Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass RCE vulnerability fixed

bugs.chromium.org

Post reply on HN
Print view View original

121–130 of 188 posts

Re: LastPass RCE vulnerability fixed

#121

Post by will_hughes »

megous wrote: post #115
giovannibajo1 wrote: post #85

Earlier quoted context omitted.

There are endless online services which only allow one user per logical account. In fact I would say the majority of them do it.

So why not create multiple accounts? ToS usually advises against sharing credentials.

Because sometimes you're trying to manage a single resource.

eg I know some phone/sms services that only let one account manage a phone number or something.

Also, sometimes account licences are absurdly expensive.

There's some services that even though we have (say) 50 licenced users, they also want us to have licences for each admin. We're not spending $50k/year just so we can each login once or twice a year to fix/configure something for someone.

Re: LastPass RCE vulnerability fixed

#122

Post by donatj »

martin1975 wrote: post #103
Exuma wrote: post #25

Earlier quoted context omitted.

That is honestly embarrassing. I'm glad I don't use LastPass.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

The killer android support is why I still use it. Auto fill in any app.

Re: LastPass RCE vulnerability fixed

#123

Post by gfsadhfsd »

bluedonuts wrote: post #35

Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.

Flat text file on an encrypted volume. I use cat or vi for editing, and grep for reading. If it's ultrasensitive, I keep it on a non-networked device and type it in. Otherwise, normally, I grep and copy/paste from terminal to password field.

I do security for a living. This technique is mocked by other so-called experts, but who's laughing today? I fully understand the security model I'm using. Lastpass users--and developers--clearly did not. Other password manager users should stifle the urge to laugh if they haven't fully reviewed their entire stack.

Re: LastPass RCE vulnerability fixed

#124

Post by problems »

peak_body_yo wrote: post #100
problems wrote: post #64

Earlier quoted context omitted.

KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.

> Argon2 KDF and ChaCha20 as a cipher Are these a huge improvement from what was offered previously?

Before they were using a custom AES-based key derivation function which had not been strongly peer reviewed so Argon2 is a big improvement there in my book.

ChaCha20 over the existing AES-CBC... not as much, I feel more comfortable in that it's harder to screw up the implementation of it, but that's about it. CBC mode especially can have unexpected side effects unless used very carefully, ChaCha20 or any other strong stream cipher, even AES in CTR mode is somewhat easier to understand the side effects of.

So overall, not concretely in terms of known vulnerabilities, but in terms of predicted risks, I'd say certainly. Before this change I was erring on the side of known algorithms with solutions like LastPass at least using standardized PBKDF2. With this change, KeePass went behind or middle of the pack, cryptographically compared to competition, to the frontrunner.

Re: LastPass RCE vulnerability fixed

#125

Post by gfsadhfsd »

gfsadhfsd wrote: post #123
bluedonuts wrote: post #35

Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.

Flat text file on an encrypted volume. I use cat or vi for editing, and grep for reading. If it's ultrasensitive, I keep it on a non-networked device and type it in. Otherwise, normally, I grep and copy/paste from terminal to password field. I do security for a living. This technique is mocked by other so-called experts, but who's laughing today? I fully understand the security model I'm using. Lastpass users--and de…

Also, I do not keep the encrypted volume in the cloud. It's only on my trusted device. If it's important enough to secure the password, it's important enough to bring the device.

Further, I've used variations of the same password for the past two decades for >90% of my accounts, e.g., the ones where my threat model is "do not give a fuck." When I sign up, I mentally consider whether I give a fuck the account is compromised. If I do, new random password for the list. If I don't, use the 20-year-old password.

Re: LastPass RCE vulnerability fixed

#126

Post by gfsadhfsd »

gfsadhfsd wrote: post #123
bluedonuts wrote: post #35

Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.

Flat text file on an encrypted volume. I use cat or vi for editing, and grep for reading. If it's ultrasensitive, I keep it on a non-networked device and type it in. Otherwise, normally, I grep and copy/paste from terminal to password field. I do security for a living. This technique is mocked by other so-called experts, but who's laughing today? I fully understand the security model I'm using. Lastpass users--and de…

If it's really ultrasensitive, it's 12+ character random ASCII string committed to muscle memory only. No horse battery stapling bullshit.

Re: LastPass RCE vulnerability fixed

#127

Post by russell_h »

tcbawo wrote: post #116
mcbutterbunz wrote: post #106

Earlier quoted context omitted.

I would suggest not using the auto fill feature of password managers. I use 1Password and the mini UI that sits in the tray is super easy to copy a password from and paste in the browser.

Why not use auto fill? I consider that a decent defense against phishing attempts. Now I always think twice before entering my name and password.

Autofill requires a browser extension. There are at least three major risks associated with this:

1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passphrase. Other extensions may be able to emulate this behavior or otherwise intercept your passphrase.

Anyone who isn't using a password manager should do so. A password manager with autofill is a huge step forward from nothing. But disabling autofill offers some further benefit.

Re: LastPass RCE vulnerability fixed

#128

Post by chrisper »

russell_h wrote: post #127
tcbawo wrote: post #116

Earlier quoted context omitted.

Why not use auto fill? I consider that a decent defense against phishing attempts. Now I always think twice before entering my name and password.

Autofill requires a browser extension. There are at least three major risks associated with this: 1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passp…

I don't think this is true. Keepass can do autofill without a browser extension. Or are we talking about a different feature?

Re: LastPass RCE vulnerability fixed

#129

Post by chrisper »

donatj wrote: post #122
martin1975 wrote: post #103

Earlier quoted context omitted.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

The killer android support is why I still use it. Auto fill in any app.

You can do that with keepass2android as well.

Re: LastPass RCE vulnerability fixed

#130

Post by problems »

EuAndreh wrote: post #104
ktta wrote: post #89

Earlier quoted context omitted.

I would suggest KeePassXC, which in my opinion, looks better since uses Qt rather than mono so has a more native feel. https://keepassxc.org/

See also KeeWeb[0]. Also mutiplatform as KeePassXC, built on Electron. Even though it is built on JavaScript, it has 0 dependencies[1]. And the author responds well on external feedback/contributions[2]. It does support KDBX4[3]. [0]: https://keeweb.info/ [1]: https://github.com/keeweb/keeweb/blob/c651343f80f4f3d41c7d64... [2]: https://github.com/keeweb/keeweb/issues/104 [3]: https://github.com/keeweb/keeweb/issues/3…

> 0 dependencies

If bundling your devDependencies at compile time counts as "0 dependencies", nothing has any dependencies. In this case, the whole thing's built on electron - all of chrome's rendering engine is quite the dependency. The uncompressed Windows version is 137 MB on disk. Fatter than most any app should be.

Post reply on HN