51–60 of 69 posts
Earlier quoted context omitted.
Prefix the command with a space and bash won't save it in its history.
This doesn't seem to be true in 4.3.42, at least not by default. " echo test" shows up in both the output of the 'history' builtin and in ~/.bash_history. Is it an option that needs to be set?
Earlier quoted context omitted.
I'm assuming by the same mechanism that offers to save previously-entered passwords. It's always sniffing anything you type into a password field.
How would it know it's a password field and not just some text input box that uses * characters?
LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012: https://code.google.com/p/chromium/issues/detail?id=39511 We do a lot to try to protect our usage of viewports using iframes, but it's not good enough and we'll figure out a way to do better. LastPass has generally told people to u…
Sean here: the mitigation you speak of (notifying the user that they've typed in their master password) is actually another vulnerability. A malicious page can detect the fact that LastPass put that notification, and then it knows exactly what your master password is without even contacting LastPass. I've told your security team about this but haven't yet received a response.
Earlier quoted context omitted.
This doesn't seem to be true in 4.3.42, at least not by default. " echo test" shows up in both the output of the 'history' builtin and in ~/.bash_history. Is it an option that needs to be set?
Yes, you need to have HISTCONTROL=ignorespace option in your .bashrc
# don't put duplicate lines or lines starting with space in the history.
# See bash(1) for more options
HISTCONTROL=ignoreboth
Earlier quoted context omitted.
>the reality is that it's no different than using 1Password with sync enabled. Except that a users LastPass vault lives in the "cloud" so that a compromise of that password can likely open the door and makes it a more enticing target to begin with. Compared the likely hood of merely getting at the 1password vault (assuming it's not synced to the cloud) being a significant barrier. Again, for me this discussion is edu…
> I'm curious how having this data in the cloud could ever be considered more secure than local storage It's not, I didn't mean to give that impression. It increases your attack surface, which is a tradeoff that 99.99% of users are happy to make for the convenience of having instant and strongly secured access to all of their passwords from anywhere. I meant to point out that this is no different than how the vast ma…
I use 1pass too and would never consider storing passwords in the cloud, let alone on Dropbox.
Earlier quoted context omitted.
Sean here: the mitigation you speak of (notifying the user that they've typed in their master password) is actually another vulnerability. A malicious page can detect the fact that LastPass put that notification, and then it knows exactly what your master password is without even contacting LastPass. I've told your security team about this but haven't yet received a response.
Not great, but at that point they don't get your two factor token at least.
I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors imp…
What do you do on pages that require / forbid special characters and require / forbid length >8 characters?
I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors imp…
sounds like one shall pass: https://oneshallpass.com/
I like that 1SP is open source. One could download it and add complexity to it! But to use the 'standard' version is a risk.
LastPass has pushed Google for years to give us a way to avoid using the browser viewport: infobars was a solution to this issue -- you can see one of my pleas for it back in January 2012: https://code.google.com/p/chromium/issues/detail?id=39511 We do a lot to try to protect our usage of viewports using iframes, but it's not good enough and we'll figure out a way to do better. LastPass has generally told people to u…
Sean here: the mitigation you speak of (notifying the user that they've typed in their master password) is actually another vulnerability. A malicious page can detect the fact that LastPass put that notification, and then it knows exactly what your master password is without even contacting LastPass. I've told your security team about this but haven't yet received a response.
Also even multifactor now must be new location verified so the ability to exploit this is now extremely low. Any attempt utilize those credentials will be blocked an email will be generated just like what happened in the non-multifactor case.
Hopefully you've gained enough attention for the chrome issue: https://code.google.com/p/chromium/issues/detail?id=453093 to be implemented sooner rather than later, if you could do me a favor and follow it to keep the pressure on Google to help mitigate phishing risk we'd appreciate it.