Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass RCE vulnerability fixed

bugs.chromium.org

Post reply on HN
Print view View original

81–90 of 188 posts

Re: LastPass RCE vulnerability fixed

#81

Post by megous »

eli wrote: post #51
Sir_Cmpwn wrote: post #45

Earlier quoted context omitted.

I can't help you with #4, but I've been a pass user for a long time: https://www.passwordstore.org/ It encrypts your passwords with your GPG key and stores them in a git repository. You can of course easily extend this to do a lot of different things. I also wrote this tool for automating password rotation: https://github.com/SirCMpwn/pass-rotate

It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.

Isn't sharing passwords a bad thing to do in general? Each user should have a separate account/identity and manage his own secrets.

Re: LastPass RCE vulnerability fixed

#82

Post by UnoriginalGuy »

larsnystrom wrote: post #14
svenfaw wrote: post #9

Earlier quoted context omitted.

The high number of vulnerabilities that keep being found in LastPass (including some that are not publicly disclosed) forced me to jump ship a while ago.

Can you please provide some references to the "high number of vulnerabilities"? I've only heard of one or two, but those were promptly fixed.

They cannot because it is a fictional claim.

I've just been researching it and most of the recent vulnerabilities (before this one) have been either minor in severity or "working as intended" (like saving your master password and using PIN unlock, which they warn you is insecure, and relies on device encryption to protect your master password).

Today's issue is by far the most serious in at least the last year.

Re: LastPass RCE vulnerability fixed

#83

Post by UnoriginalGuy »

wsinks wrote: post #80
UnoriginalGuy wrote: post #78

Earlier quoted context omitted.

As soon as you put a Keepass encrypted database onto any cloud service (e.g. DropBox, Google Drive, etc) you've effectively just recreated LastPass. Both use an AES-256 encrypted database encrypted using a master password which is first hashed using a modern/slow hashing algorithm. Obviously it is imperfect that the LastPass plugin has bugs in it; and I won't defend that. But I will say that the convenience is worth…

One click password rotation! I had no idea.

It is neat but only on a select list of popular sites, you can see the list at the bottom of this page:

https://helpdesk.lastpass.com/generating-a-password/#h2

Re: LastPass RCE vulnerability fixed

#84

Post by ktta »

Strom wrote: post #75
droopybuns wrote: post #62

>>Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations. COMMENT OF THE DECADE. If you think that lastpass should be embarrassed based on what Tavis has written, maybe consider taking a lit criticism class. There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that peo…

It's not like Tavis is creating these bugs. He's merely pointing out that the emperor has no clothes. Quite a socially awkward situation for town folk who've been living as if the clothes are wonderful. Additionally, in general and as is the case here, the bugs aren't in some nice kid's hobby project. It's not like he's pointing out that grandma's blog has XSS vulnerabilities. These are security products, which often…

I don't think I'd call them a 'sham'. They're not advertising something they don't do. I think they do everything that they say they do[1]. If this was a case where someone was able to get plaintext passwords from lastpass's server, you'd be right.

The first thing I think people should realize is that there are vulnerabilities in every software, and addressing that fact goes a long way. I doubt that they weren't following standards, and they do have a good track record of security although they get flak for being a extension based password manager (which is a very bad idea, something I've come to realize not long ago. I think it was at the time of lastpass's last vulnerability[2])

If you don't mind, I'm interested in know what you'd consider products with 'strong security'?

[1]:https://www.lastpass.com/how-it-works

[2]:https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...

Re: LastPass RCE vulnerability fixed

#85

Post by giovannibajo1 »

megous wrote: post #81
eli wrote: post #51

Earlier quoted context omitted.

It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.

Isn't sharing passwords a bad thing to do in general? Each user should have a separate account/identity and manage his own secrets.

There are endless online services which only allow one user per logical account. In fact I would say the majority of them do it.

Re: LastPass RCE vulnerability fixed

#86

Post by snowwrestler »

problems wrote: post #64
bluedonuts wrote: post #35

Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.

KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.

Which mobile app do you use with KeePass? I use MiniKeePass and am pretty happy with it.

Re: LastPass RCE vulnerability fixed

#87

Post by ktta »

sp332 wrote: post #50

Update: another vulnerability found, not patched yet. https://mobile.twitter.com/taviso/status/844312124541186048

Well. This is not a good week for lastpass.

And for all the users of password managers which use a browser extension or a cloud synced database, KeepPassXC[1] is a good alternative, because it won't come close to touching your browser or any remote server. It is cross platform so you have no excuse. It also has a mobile app which is not made by the same developers but a different company so I would be wary of the app.

[1]:https://keepassxc.org/

Re: LastPass RCE vulnerability fixed

#88

Post by ktta »

snowwrestler wrote: post #86
problems wrote: post #64

Earlier quoted context omitted.

KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.

Which mobile app do you use with KeePass? I use MiniKeePass and am pretty happy with it.

I'm not the user you replied to, but that app looks like the only good app, atleast for iOS.

Re: LastPass RCE vulnerability fixed

#89

Post by ktta »

problems wrote: post #64
bluedonuts wrote: post #35

Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.

KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.

I would suggest KeePassXC, which in my opinion, looks better since uses Qt rather than mono so has a more native feel.

https://keepassxc.org/

Re: LastPass RCE vulnerability fixed

#90

Post by paultopia »

romuloab42 wrote: post #46
wolf550e wrote: post #10

Earlier quoted context omitted.

Look at all his bugs: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

This is golden: https://bugs.chromium.org/p/project-zero/issues/detail?id=69...

OMG. Arbitrary code execution just from visiting a URL, and dump all the passwords?
Post reply on HN