Use www.dnsmadeeasy.com and then dns.he.net as your secondary dns service or vice-versa. They will do transfers/updates from each other and work just fine.
It doesn't always require root privileges...for instance if some program (wireshark) changes the permissions on your loopback. There are other questions there but I'll probably dig into it later.
The thing I guess I would say bothers me about your post is you just say well, if a person gets access to a machine it is basically all over which isn't necessarily the case. Even if they get root access we don't want to make it easy, right? Thats why we encrypt databases or in certain cases storage at rest so even if the hacker has root access it is sure going to be hard.
1Password can never absolutely protect against an attack when an attacker has root. But they can make it harder then just dumping out lo0. Level of effort does account for something.
Thank you for responding. The reason I wrote this up is not to let people oh my god the world is ending but to let them know, hey if you are using the browser extension there is clear text passwords being sent over the loopback, if you don't like that then don't use their extensions.
You have made very well informed arguments about how hard it is to protect if someone has access to your machine, specifically elevated. But the argument to me seems kind of like "well, it's hard to protect against then so we just decided to not do anything at all." It seems like one other password manager company did something, so why wouldn't you?
Can you explain why it would require a pairing request every time? Couldn't you just pair it once and then be done with it? Can you explain the other approaches?
So I work in information security and I'll tell you i haven't seen good standards around this. In some places IT people regularly look at emails or web traffic, which i think is wrong.
When I go into a company I make sure we put a policy in place that to review an employees emails / web traffic / devices we need to have Legal and HR sign off on it unless the person being investigated is part of one of those groups then it is one group and an executive.
This covers me from legal/HR fallout and it covers the employees because they know we aren't just sneaking around looking at their stuff, it creates trust.
That cannot be true or you could never do proper security or investigations. How would you know if an employee machine was compromised if you absolutely cannot read their internet traffic? Sometimes you actually have to dump traffic an analyze it with wireshark to figure out something is wrong.
That is actually pretty hilarious....I wonder if they grabbed it because of potential issues with the name or mainly because of mistypes.
We grabbed quite a few names due to people misspelling the domain so we could direct them to the proper site, never really cared about the <name>sucks.com stuff.
You equate a site trying to compensate themselves by showing you an AD you should be seeing for viewing their content with someone creating a program that maliciously alters your computer and can take control of it? Seriously? Would you like to retract that statement as hyperbole or are you still wanting to stand by it?
Always on scrubbing has a number of factors depending on the provider you use. All charge for clean traffic but some charge for number of netblocks/ASNs, number of routers, number of attacks mitigated, etc. It can get extremely expensive depending on your traffic needs and all the other variables. Paying an extra $250,000+ year for 2 Gb/s of traffic is extremely expensive to me.
Cloudflare is a WAF/Proxy that can handle DDoS, it isn't a DDoS specific product. If your actual network space is getting hit (e.g. 8.8.8.8) cloudflare will not help you.
It however does meet the requirement I have which is a lightning port which means I'll probably buy it bump and all. Being able to see the juice left from IOS is also an excellent feature.
tl:dr Used cloudflare for DNS and Level3/Blacklotus for network filtering.
In DDoS attacks you have three models:
On-Prem: Buy hardware and big fat internet pipes to filter traffic (expensive / time \ resrouce intensive)
Hybrid: On-Prem devices that can mitigate X/Mbps and then starts announcing your routes after X to their cloud scrubbing centers which can filter it at a much higher capacity (best option)
Cloud: Full on filtering by a provider where all your traffic goes through their scrubbing centers full time (usually adds latency, extremely expensive)
The hybrid model is the best and what most companies are going to as it allows you to filter smaller attacks out with little cost as well as scaling up to large 100 Gb/s+ attacks without having to buy massive amounts of hardware/transit.
Seriously I don't think you really understand the implications here or you aren't taking them seriously, if you did you sure wouldn't be talking about this so nonchalantly. You should seriously shut this down before you get some young programmers/admins fired or worse.
Also from your FAQ what the hell is "strong level encryption", can you not name it? Can you go into the extreme technical details of what encryption you are using, how data is protected in memory and at rest?
You are giving all your bash history to a third party, that is incredibly scary and if you can't see the security implications then you need to rethink your product.