Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Phishing attack against Lastpass

seancassidy.me

Post reply on HN
Print view View original

41–50 of 69 posts

Re: Phishing attack against Lastpass

#41

Post by komaromy »

bqe wrote: post #39
pwman wrote: post #25

LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012: https://code.google.com/p/chromium/issues/detail?id=39511 We do a lot to try to protect our usage of viewports using iframes, but it's not good enough and we'll figure out a way to do better. LastPass has generally told people to u…

Sean here: the mitigation you speak of (notifying the user that they've typed in their master password) is actually another vulnerability. A malicious page can detect the fact that LastPass put that notification, and then it knows exactly what your master password is without even contacting LastPass. I've told your security team about this but haven't yet received a response.

Sending the notification still seems like a better idea than not doing it. If a page has gotten you to enter the password at all then it's pretty likely that it knows the significance before the notification.

Re: Phishing attack against Lastpass

#42

Post by DrScump »

jnevill wrote: post #2

This is of the devil. It needs to be burned with fire and the ashes should be sunk in the Mariana trench and the trench should be filled with dirt that has been cursed by a witch that was formerly dead but was reanimated by Cthulhu and then rekilled, burned with fire, and buried on the opposite side of the earth. Everything here is usual phishing stuff, but that Chrome-Extension.pw url is disturbing combined with the…

Digging it out from the bottom of the Marianas Trench only to rebury it in an inferior location (from an accessibility standpoint) seems counterproductive.

Re: Phishing attack against Lastpass

#43

Post by DrScump »

subsection1h wrote: post #28
bikamonki wrote: post #10

Earlier quoted context omitted.

Different phrases->hashes for each vendor. The brain can easily remember what short phrase corresponds to what vendor.

I assume you have hundreds of accounts like I and most people I know have. If you can recall hundreds of passphrases, including passphrases for accounts that you don't access for several years, and you can continue recalling these hundreds of passphrases even while changing them regularly, how else are you making use of your exceptional memory? Just curious.

I make a record of them shrouded in a mnemonic that I can figure out but that would be useless to a stranger.

Re: Phishing attack against Lastpass

#44

Post by Sophira »

veddan wrote: post #17
DyslexicAtheist wrote: post #14

Earlier quoted context omitted.

have been tinkering with this idea also something like *echo -n 'my unique passphrase' |sha512sum* only issue is this shows up in your memory and on disk (e.g. .bash_history)

Prefix the command with a space and bash won't save it in its history.

This doesn't seem to be true in 4.3.42, at least not by default. " echo test" shows up in both the output of the 'history' builtin and in ~/.bash_history.

Is it an option that needs to be set?

Re: Phishing attack against Lastpass

#45

Post by level3 »

komaromy wrote: post #41
bqe wrote: post #39

Earlier quoted context omitted.

Sean here: the mitigation you speak of (notifying the user that they've typed in their master password) is actually another vulnerability. A malicious page can detect the fact that LastPass put that notification, and then it knows exactly what your master password is without even contacting LastPass. I've told your security team about this but haven't yet received a response.

Sending the notification still seems like a better idea than not doing it. If a page has gotten you to enter the password at all then it's pretty likely that it knows the significance before the notification.

But does the page even need to get you to enter it? Could it be possible to set up a hidden password field for LastPass to monitor, and then run a dictionary attack in the background, waiting for the notification?

(I don't use LastPass, so I don't know anything about how this feature is designed.)

Re: Phishing attack against Lastpass

#46

Post by kobayashi »

delhanty wrote: post #16

I have 1Password on Mac and the 1Password Chrome extension. But for typing my master password in, I always use the Mac application. That's because I'm worried that the Chrome extension might be vulnerable.

Are you running a 1Password version <5.0? In 1Password 5 AgileBits added 1Password mini, which is a small helper app running in the background. The point of this is to say that one no longer enters passwords into the extension - toggling the extension merely brings up 1Password mini, which is where passwords are entered. Once the 1P mini is unlocked, it then enters the relevant login info into the browser (by using the extension's functionality, all of which is transparent to the user.

Re: Phishing attack against Lastpass

#47

Post by TwoBit »

willidiots wrote: post #37
DrewHintz wrote: post #32

Earlier quoted context omitted.

> LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake Interesting! How does it do this?

I'm assuming by the same mechanism that offers to save previously-entered passwords. It's always sniffing anything you type into a password field.

How would it know it's a password field and not just some text input box that uses * characters?

Re: Phishing attack against Lastpass

#48

Post by EGreg »

This is also an attack that is possible against MacOS and Windows. My app can make the screen "go dark" or throw up an Apple-looking password prompt.

As I kept saying (and once emailed Steve Jobs about) the way to properly handle this is:

1. Establish a secret phrase or icon when the account is created, that the user can recognize

2. Show it in the iframe when the user places their keyboard focus into the password field

3. Do not allow outside code to grab it -- in browsers, use the cross domain security model, in MacOS use the anti-DRM preventing screenshotting a certain window.

Now, it's true that on the web, the secret phrase or icon has to depend on the user already having a session they've logged into. This authentication prevents an attacker from simply getting the secret phrase or icon.

Re: Phishing attack against Lastpass

#49

Post by TwoBit »

vosper wrote: post #5

Woah, this is scary. I'll need to look closely at LastPass alternatives (perhaps something that runs separately from the browser, even if it's a little more clunky to use than LastPass's integration).

For sites that really matter, don't use lastpass or any system other than memory or a written down hint system.

Re: Phishing attack against Lastpass

#50

Post by nfm »

pwman wrote: post #25

LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012: https://code.google.com/p/chromium/issues/detail?id=39511 We do a lot to try to protect our usage of viewports using iframes, but it's not good enough and we'll figure out a way to do better. LastPass has generally told people to u…

For what it's worth, I'd definitely prefer logins from new devices to require an email confirmation when 2FA is enabled.
Post reply on HN