Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass RCE vulnerability fixed

bugs.chromium.org

Post reply on HN
Print view View original

131–140 of 188 posts

Re: LastPass RCE vulnerability fixed

#131

Post by Semaphor »

chrisper wrote: post #128
russell_h wrote: post #127

Earlier quoted context omitted.

Autofill requires a browser extension. There are at least three major risks associated with this: 1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passp…

I don't think this is true. Keepass can do autofill without a browser extension. Or are we talking about a different feature?

Keepass can't? It can fill upon request with Ctrl+V which does [TAB][Enter], but to automatically fill passwords you need the http plugin for keepass and a browser extension.

Re: LastPass RCE vulnerability fixed

#133

Post by daveFNbuck »

gfsadhfsd wrote: post #126
gfsadhfsd wrote: post #123

Earlier quoted context omitted.

Flat text file on an encrypted volume. I use cat or vi for editing, and grep for reading. If it's ultrasensitive, I keep it on a non-networked device and type it in. Otherwise, normally, I grep and copy/paste from terminal to password field. I do security for a living. This technique is mocked by other so-called experts, but who's laughing today? I fully understand the security model I'm using. Lastpass users--and de…

If it's really ultrasensitive, it's 12+ character random ASCII string committed to muscle memory only. No horse battery stapling bullshit.

A 6-word diceware passphrase has more entropy than 12 characters of ASCII and is easier to memorize. In what way is that bullshit?

Re: LastPass RCE vulnerability fixed

#134

Post by kevhito »

gfsadhfsd wrote: post #126
gfsadhfsd wrote: post #123

Earlier quoted context omitted.

Flat text file on an encrypted volume. I use cat or vi for editing, and grep for reading. If it's ultrasensitive, I keep it on a non-networked device and type it in. Otherwise, normally, I grep and copy/paste from terminal to password field. I do security for a living. This technique is mocked by other so-called experts, but who's laughing today? I fully understand the security model I'm using. Lastpass users--and de…

If it's really ultrasensitive, it's 12+ character random ASCII string committed to muscle memory only. No horse battery stapling bullshit.

Please don't give security advice unless you know what you are talking about. It just spreads misinformation.

Re: LastPass RCE vulnerability fixed

#135

Post by gfsadhfsd »

daveFNbuck wrote: post #133
gfsadhfsd wrote: post #126

Earlier quoted context omitted.

If it's really ultrasensitive, it's 12+ character random ASCII string committed to muscle memory only. No horse battery stapling bullshit.

A 6-word diceware passphrase has more entropy than 12 characters of ASCII and is easier to memorize. In what way is that bullshit?

Nope.

94^12 ~= 4.76e23 > 7776^6 ~= 2.21e23.

And typing 12 characters from muscle memory is faster than learning and typing "limbdumaslaterjuramondohalf", which is what diceware^6 just gave me.

The supposed mnemonic value of diceware is illusory. If it convinces people to use stronger passwords and it works for you, great.

Re: LastPass RCE vulnerability fixed

#136

Post by daveFNbuck »

gfsadhfsd wrote: post #135
daveFNbuck wrote: post #133

Earlier quoted context omitted.

A 6-word diceware passphrase has more entropy than 12 characters of ASCII and is easier to memorize. In what way is that bullshit?

Nope. 94^12 ~= 4.76e23 > 7776^6 ~= 2.21e23. And typing 12 characters from muscle memory is faster than learning and typing "limbdumaslaterjuramondohalf", which is what diceware^6 just gave me. The supposed mnemonic value of diceware is illusory. If it convinces people to use stronger passwords and it works for you, great.

You're right, I misremembered the number of rolls for diceware. I guess your passwords have an extra bit over mine. How many 12+ character passwords are you able to memorize? How long does it take you to learn a new/changed one?

Re: LastPass RCE vulnerability fixed

#137

Post by [deleted] »

gfsadhfsd wrote: post #135
daveFNbuck wrote: post #133

Earlier quoted context omitted.

A 6-word diceware passphrase has more entropy than 12 characters of ASCII and is easier to memorize. In what way is that bullshit?

Nope. 94^12 ~= 4.76e23 > 7776^6 ~= 2.21e23. And typing 12 characters from muscle memory is faster than learning and typing "limbdumaslaterjuramondohalf", which is what diceware^6 just gave me. The supposed mnemonic value of diceware is illusory. If it convinces people to use stronger passwords and it works for you, great.

[deleted]

Re: LastPass RCE vulnerability fixed

#138

Post by gfsadhfsd »

daveFNbuck wrote: post #136
gfsadhfsd wrote: post #135

Earlier quoted context omitted.

Nope. 94^12 ~= 4.76e23 > 7776^6 ~= 2.21e23. And typing 12 characters from muscle memory is faster than learning and typing "limbdumaslaterjuramondohalf", which is what diceware^6 just gave me. The supposed mnemonic value of diceware is illusory. If it convinces people to use stronger passwords and it works for you, great.

You're right, I misremembered the number of rolls for diceware. I guess your passwords have an extra bit over mine. How many 12+ character passwords are you able to memorize? How long does it take you to learn a new/changed one?

> How many 12+ character passwords are you able to memorize?

As I need to enter on a regular basis. In practice, no more than half a dozen. Usually I have 3 or 4 in use. Might be work, personal, and a couple for crypto.

> How long does it take you to learn a new/changed one?

Depending on the length, 5-10 minutes of continuous training to be confident if it's one I'm going to put into immediate use.

The point is to go straight to pure muscle memory without using a mnemonic crutch. Ultimately for a password that you're typing on a multiple-times daily basis, you're going to be relying on muscle memory anyway. If you're trying to remember what came after the correct horse battery, or if the correct came first or last, you've already lost. "limbdumaslaterjuramondo" gets me no closer to login if my password is "limbdumaslaterjuramondohalf" if I've forgotten nonsensical "half" than "+D%W}B_]7|~y" gets me to login if my password is "+D%W}B_]7|~yd" and I've forgotten "d".

You're going to be typing the password with your fingers, so learn the password by typing it with your fingers until it's automatic, not by conjuring a sequence of unconnected mental images. It actually saves time.

Re: LastPass RCE vulnerability fixed

#139

Post by gfsadhfsd »

kevhito wrote: post #134
gfsadhfsd wrote: post #126

Earlier quoted context omitted.

If it's really ultrasensitive, it's 12+ character random ASCII string committed to muscle memory only. No horse battery stapling bullshit.

Please don't give security advice unless you know what you are talking about. It just spreads misinformation.

Please elucidate.

Misinformation like, "Always use a reputable cloud password manager, like LastPass?" Along with a trusty antivirus, am I right?

To be further contrarian, if the common man is going to use a password manager, use Chrome's built-in auto-fill, without antivirus or other 3rd-party bolt-ons, be they LastPass, KeepPass, 1password etc. You know who Tavis works for, right? Chrome's application security is best of breed, and its password manager does what it's designed for, at least.

Re: LastPass RCE vulnerability fixed

#140

Post by DaniloDias »

tcbawo wrote: post #116
mcbutterbunz wrote: post #106

Earlier quoted context omitted.

I would suggest not using the auto fill feature of password managers. I use 1Password and the mini UI that sits in the tray is super easy to copy a password from and paste in the browser.

Why not use auto fill? I consider that a decent defense against phishing attempts. Now I always think twice before entering my name and password.

Select view source on a page where credentials are auto populated. See your password.

Now imagine you stepped away from your machine while still logged in.

Autofill is convenient, but there are negative consequences.

Post reply on HN