OneLogin: Breach Exposed Ability to Decrypt Data

OneLogin, an online service that lets users manage logins to sites and apps from a single platform, says it has suffered a security breach in which customer data was compromised, including the ability to decrypt encrypted data.

Source: https://krebsonsecurity.com/2017/06/one ... rypt-data/

This is indeed a very nasty situation.

No website is ever 100% secure, we hear reports of "secure" sites having their data compromised every day. So why anyone would use one to hold their login credentials for multiple sites and/or devices, is quite honestly beyond me.

Security I'm afraid is by necessity inconvenient, and in attempting to reduce that inconvenience, all that usually happens is that the security gets compromised.

Unfortunately the industry appears to be loosing the "Convenience vs Security" battle. Folks will inherently choose convenience, only sporadically shaken to action by stories such as these.

The question is, how do we effectively keep the the necessity of security in peoples minds while avoiding the associated progressive desensitization?

It is unfortunate, but there is no way to protect a computer from its greatest threat... the end user. There will always be users who will choose a password such as "123456" or "password," or their last name or birthday. They are the same folks who, no matter how many times they've been warned not to do it, just can't bear to pass up a chance to click on a link that will take them to a free site where they can download a screensaver of dancing pigs or flying monkeys.

Point these people to a site that promises it will allow them to "safely and securely" store all their passwords in the mythical cloud universe and they will flock to it.