Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Phishing attack against Lastpass

seancassidy.me

Post reply on HN
Print view View original

21–30 of 69 posts

Re: Phishing attack against Lastpass

#21

Post by chrisfosterelli »

redwards510 wrote: post #20

This is amazing not just for the execution, but the plain simplicity of it. Could you get around this by always clicking on the browser bar LastPass button when you want to login? I've noticed LastPass will often log out seemingly at random. This is supposed to be determined by a combination of your settings like "only allow one IP logged in at a time", which would log you out if you switched on your VPN for instance…

Yes, clicking on the button in the browser's task bar would foil this phishing attack.

Re: Phishing attack against Lastpass

#22

Post by redwards510 »

chrisfosterelli wrote: post #18
infinitelurker wrote: post #15

Earlier quoted context omitted.

This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud. https://www.blackhat.com/eu-15/briefings.html#even-the-lastp... https://blog.lastpass.com/2015/06/lastpass-security-notice.h... I've been very happy with 1password, runs locally can be synced directly to other devices. https://agilebits.com/onepassword Does anyone…

I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons: 1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords. 2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerab…

I think you may be wrong about #3. The author argues that anyone with 2factor turned on will NOT receive email notification, and I'm not sure what you mean by geographic restriction. You can disallow Tor IPs but that is about it.

Re: Phishing attack against Lastpass

#23

Post by chrisfosterelli »

redwards510 wrote: post #22
chrisfosterelli wrote: post #18

Earlier quoted context omitted.

I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons: 1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords. 2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerab…

I think you may be wrong about #3. The author argues that anyone with 2factor turned on will NOT receive email notification, and I'm not sure what you mean by geographic restriction. You can disallow Tor IPs but that is about it.

Sorry, you're right that 2FA accounts will not receive the email. I've updated my comment.

In addition to the TOR IP block, you can also restrict it to only allow access from select countries. This is what I meant by geographic restriction.

Re: Phishing attack against Lastpass

#24

Post by userbinator »

https://www.seancassidy.me/images/lastpass_login.png"> src="/images/lostpass_login.png"

I clicked on the thumbnail to examine it more closely, and was briefly confused, then amused that it pointed to the real one.

I think this quite nicely shows why hiding the URL scheme is NOT a good idea; otherwise it would show this, which is far more obvious to indicate that the page is either from the extension or not:

    http://chrome-extension.pw/:/...
    chrome-extension://...
Ironically, it wasn't that long ago when browser designers thought completely hiding the URL bar was a good idea.

Re: Phishing attack against Lastpass

#25

Post by pwman »

LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012: https://code.google.com/p/chromium/issues/detail?id=39511

We do a lot to try to protect our usage of viewports using iframes, but it's not good enough and we'll figure out a way to do better. LastPass has generally told people to use the extension directly to login as it's more secure, we'll need to go further here as well.

Sean was clever using http://chrome-extension.pw which looks close -- but LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake, mitigating this a great deal. This has existed for a long time before Sean's report and we did not implement as a response to Sean's bug report -- we implemented it as a general way for people to know about password resuse and to be notified of being phished.

Making this practical is a lot tougher than email phishing -- you really need an XSS on a page that people use to login, and unlike email phishing it is immediately caught.

Re: Phishing attack against Lastpass

#27

Post by scrollaway »

bikamonki wrote: post #10
greggarious wrote: post #8

Earlier quoted context omitted.

Still, that's just one password. Do you use this one password for all your accounts, or as input to a password manager? Or are you just manually copying and pasting this one super good hash into all your accounts? :/

Different phrases->hashes for each vendor. The brain can easily remember what short phrase corresponds to what vendor.

Up until one of the vendor's databases leaks on the internet and we find out their passwords were stored in cleartext.

Re: Phishing attack against Lastpass

#28

Post by subsection1h »

bikamonki wrote: post #10
greggarious wrote: post #8

Earlier quoted context omitted.

Still, that's just one password. Do you use this one password for all your accounts, or as input to a password manager? Or are you just manually copying and pasting this one super good hash into all your accounts? :/

Different phrases->hashes for each vendor. The brain can easily remember what short phrase corresponds to what vendor.

I assume you have hundreds of accounts like I and most people I know have. If you can recall hundreds of passphrases, including passphrases for accounts that you don't access for several years, and you can continue recalling these hundreds of passphrases even while changing them regularly, how else are you making use of your exceptional memory? Just curious.

Re: Phishing attack against Lastpass

#29

Post by infinitelurker »

chrisfosterelli wrote: post #18
infinitelurker wrote: post #15

Earlier quoted context omitted.

This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud. https://www.blackhat.com/eu-15/briefings.html#even-the-lastp... https://blog.lastpass.com/2015/06/lastpass-security-notice.h... I've been very happy with 1password, runs locally can be synced directly to other devices. https://agilebits.com/onepassword Does anyone…

I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons: 1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords. 2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerab…

Thanks for the link to the 1password compromise, although, I stand by my point, that compromise is due to extraneous features as opposed to the core functionality. Being conservative myself, that's not a feature I use.

I see 1password's main vulnerability being that someone could gaining access to a device and vault passcode or obtaining that passcode through a keylogger.

I'm not sure how difficult it would be to brute force into 1Password locally but either way it's a low benefit game compared to the potential access with a compromise to a cloud based scenario like LastPass.

But I'm always open to security advice...

Re: Phishing attack against Lastpass

#30

Post by bikamonki »

subsection1h wrote: post #28
bikamonki wrote: post #10

Earlier quoted context omitted.

Different phrases->hashes for each vendor. The brain can easily remember what short phrase corresponds to what vendor.

I assume you have hundreds of accounts like I and most people I know have. If you can recall hundreds of passphrases, including passphrases for accounts that you don't access for several years, and you can continue recalling these hundreds of passphrases even while changing them regularly, how else are you making use of your exceptional memory? Just curious.

I wish I had an exceptional memory ;)

Only 4-5 accounts require a strong password. The rest I don't care, I use the same password or request a reset every time I go back.

Post reply on HN