LastPass RCE vulnerability fixed • Hacker News Board

Re: LastPass RCE vulnerability fixed

#101

Post by ktta » Wed, Mar 22, 2017, 2:56 AM UTC

problems wrote: post #92

ktta wrote: post #89

Earlier quoted context omitted.

I would suggest KeePassXC, which in my opinion, looks better since uses Qt rather than mono so has a more native feel. https://keepassxc.org/

I would not suggest this as KeePassXC does not support the new KDBX4 format with the upgraded cryptography - only the old Keepass format which relies on a custom AES-based key derivation function, which I cannot in good faith recommend. Once it's implemented I may reconsider, but for now at least, I'd shy away from it. https://github.com/keepassxreboot/keepassxc/issues/148

Thanks for the info!

Edit: Looks like it's close

https://github.com/keepassx/keepassx/pull/200#issuecomment-2...

Re: LastPass RCE vulnerability fixed

#102

Post by balladeer » Wed, Mar 22, 2017, 3:12 AM UTC

ktta wrote: post #89

problems wrote: post #64

Earlier quoted context omitted.

KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.

I would suggest KeePassXC, which in my opinion, looks better since uses Qt rather than mono so has a more native feel. https://keepassxc.org/

For OSX I have been using this native app MacPass - http://mstarke.github.io/MacPass. Actively developed from what I see on Github.

Re: LastPass RCE vulnerability fixed

#103

Post by martin1975 » Wed, Mar 22, 2017, 3:15 AM UTC

Exuma wrote: post #25

blakesterz wrote: post #17

This made me laugh: "They also said they couldn't get my exploit to work, but I checked my apache access logs and they were using a Mac. Naturally, calc.exe will not appear on a Mac."

That is honestly embarrassing. I'm glad I don't use LastPass.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

Re: LastPass RCE vulnerability fixed

#104

Post by EuAndreh » Wed, Mar 22, 2017, 3:21 AM UTC

ktta wrote: post #89

problems wrote: post #64

Earlier quoted context omitted.

KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.

I would suggest KeePassXC, which in my opinion, looks better since uses Qt rather than mono so has a more native feel. https://keepassxc.org/

Re: LastPass RCE vulnerability fixed

#105

Post by winteriscoming » Wed, Mar 22, 2017, 3:27 AM UTC

droopybuns wrote: post #62

>>Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations. COMMENT OF THE DECADE. If you think that lastpass should be embarrassed based on what Tavis has written, maybe consider taking a lit criticism class. There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that peo…

>> There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that people stopped focusing exclusively on the quality of his discoveries and started to ask if his behavior is one we want to implement.

I have seen many security bugs reported by Tavis show up here on HN. I haven't seen Tavis behave poorly in either explaining these issues or reviewing the fixes. On the contrary, his comments in the issue discussions have almost always given a benefit of doubt to the product and its developers when it comes to the way they have handled the security issues.

Re: LastPass RCE vulnerability fixed

#106

Post by mcbutterbunz » Wed, Mar 22, 2017, 3:29 AM UTC

martin1975 wrote: post #103

Exuma wrote: post #25

Earlier quoted context omitted.

That is honestly embarrassing. I'm glad I don't use LastPass.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

I would suggest not using the auto fill feature of password managers. I use 1Password and the mini UI that sits in the tray is super easy to copy a password from and paste in the browser.

Re: LastPass RCE vulnerability fixed

#107

Post by nsm » Wed, Mar 22, 2017, 3:32 AM UTC

moyix wrote: post #43

marksomnian wrote: post #42

Earlier quoted context omitted.

Not sure about point 2, but 1Password seems to fit all the others. Really like it, personally.

1Password didn't support Linux last time I checked. There are 3rd party libraries, but most of them don't support the newer keychain format. I still use it and just look up the password on my phone when I'm on a Linux system.

1password has their opvault format spec on the website and https://github.com/OblivionCloudControl/opvault can decrypt. Admittedly the UX is lacking.

Re: LastPass RCE vulnerability fixed

#108

Post by stryk » Wed, Mar 22, 2017, 3:40 AM UTC

xxkylexx wrote: post #30

devopsproject wrote: post #27

Earlier quoted context omitted.

How are you making money off of this?

bitwarden is currently sponsored by the Microsoft BizSpark program which covers many of our operation costs and allows us to offer services for free to our users. We are working to introduce enterprise features for businesses in the future (scheduled for release next month) which will allow us to monetize. In the meantime, everything is free for users.

Which of the current free-for-everyone features, if any, are you considering making available to paid accounts only? (i.e., what will your current free users lose unless they move to a paid account once you monetize?)

Re: LastPass RCE vulnerability fixed

#109

Post by moyix » Wed, Mar 22, 2017, 3:41 AM UTC

nsm wrote: post #107

moyix wrote: post #43

Earlier quoted context omitted.

1Password didn't support Linux last time I checked. There are 3rd party libraries, but most of them don't support the newer keychain format. I still use it and just look up the password on my phone when I'm on a Linux system.

1password has their opvault format spec on the website and https://github.com/OblivionCloudControl/opvault can decrypt. Admittedly the UX is lacking.

I've tried that library, actually. Last time I used it, it couldn't find some passwords in the vault, including (crucially) the one I use for SSO at work. It's totally possible I was just using it wrong – it would be nice if the repository had a demo command line tool or something.

Re: LastPass RCE vulnerability fixed

#110

Post by mdekkers » Wed, Mar 22, 2017, 4:04 AM UTC

droopybuns wrote: post #62

>>Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations. COMMENT OF THE DECADE. If you think that lastpass should be embarrassed based on what Tavis has written, maybe consider taking a lit criticism class. There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that peo…

Tavis has a documented track record of poor interpersonal behavior. It's time that people stopped focusing exclusively on the quality of his discoveries and started to ask if his behavior is one we want to implement.

Given what he does, the quality of his discoveries are really the only important thing. Do you really think that "form over function" is important in the context of what he does?