Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass RCE vulnerability fixed

bugs.chromium.org

Post reply on HN
Print view View original

61–70 of 188 posts

Re: LastPass RCE vulnerability fixed

#61

Post by enoch_r »

eli wrote: post #51
Sir_Cmpwn wrote: post #45

Earlier quoted context omitted.

I can't help you with #4, but I've been a pass user for a long time: https://www.passwordstore.org/ It encrypts your passwords with your GPG key and stores them in a git repository. You can of course easily extend this to do a lot of different things. I also wrote this tool for automating password rotation: https://github.com/SirCMpwn/pass-rotate

It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.

I haven't used this (pass works fine for my use case), but Gopass was on HN a bit ago:

https://www.justwatch.com/blog/post/announcing-gopass/

One of the claimed features is "multiple stores: Combine several work teams and your private store!"

Re: LastPass RCE vulnerability fixed

#62

Post by droopybuns »

>>Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations.

COMMENT OF THE DECADE.

If you think that lastpass should be embarrassed based on what Tavis has written, maybe consider taking a lit criticism class.

There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that people stopped focusing exclusively on the quality of his discoveries and started to ask if his behavior is one we want to implement.

For all of project zero's bullshit on 90 day disclosure policies- there is clearly a different set of rules for Android. There is obvious internal discussion on the topic. Please be skeptical of Tavis' framing of what's going on. He's not projecting the personality of a sympathetic person.

Re: LastPass RCE vulnerability fixed

#63

Post by Veratyr »

xxkylexx wrote: post #22
Veratyr wrote: post #19

Earlier quoted context omitted.

I'm not the lead developer (or involved with the project at all) and I also recommend it. Only issues I have right now are: - No app-fill on Android. - No auto-fill (have to manually click the icon and select an account). - When using Firefox the extension periodically logs out for no apparent reason. - There's no address/wallet stuff so I actually have to pull out my credit cards. Other than that it works pretty wel…

- We released app-fill (autofill) on android last month. Make sure you are using version 1.3.0 or greater. Read more here: https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill... - We also fixed the issue you are referring to on Firefox last week. Make sure you are using 1.10.1 - There are plans for additional "wallet" features in the future.

Woo! I just got app-fill working.

To be clear though, app-fill and auto-fill were referring to different things. What I meant by lack of "auto-fill" was that when I visit a website on desktop, my details aren't instantly filled when the page loads. I have to manually click the extension icon in my browser and select the account I want.

Re: LastPass RCE vulnerability fixed

#64

Post by problems »

bluedonuts wrote: post #35

Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.

KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.

Re: LastPass RCE vulnerability fixed

#65

Post by joshschreuder »

The test page is still vulnerable for me.

https://lock.cmpxchg8b.com/SaiGhij5/lastpass.html

  Chrome 57.0.2987.110 (64-bit)
  Version: 4.1.42
  Built: Thu Mar 09 2017 12:40:16 GMT-0500 (EST)
  Binary Component: true (Native Messaging version 4.1.34, built Jan 11 2017 01:45:24)
Any idea why? I thought no user action was required? No custom error message for NXDOMAIN (I think?), I see the Lastpass site, then calc.exe opens.

https://twitter.com/LastPass/status/844176201392504834

Re: LastPass RCE vulnerability fixed

#66

Post by problems »

svenfaw wrote: post #9
emn13 wrote: post #6

I've got to say, this attack looks a little too obvious; that doesn't reflect well on lastpass.

The high number of vulnerabilities that keep being found in LastPass (including some that are not publicly disclosed) forced me to jump ship a while ago.

Agreed - I was tolerant for quite a while as the vulnerabilities seemed obscure and the handling seemed good, but they kept cropping up in more and more obvious ways. When KeePass got a crypto upgrade recently I jumped ship. I loved LastPass for the sync, but SyncThing to my phone has made it all too easy to get away without it.

Re: LastPass RCE vulnerability fixed

#68

Post by username223 »

Is it just me, or are these "cloud password managers" a terrible idea given the typical person's threat model? First, there are hackers looking to score a huge pile of accounts. Second, there could be a relatively unsophisticated person with a grudge, like an ex-partner. In a distant third, there are nation-state-level actors.

If I keep a local encrypted password file and copy it around by hand, I may have some vulnerabilities, but it's not worth a hacker's time to steal only my accounts, and I can probably protect my credentials from casual malice. On the other hand, if I put my passwords on the same service as hundreds of thousands of other people, that's a huge jackpot that attracts significant hacking interest, and the service only has to screw up once. The risk doesn't seem worth the convenience.

Re: LastPass RCE vulnerability fixed

#69

Post by dsacco »

awirth wrote: post #57
dsacco wrote: post #16

Earlier quoted context omitted.

One of the best vulnerability researchers in the world right now. Tavis Ormandy is a spectre of doom. He is one of the last people you want to see tweeting about your company. Every member of Google's Project Zero team is individually more capable and productive than entire teams of consultants at the best security firms.

This is a bit disingenuous. It's almost impossible to measure the output of the other teams/consultants because their reports are never made public. I wish that we had more opportunities available for researchers to do the work that Tavis is doing. He is very very good and highly productive, but he's not somehow orders of magnitude better at his research than others. The thing that makes him unique is that Google is…

You make a fair point, but I don't think it's an argument against what I'm saying. If for no other reason than what you stated about being paid for such open goals, he certainly is more productive than most consulting teams. And given his practice and experience at that sort of productivity, he's likely more capable as well.

I agree that security consulting results should be more open, but incentives are not really aligned for that to be the case.

Re: LastPass RCE vulnerability fixed

#70

Post by fencepost »

Veratyr wrote: post #63
xxkylexx wrote: post #22

Earlier quoted context omitted.

- We released app-fill (autofill) on android last month. Make sure you are using version 1.3.0 or greater. Read more here: https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill... - We also fixed the issue you are referring to on Firefox last week. Make sure you are using 1.10.1 - There are plans for additional "wallet" features in the future.

Woo! I just got app-fill working. To be clear though, app-fill and auto-fill were referring to different things. What I meant by lack of "auto-fill" was that when I visit a website on desktop, my details aren't instantly filled when the page loads. I have to manually click the extension icon in my browser and select the account I want.

This is not always a bad thing. Sometimes you don't want software to automatically plunk your login credentials into appropriately named fields on a JavaScript driven web page
Post reply on HN