News for hackers. Stuff that matters.

A comment on I Lost All Faith in LastPass. Parent comment

Re:I Lost All Faith in LastPass by pentest_bob on Thursday December 29, 2022 @02:28PM (#34176784)
Not dismissing anything you said regarding 1PW but they also had cure53 audits. See e.g.

- https://cure53.de/pentest-report_1password-b5.pdf

- https://cure53.de/pentest-report_1password-mobile.pdf

Edit: overview of audits https://support.1password.com/security-assessments/

[ Parent | on HN ]
Re:I Lost All Faith in LastPass by acatton on Thursday December 29, 2022 @02:40PM (#34176932)
These are pen-tests and black-box security audits. While they're definitely better than nothing, and they would show that their security is better than LastPass', the code was never audited.
[ Parent | on HN ]
Re:I Lost All Faith in LastPass by bendiksolheim on Thursday December 29, 2022 @04:43PM (#34178428)
Are we reading the same reports? At least the two latest reports by Cure53 mentions "source code audit". In addition, the audits by ISE and AppSec explicitly mentions code review as part of the audit.

I am in no way familiar with these kinds of reports, but does this not mean that (at least parts of) the source code was audited?

[ Parent | on HN ]