MSeven your lack of transparency surrounding this security breach is concerning
S
Scott
ha iniziato un argomento
circa 4 ore fa
I have more than 15 years into this platform, your lack of information says we all need to be looking elsewhere.
What exactly was stolen? Were individual encrypted customer vaults acquired, or was this a separate customer-account database? Please identify the categories of information contained in the stolen database, including any unencrypted customer metadata.
Can the stolen database be subjected to offline attacks against customers' master passwords? mSecure's security architecture reportedly requires a locally generated 46-character Account Key. Was this Account Key, or any equivalent cryptographic material capable of facilitating decryption, accessible to the unauthorized actor? Can mSeven confirm that the stolen database cannot be decrypted without each customer's unique Account Key?
What security benefit does changing the master password provide following this incident? Does changing the master password generate new encryption keys and re-encrypt the entire vault, or does it merely change how the existing encryption key is protected? Since the attacker already possesses a copy of the encrypted database, how would changing the master password protect that previously acquired copy?
How did the unauthorized actor acquire the database, and what evidence confirms the intrusion has been contained? Please provide the known timeline of the intrusion, discovery, containment, and remediation. Has an independent cybersecurity firm verified that the attacker's access has been terminated and that no additional systems or cryptographic materials were compromised?
Your repeated assertion that mSeven has "no evidence" of unauthorized access to the confidential information does not establish that the stolen database cannot be decrypted.
Please distinguish between what has been independently verified, what remains under investigation, and what mSeven is merely assuming based on its encryption architecture.
Given the sensitivity of the information customers have entrusted to mSecure, I would appreciate specific technical answers rather than generalized reassurances.
Scott
I have more than 15 years into this platform, your lack of information says we all need to be looking elsewhere.
What exactly was stolen? Were individual encrypted customer vaults acquired, or was this a separate customer-account database? Please identify the categories of information contained in the stolen database, including any unencrypted customer metadata.
Can the stolen database be subjected to offline attacks against customers' master passwords? mSecure's security architecture reportedly requires a locally generated 46-character Account Key. Was this Account Key, or any equivalent cryptographic material capable of facilitating decryption, accessible to the unauthorized actor? Can mSeven confirm that the stolen database cannot be decrypted without each customer's unique Account Key?
What security benefit does changing the master password provide following this incident? Does changing the master password generate new encryption keys and re-encrypt the entire vault, or does it merely change how the existing encryption key is protected? Since the attacker already possesses a copy of the encrypted database, how would changing the master password protect that previously acquired copy?
How did the unauthorized actor acquire the database, and what evidence confirms the intrusion has been contained? Please provide the known timeline of the intrusion, discovery, containment, and remediation. Has an independent cybersecurity firm verified that the attacker's access has been terminated and that no additional systems or cryptographic materials were compromised?
Your repeated assertion that mSeven has "no evidence" of unauthorized access to the confidential information does not establish that the stolen database cannot be decrypted.
Please distinguish between what has been independently verified, what remains under investigation, and what mSeven is merely assuming based on its encryption architecture.
Given the sensitivity of the information customers have entrusted to mSecure, I would appreciate specific technical answers rather than generalized reassurances.