Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass RCE vulnerability fixed

bugs.chromium.org

Post reply on HN
Print view View original

51–60 of 188 posts

Re: LastPass RCE vulnerability fixed

#51

Post by eli »

Sir_Cmpwn wrote: post #45
bluedonuts wrote: post #35

Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.

I can't help you with #4, but I've been a pass user for a long time: https://www.passwordstore.org/ It encrypts your passwords with your GPG key and stores them in a git repository. You can of course easily extend this to do a lot of different things. I also wrote this tool for automating password rotation: https://github.com/SirCMpwn/pass-rotate

It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.

Re: LastPass RCE vulnerability fixed

#52

Post by Sir_Cmpwn »

eli wrote: post #51
Sir_Cmpwn wrote: post #45

Earlier quoted context omitted.

I can't help you with #4, but I've been a pass user for a long time: https://www.passwordstore.org/ It encrypts your passwords with your GPG key and stores them in a git repository. You can of course easily extend this to do a lot of different things. I also wrote this tool for automating password rotation: https://github.com/SirCMpwn/pass-rotate

It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.

It's probably an afternoon project to get that functionality. Since it's just a git repo, that much is easily shared. GPG supports encrypting messages for multiple recepients. Since pass is simple and open source it should be quite easy to add what you need. Send your patches upstream, I'm sure that others would find them useful too!

Re: LastPass RCE vulnerability fixed

#53

Post by elastic_church »

Exuma wrote: post #25
blakesterz wrote: post #17

This made me laugh: "They also said they couldn't get my exploit to work, but I checked my apache access logs and they were using a Mac. Naturally, calc.exe will not appear on a Mac."

That is honestly embarrassing. I'm glad I don't use LastPass.

My girlfriend was wondering why programmers are so pedantic, and my primary response was "because they can never be wrong", and as a corollary it becomes important to always be right and develop a culture that points out every flaw in competence.

Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations.

Re: LastPass RCE vulnerability fixed

#54

Post by jessaustin »

wolf550e wrote: post #10
koolba wrote: post #3

Looks like this was discovered by the same guy that discovered CloudFail. That dude is amazing.

Look at all his bugs: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

I'll bookmark this for the next time someone recommends AV of any sort...

Re: LastPass RCE vulnerability fixed

#55

Post by awirth »

Analemma_ wrote: post #32
mikecb wrote: post #29

Earlier quoted context omitted.

Concern about code quality is legitimate, and vulns discovered is one metric for that, but I worry that hopping to the unreviewed (and therefore lacking vuln disclosures) app is even worse. But I don't use lastpass.

Other managers have been reviewed, and found better success than LastPass. I (finally) signed up for a password manager a little while ago, and after some evaluation chose 1Password. A big part of that decision was that they have been reviewed/audited and there were a couple vulnerabilities found, but they were all minor, which indicates to me the system is pretty secure. The nature of the bugs was also comforting in…

What other ones have been reviewed? I'd be interested to read the audit reports.

Re: LastPass RCE vulnerability fixed

#56

Post by RyJones »

romuloab42 wrote: post #46
wolf550e wrote: post #10

Earlier quoted context omitted.

Look at all his bugs: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

This is golden: https://bugs.chromium.org/p/project-zero/issues/detail?id=69...

Not that I had a high opinion of Trend Micro before, but that series of responses from them is shamefully bad.

Re: LastPass RCE vulnerability fixed

#57

Post by awirth »

dsacco wrote: post #16
koolba wrote: post #3

Looks like this was discovered by the same guy that discovered CloudFail. That dude is amazing.

One of the best vulnerability researchers in the world right now. Tavis Ormandy is a spectre of doom. He is one of the last people you want to see tweeting about your company. Every member of Google's Project Zero team is individually more capable and productive than entire teams of consultants at the best security firms.

This is a bit disingenuous. It's almost impossible to measure the output of the other teams/consultants because their reports are never made public.

I wish that we had more opportunities available for researchers to do the work that Tavis is doing. He is very very good and highly productive, but he's not somehow orders of magnitude better at his research than others. The thing that makes him unique is that Google is paying him a full-time salary just to find bugs and post them publicly. He doesn't have to worry about only targeting stuff in bug bounty scope or working on executive-targeted write-ups and consultation reports to make ends meet.

Basically, he gets paid to spend all day, every day, finding bugs and documenting them for people to see. We need more people in those sorts of positions, but only Google is really able to bankroll it.

Re: LastPass RCE vulnerability fixed

#58

Post by rkeene2 »

eli wrote: post #51
Sir_Cmpwn wrote: post #45

Earlier quoted context omitted.

I can't help you with #4, but I've been a pass user for a long time: https://www.passwordstore.org/ It encrypts your passwords with your GPG key and stores them in a git repository. You can of course easily extend this to do a lot of different things. I also wrote this tool for automating password rotation: https://github.com/SirCMpwn/pass-rotate

It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.

My password manager, hunter2 ( https://chiselapp.com/user/rkeene/repository/hunter2/ ), supports multiple users. Each user is identified by their public key and the DB is a plain text file that can be easily managed in your version control system.

Re: LastPass RCE vulnerability fixed

#59

Post by lazaroclapp »

xbryanx wrote: post #31
svenfaw wrote: post #9

Earlier quoted context omitted.

The high number of vulnerabilities that keep being found in LastPass (including some that are not publicly disclosed) forced me to jump ship a while ago.

It's always worth remembering that using something like LastPass should be compared with the status quo that it often fixes (same password for everything, post-it notes, teams emailing passwords around).

Sure. Which is why Last Pass makes you safer if you use it for the long tail of rarely used non-critical passwords. The problem is once you are using Last Pass for those, it becomes more and more tempting to use it for passwords that actually matter, and for those you really really don't want to be using an online password manager.

In fact, for the average person, I am not sure a post-it note full of passwords in their home is a bigger risk than an online password manager. Sure, if someone breaks into their house they are screwed, and that is a relatively easy attack. But on the other hand, any bulk breach leaves them unaffected. A notebook full of plain text passwords in a drawer in your home and a shared memorized prefix that must be combined with the passwords on the list to get the full password seems strictly more secure than a password manager (although slightly less convenient).

Re: LastPass RCE vulnerability fixed

#60

Post by lucastx »

eli wrote: post #51
Sir_Cmpwn wrote: post #45

Earlier quoted context omitted.

I can't help you with #4, but I've been a pass user for a long time: https://www.passwordstore.org/ It encrypts your passwords with your GPG key and stores them in a git repository. You can of course easily extend this to do a lot of different things. I also wrote this tool for automating password rotation: https://github.com/SirCMpwn/pass-rotate

It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.

Keyringer is a software that does exactly what I think you need, in a similar way than the parent's suggestion (gpg over git):

Keyringer: encrypted and distributed secret sharing software https://keyringer.pw/

Post reply on HN