Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass RCE vulnerability fixed

bugs.chromium.org

Post reply on HN
Print view View original

151–160 of 188 posts

Re: LastPass RCE vulnerability fixed

#151

Post by RubyPinch »

AhtiK wrote: post #145
martin1975 wrote: post #103

Earlier quoted context omitted.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

Has anyone used hardware-based password manager like Trezor Password Manager? [1] [2] Initially Trezor was created as a bitcoin wallet but is much more these days. The issue with 1Password is that it's not accessible in Linux and no U2F (yubikey etc) support AFAIK... [1] https://trezor.io/passwords/ [2] https://blog.trezor.io/satoshilabs-launches-trezor-password-...

I've wanted to use such a thing, but the requirement to use a specific browser is always a massive bother

same with things like yubikey

It seems like it would be better to just fake a keyboard output instead? then you could have something that could work on all platforms in all situations

Re: LastPass RCE vulnerability fixed

#152

Post by lazyasciiart »

megous wrote: post #81
eli wrote: post #51

Earlier quoted context omitted.

It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.

Isn't sharing passwords a bad thing to do in general? Each user should have a separate account/identity and manage his own secrets.

But then there's netflix (and probably the same problem of multiple users/one credential for hulu, hbo go, whatever else).

Re: LastPass RCE vulnerability fixed

#153

Post by runejuhl »

martin1975 wrote: post #103
Exuma wrote: post #25

Earlier quoted context omitted.

That is honestly embarrassing. I'm glad I don't use LastPass.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

I use pass ( http://passwordstore.org/ ). Uses gpg, has addons for all major browsers, works on Android, is completely transparent, supports segmenting your password "tree" to use different PGP keys depending on path (e.g. all passwords in www/ encrypted to both my safe GPG key and my less safe key unique to my phone). Highly recommended.

Re: LastPass RCE vulnerability fixed

#154

Post by runejuhl »

visualphoenix wrote: post #74
Sir_Cmpwn wrote: post #52

Earlier quoted context omitted.

It's probably an afternoon project to get that functionality. Since it's just a git repo, that much is easily shared. GPG supports encrypting messages for multiple recepients. Since pass is simple and open source it should be quite easy to add what you need. Send your patches upstream, I'm sure that others would find them useful too!

Although I haven't tried it myself, it looks like pass already supports this using the PASSWORD_STORE_KEY variable in the set_gpg_recipients() function. [0] [0] https://git.zx2c4.com/password-store/plain/src/password-stor...

Or just put key IDs in a .gpg-id file:

Initialize new password storage and use gpg-id for encryption. Multiple gpg-ids may be specified, in order to encrypt each password with multiple ids. This command must be run first before a password store can be used. If the specified gpg-id is different from the key used in any existing files, these files will be reencrypted to use the new id. Note that use of gpg-agent(1) is recommended so that the batch decryption does not require as much user intervention. If --path or -p is specified, along with an argument, a specific gpg-id or set of gpg-ids is assigned for that specific sub folder of the password store. If only one gpg-id is given, and it is an empty string, then the current .gpg-id file for the specified sub-folder (or root if unspecified) is removed.

-- https://git.zx2c4.com/password-store/about/

EDIT: Better formatting

Re: LastPass RCE vulnerability fixed

#155

Post by kagebe »

visualphoenix wrote: post #74
Sir_Cmpwn wrote: post #52

Earlier quoted context omitted.

It's probably an afternoon project to get that functionality. Since it's just a git repo, that much is easily shared. GPG supports encrypting messages for multiple recepients. Since pass is simple and open source it should be quite easy to add what you need. Send your patches upstream, I'm sure that others would find them useful too!

Although I haven't tried it myself, it looks like pass already supports this using the PASSWORD_STORE_KEY variable in the set_gpg_recipients() function. [0] [0] https://git.zx2c4.com/password-store/plain/src/password-stor...

I use it to share passwords with one other person via a suitably restricted git repo, works perfectly fine.

Edit: See sister comment by runejuhl.

Re: LastPass RCE vulnerability fixed

#156

Post by ascorbic »

gfsadhfsd wrote: post #138
daveFNbuck wrote: post #136

Earlier quoted context omitted.

You're right, I misremembered the number of rolls for diceware. I guess your passwords have an extra bit over mine. How many 12+ character passwords are you able to memorize? How long does it take you to learn a new/changed one?

> How many 12+ character passwords are you able to memorize? As I need to enter on a regular basis. In practice, no more than half a dozen. Usually I have 3 or 4 in use. Might be work, personal, and a couple for crypto. > How long does it take you to learn a new/changed one? Depending on the length, 5-10 minutes of continuous training to be confident if it's one I'm going to put into immediate use. The point is to go…

A "better" password that you share between accounts is far worse than less strong passwords that are unique to each account. "+D%W}B_]7|~y" might be unfeasible to brute force, but that doesn't do much good if it turns up as plaintext in a dump and you've used it for all of your work or personal sites.

Re: LastPass RCE vulnerability fixed

#157

Post by mihaifm »

runejuhl wrote: post #153
martin1975 wrote: post #103

Earlier quoted context omitted.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

I use pass ( http://passwordstore.org/ ). Uses gpg, has addons for all major browsers, works on Android, is completely transparent, supports segmenting your password "tree" to use different PGP keys depending on path (e.g. all passwords in www/ encrypted to both my safe GPG key and my less safe key unique to my phone). Highly recommended.

any iOS app for it?

Re: LastPass RCE vulnerability fixed

#158

Post by mihaifm »

gfsadhfsd wrote: post #123
bluedonuts wrote: post #35

Long time unhappy user of Lastpass here. Would really like to hear what alternatives people are using that have at least the following features: 1. Mac/Window/Linux support 2. Ability to control accounts from an admin account. PW/2FA reset, export/wipe of accounts etc. 3. Reasonably secure 4. Not too terrible to use for Engineers/non-techies alike.

Flat text file on an encrypted volume. I use cat or vi for editing, and grep for reading. If it's ultrasensitive, I keep it on a non-networked device and type it in. Otherwise, normally, I grep and copy/paste from terminal to password field. I do security for a living. This technique is mocked by other so-called experts, but who's laughing today? I fully understand the security model I'm using. Lastpass users--and de…

I like this approach, but I would also like to have the passwords on my phone and sync between desktop and phone. Any advice on how to do that using your approach?

Re: LastPass RCE vulnerability fixed

#159

Post by snakeanus »

puzzle wrote: post #5
koolba wrote: post #3

Looks like this was discovered by the same guy that discovered CloudFail. That dude is amazing.

He also found vulnerabilities in many more security products out there. At some point, years ago, Microsoft became very hostile toward him, but things seem to be better now.

> Microsoft became very hostile toward him

What happened?

Re: LastPass RCE vulnerability fixed

#160

Post by mihaifm »

snowwrestler wrote: post #86
problems wrote: post #64

Earlier quoted context omitted.

KeePass recently got an Argon2 KDF and ChaCha20 as a cipher. I highly recommend it, good mobile apps, pretty simple UI, control over your own DB, sync it with your favourite tool, I use SyncThing as its Android support is excellent.

Which mobile app do you use with KeePass? I use MiniKeePass and am pretty happy with it.

It's a good app but as far as I remember the integration with Dropbox wasn't working properly. I think that's the main issue with KeePass right now - getting your passwords synchronized with your phone.
Post reply on HN