<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 4/18/2024 4:19 PM, Richard Schafer
via E-trademarks wrote:<br>
</div>
<blockquote type="cite"
cite="mid:SA1PR05MB7983EBA7C854CB37080E91628E0E2@SA1PR05MB7983.namprd05.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator"
content="Microsoft Word 15 (filtered medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face
{font-family:"Calibri Light";
panose-1:2 15 3 2 2 2 4 3 2 4;}@font-face
{font-family:"Palatino Linotype";
panose-1:2 4 5 2 5 5 5 3 3 4;}@font-face
{font-family:Aptos;}@font-face
{font-family:"Goudy Old Style";
panose-1:2 2 5 2 5 3 5 2 3 3;}@font-face
{font-family:Garamond;
panose-1:2 2 4 4 3 3 1 1 8 3;}@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}@font-face
{font-family:Webdings;
panose-1:5 3 1 2 1 5 9 6 7 3;}@font-face
{font-family:"Iskoola Pota";}@font-face
{font-family:"DellaRobbia BT";}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Goudy Old Style",serif;
color:#993366;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1"><span
style="font-family:"Goudy Old Style",serif;color:#993366">But
at my previous law firm, the chief security officer had (and I
think still has) a firm rule prohibiting the use of password
manager software as unsafe because of the risk that someone
might be able to break the password vault maintained by the
software. I vigorously disagreed, citing NIST and others, but
was unable to convince him. I don’t know how widespread that
opinion is.</span></div>
</blockquote>
<p>Keep in mind that Lastpass got compromised. That was what forced
me to migrate away from Lastpass. Now I am using Bitwarden. The
person in charge of security is not wrong to give thought to this.<br>
</p>
<p>I have decided that the way to go is this. First, turn on 2FA on
every site that I care about to the slightest extent.</p>
<p>Second, don't entrust the 2FA to the same manager as the one to
which I entrust the passwords. (Bitwarden offers to do both tasks
and I actively chose not to say "yes" to that.)</p>
<p>I entrust my 2FA secrets to WinAuth.</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
</body>
</html>