LastPass: design flaw in communication to privileged components • Hacker News Board

Re: LastPass: design flaw in communication to privileged components

#21

Post by coderdude » Thu, Jul 28, 2016, 4:16 AM UTC

bqe wrote: post #3

mentat wrote: post #2

Agree with the comment that the blogger doesn't understand what phishing is. This could be done against a huge number of people through various approaches with ad network code or targeted attacks controlling path to internet. That's all setting aside how trivial it would be for nation states.

They have a history of trying to explain away their security problems as not really their fault. That alone should give any LastPass user pause.

>They have a history of trying to explain away their security problems as not really their fault.

I feel like I'm reading some person's pet Wikipedia page. If they do then at least give some examples. You can't just say damning things and expect everyone to take it at face value.

Re: LastPass: design flaw in communication to privileged components

#22

Post by nitrogen » Thu, Jul 28, 2016, 4:33 AM UTC

tonmoy wrote: post #17

EGreg wrote: post #14

Earlier quoted context omitted.

I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password. In fact, I'd go further and say that you can do this with your login name. So for example: myemail+by@gmail.com for eBaY This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your i…

This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.

I imagine password cracking apps are also smart enough to try letters from the site domain combined with other known base passwords (dictionary words, common substrings from other password leaks, etc.).

Re: LastPass: design flaw in communication to privileged components

#23

Post by ploxiln » Thu, Jul 28, 2016, 4:39 AM UTC

kevin_thibedeau wrote: post #5

Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.

Password managers exchange too many strong secrets to remember, for one strong secret you can remember.

You just have to turn off any automatic / integration features. I do. Unlock with master password for every use. Really, how often is that, since most sites keep you logged in? Just a couple times a day for me.

Re: LastPass: design flaw in communication to privileged components

#24

Post by jessaustin » Thu, Jul 28, 2016, 4:45 AM UTC

mintplant wrote: post #9

cottsak wrote: post #8

This is not the same as https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi... is it?

No, the two disclosures just happened to come at the same time.

Wow, a bad day for them. Two different awful bugs on the front page.

Re: LastPass: design flaw in communication to privileged components

#25

Post by adevine » Thu, Jul 28, 2016, 4:49 AM UTC

ploxiln wrote: post #23

kevin_thibedeau wrote: post #5

Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.

Password managers exchange too many strong secrets to remember, for one strong secret you can remember. You just have to turn off any automatic / integration features. I do. Unlock with master password for every use. Really, how often is that, since most sites keep you logged in? Just a couple times a day for me.

Ugh, seriously? I think the vast majority of people wouldn't use a password manager if it were that difficult to use, especially on mobile where typing a truly secure password with different casing and special chars is a PITA. Getting a phone with a fingerprint scanner to unlock my password manager has been the mobile feature that has had the most valuable impact on me in the past couple years.

Re: LastPass: design flaw in communication to privileged components

#26

Post by justinludwig » Thu, Jul 28, 2016, 4:50 AM UTC

EGreg wrote: post #18

tonmoy wrote: post #17

Earlier quoted context omitted.

This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.

Do you realize that your AWS account can be compromised without something like this?

Using different usernames/emails for different services is not a bad idea (particularly as a defense against untargeted attacks). But using a simple algorithm for generating passwords (ie pretty much any algorithm a human can remember) is playing with fire -- if an attacker can recover your generated passwords from just a few different services (via lucky crack from a db dump, or some site stored or transmitted or logged it in plaintext, or you were phished, or you created an account to try out someone's random mvp on a slapdash server that was already pwnd, etc), a human attacker will be able to figure out your username/password for all of your services. (And if we're not there already, it won't be too long before automated password crackers can do the same.)

Plus, from a practical standpoint, what do you do when a site forces you to change your password because they fear their password db has been compromised (or has asinine rules about your password being too long, or make you rotate your password every 90 days, or they change their domain name 5 times in 3 years)?

Re: LastPass: design flaw in communication to privileged components

#27

Post by JumpCrisscross » Thu, Jul 28, 2016, 5:11 AM UTC

Has LastPass ever subjected their code to a proper, outside security audit in a form tptacek would endorse?

Re: LastPass: design flaw in communication to privileged components

#28

Post by mikkom » Thu, Jul 28, 2016, 5:28 AM UTC

So this post says

> We have verified that intercepting messages via the method you suggested is possible and is a problem. We have also verified it only affects firefox (chrome, ie, safari, opera, etc do not use the window for message passing in the same manner) and doesn't affect our primary addons.mozilla.org firefox download (which is still 3.0 version).

It seems latest version for windows is 4.1.20a? As I'm both linux and firefox user and there have been 2 password stealing exploits revealed I would very much like to know if this affects me (my version seems to be 3.3.1). Is there any version history that I could check or does anyone know what versions are affected by these 2 exploits?

Re: LastPass: design flaw in communication to privileged components

#29

Post by geofft » Thu, Jul 28, 2016, 5:39 AM UTC

pfg wrote: post #7

kevin_thibedeau wrote: post #5

Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.

Just about any scenario I can think of where the attacker could get to "what you have", by which I assume you mean the unencrypted password database (i.e. what you have after you entered something you know , since the whole point of a password manager is to have one strong password that you need to remember, instead of tens or hundreds probably-not-so-strong individual passwords), would also be a game-over scenario i…

Yes, exactly. I have never understood the prevalence of threat models of the form "if an attacker gets full, unrestricted access to my running session, they still won't be able to ..." or "if an attacker gets me to run code, they won't figure out ...". They make no sense, unless the attacker is stupid.

To be fair, there are a lot of script kiddies in the world.

Re: LastPass: design flaw in communication to privileged components

#30

Post by mitchell209 » Thu, Jul 28, 2016, 5:50 AM UTC

adevine wrote: post #25

ploxiln wrote: post #23

Earlier quoted context omitted.

Password managers exchange too many strong secrets to remember, for one strong secret you can remember. You just have to turn off any automatic / integration features. I do. Unlock with master password for every use. Really, how often is that, since most sites keep you logged in? Just a couple times a day for me.

Ugh, seriously? I think the vast majority of people wouldn't use a password manager if it were that difficult to use, especially on mobile where typing a truly secure password with different casing and special chars is a PITA. Getting a phone with a fingerprint scanner to unlock my password manager has been the mobile feature that has had the most valuable impact on me in the past couple years.

Even though I use 1Password, I used to use weak passwords on some accounts I frequently had to sign in to because I couldn't stand typing my master password in to my iPhone every time I wanted to open it. Finger print unlocking means I can use significantly stronger passwords for almost everything with little trouble now. That feature has been invaluable to me. Probably one of the most important mobile features ever, for me.