Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass RCE vulnerability fixed

bugs.chromium.org

Post reply on HN
Print view View original

161–170 of 188 posts

Re: LastPass RCE vulnerability fixed

#161

Post by manyxcxi »

martin1975 wrote: post #103
Exuma wrote: post #25

Earlier quoted context omitted.

That is honestly embarrassing. I'm glad I don't use LastPass.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

1Password, and it's been awesome. If you use the non-hosted version you control the whole thing. LAN only sync, or Dropbox, Rsync, however you want to sync it if it matters. Otherwise they've got a hosted version which can also give you web access in a pinch and handle all the syncing for you. I have been with them for long enough that my only option was a non-hosted version and I keep in sync with Dropbox and it works wonderfully.

The Mac client is very nice to use. The Windows client works well but isn't as nice looking. The browser extension is awesome- AND you can put MFA keys in there as well.

EDIT: And I forgot to mention the main reason I chose 1Password so long ago. Their iOS app is awesome and their mobile Safari integration works quite well.

Re: LastPass RCE vulnerability fixed

#162

Post by manyxcxi »

AhtiK wrote: post #145
martin1975 wrote: post #103

Earlier quoted context omitted.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

Has anyone used hardware-based password manager like Trezor Password Manager? [1] [2] Initially Trezor was created as a bitcoin wallet but is much more these days. The issue with 1Password is that it's not accessible in Linux and no U2F (yubikey etc) support AFAIK... [1] https://trezor.io/passwords/ [2] https://blog.trezor.io/satoshilabs-launches-trezor-password-...

If you install 1Password 4 in Wine it works pretty well, I've even got browser extensions working with my Linux browser.

Its not great and it crashes some, but it does work.

Re: LastPass RCE vulnerability fixed

#163

Post by gfsadhfsd »

ascorbic wrote: post #156
gfsadhfsd wrote: post #138

Earlier quoted context omitted.

> How many 12+ character passwords are you able to memorize? As I need to enter on a regular basis. In practice, no more than half a dozen. Usually I have 3 or 4 in use. Might be work, personal, and a couple for crypto. > How long does it take you to learn a new/changed one? Depending on the length, 5-10 minutes of continuous training to be confident if it's one I'm going to put into immediate use. The point is to go…

A "better" password that you share between accounts is far worse than less strong passwords that are unique to each account. "+D%W}B_]7|~y" might be unfeasible to brute force, but that doesn't do much good if it turns up as plaintext in a dump and you've used it for all of your work or personal sites.

What? Where did I say I share these passwords? I don't. Go up to my top post. Passwords of any importance are unique, also random, and stored in a text file in an encrypted volume (with a unique, strong, memorized key).

The only non-unique keys I use, are also nonrandom, and used for accounts with no security consequences. Like this one.

Re: LastPass RCE vulnerability fixed

#164

Post by extra88 »

russell_h wrote: post #127
tcbawo wrote: post #116

Earlier quoted context omitted.

Why not use auto fill? I consider that a decent defense against phishing attempts. Now I always think twice before entering my name and password.

Autofill requires a browser extension. There are at least three major risks associated with this: 1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passp…

1Password does not have a list of "secrets" that it draws from for all forms, it only saves the information you provide per-site; anything it submits to a site is information you've already submitted to the site previously.

1Password's extension does not prompt for my master passphrase, I have to click on it to enter it (if I haven't already). It also to don't try to fill forms on page load, I have to instruct it to do so. By default it will usually submit a form upon fill but I often turn off that setting.

As for browser vulnerabilities, I'm not familiar with any information about extensions being particularly vulnerable to browser exploits, it seems like when browsers get "pwned," anything in userland (if not the whole system) is up for grabs so avoiding the password manager's browser extension doesn't gain you anything. I'm not saying there's no risk, just that trade-off is worth it. Agilebits argues that using the extension is safer because it avoids keystroke loggers and clipboard sniffers [0]

[0] https://blog.agilebits.com/2014/08/21/watch-what-you-type-1p...

Re: LastPass RCE vulnerability fixed

#165

Post by ozo »

peak_body_yo wrote: post #97
ktta wrote: post #87

Earlier quoted context omitted.

Well. This is not a good week for lastpass. And for all the users of password managers which use a browser extension or a cloud synced database, KeepPassXC[1] is a good alternative, because it won't come close to touching your browser or any remote server. It is cross platform so you have no excuse. It also has a mobile app which is not made by the same developers but a different company so I would be wary of the app…

Is this any better than KeePassX?

From https://keepassxc.org/docs:

>Why KeePassXC instead of KeePassX?

>KeePassX is an amazing password manager, but hasn't seen much active development for quite a while. Many good pull requests were never merged and the original project is missing some features which users can expect from a modern password manager. Hence, we decided to fork KeePassX to continue its development and provide you with everything you love about KeePassX plus many new features and bugfixes.

Re: LastPass RCE vulnerability fixed

#166

Post by chrishawes »

mihaifm wrote: post #157
runejuhl wrote: post #153

Earlier quoted context omitted.

I use pass ( http://passwordstore.org/ ). Uses gpg, has addons for all major browsers, works on Android, is completely transparent, supports segmenting your password "tree" to use different PGP keys depending on path (e.g. all passwords in www/ encrypted to both my safe GPG key and my less safe key unique to my phone). Highly recommended.

any iOS app for it?

There are a couple: https://github.com/davidjb/pass-ios https://github.com/mssun/passforios

Passforios is being actively developed and is shaping up well.

Re: LastPass RCE vulnerability fixed

#167

Post by marklgr »

gfsadhfsd wrote: post #150
marklgr wrote: post #146

Earlier quoted context omitted.

I doubt most people type their passwords multiple times on a daily basis, so dismissing mnemonics with "just use muscle memory" doesn't look practical to me. And they're not incompatible, actually: you can eventually commit to muscle memory a diceware-like password, but in the meantime (or if it slips out of muscle memory) you got mnemonics ie. clues. As far as I'm concerned, I've tested some diceware passwords for s…

If it works for you, great. Maybe I was being deliberately controversial calling xkcd/diceware bullshit. Kudos for raising bad password awareness and improving practices, I suppose. But, I still contend it basically knocks down a straw man with bullshit. Yes, they correctly point out that if you're using a mnemonic method, a long passphrase is better than a short password. I'm pretty sure the PGP folks pointed that o…

One of your point is that three things to memorize is more difficult than having just one, but sometimes it's just not the case: adding vivid images and funny/silly backstories actually makes remembering easier, as research suggested and borne out by personnal experience.

Now, it could be argued that these images/backstories could be made up for random ASCII chars too, but to me it's just easier to do so with words.

Regarding screenlocks, I tend to use relatively mediocre passwords (nothing stupid, though), since screenlocking is only useful against very casual attackers -- someone skilled and motivated will just get in if they have physical access to the box. But I agree that it's where muscle memory would work best.

Re: LastPass RCE vulnerability fixed

#168

Post by ryanlol »

tedivm wrote: post #119
sp332 wrote: post #50

Update: another vulnerability found, not patched yet. https://mobile.twitter.com/taviso/status/844312124541186048

I'm really surprised, and disappointed, that Travis announced this publicly like this. From my understanding the Google team has a policy of giving people time to patch the bug before announcing it. I know that the technical details weren't released by by confirming there is a zero day exploit he's making it more likely to be discovered and exploited. The responsible thing would have been to notify the vendor and app…

I can confirm that there is unpatched exploitable vulnerabilities with high impact in the following software products:

Linux

OpenBSD

iOS

Windows

Google Chrome

Mozilla Firefox

Safari

Apache

nginx

openSSHd

bonzi buddy

Re: LastPass RCE vulnerability fixed

#169

Post by gfsadhfsd »

mihaifm wrote: post #158
gfsadhfsd wrote: post #123

Earlier quoted context omitted.

Flat text file on an encrypted volume. I use cat or vi for editing, and grep for reading. If it's ultrasensitive, I keep it on a non-networked device and type it in. Otherwise, normally, I grep and copy/paste from terminal to password field. I do security for a living. This technique is mocked by other so-called experts, but who's laughing today? I fully understand the security model I'm using. Lastpass users--and de…

I like this approach, but I would also like to have the passwords on my phone and sync between desktop and phone. Any advice on how to do that using your approach?

It's not really friendly to mobile sync, so if you're heavily into that, it's not a full solution. I'm sure you can find a way to securely push the file to the phone as an exercise to the reader, but it would probably involve some philosophical security compromises or creativity.

Re: LastPass RCE vulnerability fixed

#170

Post by ascorbic »

gfsadhfsd wrote: post #163
ascorbic wrote: post #156

Earlier quoted context omitted.

A "better" password that you share between accounts is far worse than less strong passwords that are unique to each account. "+D%W}B_]7|~y" might be unfeasible to brute force, but that doesn't do much good if it turns up as plaintext in a dump and you've used it for all of your work or personal sites.

What? Where did I say I share these passwords? I don't. Go up to my top post. Passwords of any importance are unique, also random, and stored in a text file in an encrypted volume (with a unique, strong, memorized key). The only non-unique keys I use, are also nonrandom, and used for accounts with no security consequences. Like this one.

Apologies, I misunderstood your post.
Post reply on HN