server?

    Also I agree with @Drarok, BitWarden hasn't been that convenient to use for me.

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 1
  • 💬 0🔄 0⭐ 0
  • Nov 3, 2026, 1:37 PM

    @ebourgess @thatnateguy @briankrebs @Drarok why would you need to self host? for cross device syncing? There are apps based on Keepass, idk about Android ones but Strongbox has been fine on iOS and Apple Silicon. With Strongbox it will sync w icloud if you enable, my partner does that, while I just manually transfer blobs periodically, can use the blob from Strongbox or similar w Keepass on Linux or Windows. I used mSecure in the past but switched when they were bought out.

    💬 1🔄 0⭐ 2
  • 💬 1🔄 0⭐ 1
  • 💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 2
  • Nov 3, 2026, 4:08 PM

    @thatnateguy @ebourgess @briankrebs @Drarok AFAIK KeepassXC is good to go, went Keepass primarily because two nerd friends had years of experience w it. Including one sys admin were they use it at his employer's on mixed Windows and Linux shop. And because Strongbox passed my research phase for iOS as good choice for my partner, who though tech savvy is not an enthusiast, that I'd be fine w using. We backup each other's blobs in addition to private backups.

    💬 0🔄 0⭐ 0
  • Nov 3, 2026, 1:14 PM

    @thatnateguy @ebourgess @briankrebs I went to try keepassxc but they went full slop. There's chipass if you need passkeys and no slop, but I find the passkey architecture overly-complicated. Personally gnome's password/key manager works fine for me.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Nov 3, 2026, 12:33 PM

    @briankrebs Yes, whenever people say to me "you should be using a password manager" my response is:

    "Which one can you recommend which you can *guarantee* [and back this guarantee with cash] is *never* going to be compromised?"

    So far, answer has come there none.

    💬 5🔄 1⭐ 6
  • 💬 0🔄 0⭐ 3
  • Nov 3, 2026, 12:44 PM

    @TimWardCam so what do you do instead? Write them all in a notebook? Reuse the same password everywhere (perhaps with minor changes per site)?

    💬 2🔄 0⭐ 1
  • Nov 3, 2026, 12:54 PM

    @Drarok Not telling you (just in case there's any bad guys reading this).

    The only password I'm aware of using for multiple sites is the one I used for aviation sites - NOTAMs, weather, that sort of thing. This is all public information - the only reason for logging in is so that there's a audit trail for the accident investigators, to show that you did actually do your flight preparation properly.

    💬 0🔄 0⭐ 1
  • 💬 1🔄 1⭐ 2
  • Nov 3, 2026, 1:13 PM

    @briankrebs @Drarok It can still be compromised. Which needs:

    * someone breaks into your house
    * they're bright enough to be aware of the concept of passwords[#]
    * they find one tiny notebook somewhere in an entire house
    * they decode whatever obfuscation you've used to write things down[*]
    * they also steal your phone so that they can access things with 2FA
    * they hack your accounts before you realise you've been burgled and do something about the important ones.

    Not all these steps are hard, but not all of them are easy.

    [#] The last burglars we had left US $20 bills scattered on the floor, apparently not recognising that these were "money".

    [*] For example, and this isn't how I do mine, words underlined in pencil in a long out of date O'Reilly PERL manual on a bookshelf with dozens of other long out of date O'Reilly manuals.

    💬 2🔄 1⭐ 3
  • Nov 3, 2026, 1:14 PM

    @TimWardCam nonsense – I need passwords outside of the house so would have to carry it everywhere. Inconvenient and incredibly risky.

    💬 2🔄 0⭐ 2
  • Nov 3, 2026, 1:18 PM

    @Drarok I don't use passwords outside of the house, other than a few I remember and a few my phone knows. I might take a note of the Netflix password with me in case I want to watch on someone else's telly, which doesn't already have an account, but that's about the only one.

    This did once cause a minor irritation when I needed to pay someone online whilst we were away from home for a few weeks ... easily solved by getting my wife to do the paying for me, as she actually remembers enough passwords for that!

    💬 1🔄 0⭐ 3
  • 💬 2🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Nov 3, 2026, 1:31 PM

    @bob_zim @Drarok I think it's individual apps, not the phone itself.

    Which can do really, really, stupid things.

    Like the AA app, which you don't use from one decade to the next - and then your car breaks down so you fire it up. And it wants you to re-enter your password because you haven't used the app for a year. FFS.

    💬 0🔄 0⭐ 1
  • AnneHannehargreaves@ioc.exchange
    Nov 3, 2026, 1:24 PM

    @Drarok @TimWardCam Depends on individual use case. Eg an elderly person who doesn't travel about much & finds password managers confusing or untrustworthy is better off with a password book.

    💬 0🔄 0⭐ 3
  • 💬 0🔄 0⭐ 1
  • 💬 1🔄 0⭐ 2
  • 💬 0🔄 0⭐ 1
  • Nov 3, 2026, 12:53 PM

    This is the truth, but not the right question. Every secured system ever wil at some point be compromised. Like a castle wall, you need a second line of defenses, and damage control.

    💬 0🔄 0⭐ 0
  • Nov 3, 2026, 1:59 PM

    @TimWardCam @briankrebs You have to calculate the risk. The risk of a password manager being attacked and all your passwords being compromised is never 0. But it's way lower than the risk of you reusing passwords or using easy to guess passwords.
    People brush their teeth. Is the risk of doing that a guaranteed 0? No. Is it still better than not doing it? By far.

    💬 0🔄 0⭐ 3
  • Nov 3, 2026, 1:02 PM

    @briankrebs Don't these things use asymmetric key encryption? So that even the developers can't unlock your secure storage? Or do they have some kind of master-key decrpyt, so that customers who lose their own password can beg the company to unlock it?

    In the end, is there any safe and reliable way to delegate management of private data, if you don't understand the principles of security?

    💬 2🔄 0⭐ 1
  • Nov 3, 2026, 1:07 PM

    @8r3n7 Not sure about the answer to your question about their setup. When I see alerts like this, my mind goes back to the LastPass breach, where they didn't even tell people to change stuff in their vaults, which were encrypted but nevertheless stolen. 10-12 months later, when the account takeovers happened and crypto accounts of LastPass users started getting drained, experts figured out the thieves had cracked some of the vaults by brute-forcing the master password, b/c they had offline copies of the vaults and could try password attempts ad nauseum.

    💬 0🔄 1⭐ 0
  • Nov 3, 2026, 1:29 PM

    @8r3n7 @briankrebs Most password managers don’t use asymmetric encryption. Instead, they use symmetric encryption with a key derived via a time-expensive (and ideally memory-expensive) hash like PBKDF2 or Argon.

    💬 0🔄 0⭐ 1
  • Nov 3, 2026, 1:20 PM

    @briankrebs I have been a 1password user for years. I have been happy with it and I like that it can integrate easily with Fastmail masked
    email addresses.

    I use the shared vaults and service accounts to confine credentials to contexts, probably not typical usage, I use apple's Passwords to share streaming service credentials with my family and use rules to rely PINs to my email 😂

    Four people get those OTPs; my partner my ex-wife, and my kids 😅

    💬 0🔄 0⭐ 1
  • 💬 0🔄 0⭐ 1
  • Nov 3, 2026, 2:30 PM

    @briankrebs I wish they had provided some additional information, i.e. impacted OSes, whether this is related to their own synchronization, etc. With a ton of passwords, it would be a monumental task to change all of them!

    💬 0🔄 0⭐ 1
  • Nov 3, 2026, 3:14 PM

    @briankrebs If you have a limited number of accounts or devices, I can see a way of a digital life being safe without a password manager.

    💬 0🔄 0⭐ 1
  • Nov 3, 2026, 7:20 PM

    @briankrebs Yes,🤔mSeven Software has provided no details about what system was targeted, how long the incident lasted, or whether vault data was actually exposed.🤦🏼Users are facing the daunting task of triaging hundreds of records and should assume a worst-case scenario and treat stored data as potentially compromised. :ablobcateyeroll: #Infosec

    💬 0🔄 1⭐ 0