Light

Episode #822 Quiz

Extrinsic Password Managers
Date: 2021-06-08 | Length: 2 hrs | Episode page at twit.tv

About this episode

The episode argues security is fundamentally compromised by complex, feature-heavy systems, then reviews Firefox’s background Windows updater, HTTPS-upgrading in Edge and Firefox, and ransomware examples. Colonial Pipeline likely fell via reused VPN credentials without MFA. It also notes GitHub’s stricter exploit-code policy, WordPress plugin auto-patching, and password-manager design tradeoffs.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what change did Firefox 90 beta introduce for Windows users who do not regularly launch the browser?

Question 1

According to the episode, what change did Firefox 90 beta introduce for Windows users who do not regularly launch the browser?

It will require a full browser restart before downloading any update It will only check for updates when the browser is actively open It will check for updates every seven hours when Firefox is not running It will disable update checks unless a user manually visits About Firefox

Question 2: How did Microsoft Edge 92's Automatic HTTPS feature decide when to upgrade an HTTP navigation, according to the episode?

Question 2

How did Microsoft Edge 92's Automatic HTTPS feature decide when to upgrade an HTTP navigation, according to the episode?

It upgraded only on domains Microsoft had analyzed as highly likely to support HTTPS It upgraded every HTTP navigation unconditionally to prevent any cleartext traffic It upgraded only after a site published an HSTS header for one full year It upgraded only after the user manually approved every first-time site visit

Question 3: What did the episode identify as the likely breach path for Colonial Pipeline's VPN access?

Question 3

What did the episode identify as the likely breach path for Colonial Pipeline's VPN access?

A reused password on an unused VPN account that lacked multifactor authentication A malicious update pushed through the VPN vendor's software update channel A stolen smart card used to authenticate a privileged remote admin session A zero-day in the company's perimeter firewall that exposed the VPN service

Question 4: What explanation did Steve give for how the FBI ended up with DarkSide's bitcoins?

Question 4

What explanation did Steve give for how the FBI ended up with DarkSide's bitcoins?

He said the FBI seized the coins by exploiting a flaw in the Bitcoin protocol itself He said the coins were recovered by brute-forcing the ransom address from the public ledger He concluded the FBI decrypted the bitcoin wallet by breaking the private key cryptography He suspected political pressure forced DarkSide to transfer funds to an FBI-controlled wallet

Question 5: What was Steve's main reason for preferring an extrinsic password manager over a browser-intrinsic one?

Question 5

What was Steve's main reason for preferring an extrinsic password manager over a browser-intrinsic one?

He believed browser password managers cannot generate random passwords at all He wanted to move freely among browsers without being locked into one ecosystem He wanted passwords copied only through the clipboard to increase portability He thought browser password managers were always more secure than third-party tools

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.