Heads up: A password management app/platform called Msecure from mSeven Software says it recently learned of suspicious activity associated with its app. Here is the important part of their advisory:
"Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys."
There isn't much else to the notice. I've pasted the entire thing below anyway.
"Important Security Notice
mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.
Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.
We regret any inconvenience that this may cause.
Sincerely,
The mSeven Software Team"
@briankrebs Don't these things use asymmetric key encryption? So that even the developers can't unlock your secure storage? Or do they have some kind of master-key decrpyt, so that customers who lose their own password can beg the company to unlock it?
In the end, is there any safe and reliable way to delegate management of private data, if you don't understand the principles of security?