[gabdpipi]

It’s not just cryptography when a developers password manager gets compromised and all, the hacker is “in”.

If it’s secured by a hardware key, they need to have the key physically.

Two step could work as well with the proper Authenticator.

[OhMeadhbh]

IPCMSes make it somewhat easy to MitM SMS. If your system poops a cookie in the wrong place it doesn't matter if the secret is in someone's head or if it's in a hardware dongle, like you say... the hacker is "in".

My recommendation for bad guys is to not attack the part of the system where it is strong. Just sniff around a bit until you find the weak part and attack that.

Also remember most devs couldn't use a static analysis tool to save their lives (which is why mythos is relevant.) I suspect that a 15 year old copy of Fortify or CoVerity could find bugs mythos missed.

And if that doesn't work, just start scanning github repos for entropy. That's where the credentials that were accidentally published live.

[gabdpipi]

Yeah that’s fair. It’s only as secure as the weakest link.

That was one of the promises of wasm was sandboxing npm packages independently. Not sure what happened with that or not but I’d be curious to know now we’ve had a lot of recent supply-chain publicity.

For example, if every fetched module is sandboxed and even if they got compromised there would be more protection. It would be more “when” not “if” the package is compromised, nip it in the bud.

But then attackers will target the most exposed packages… :)

Security is hard.