Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass bug leaks credentials from previous site

zdnet.com

Post reply on HN
Print view View original

121–130 of 196 posts

Re: LastPass bug leaks credentials from previous site

#121

Post by reilly3000 »

jsutton wrote: post #104
kerng wrote: post #91

Earlier quoted context omitted.

>> Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. Sorry, not doomed to fail. I'm not gonna use a password manager that is "context aware" and has the capability to auto-fill for sensitive sites - that's just my threat model. I'm okay with context aware storing of less critical passwords.

The vast majority of people don't have the same threat model, and unfortunately just want the product to work, or they won't use it at all. If you can't provide relevant information for the current website, you just won't be able to succeed as a password manager outside of niche markets.

Yes, but that's the essence of the whole problem: there are ways to spoof what the current website is, causing your context-aware password manager to spit out data it shouldn't. Diabling autofill pretty much eliminates the whole vector though, without breaking UX that hard.

Re: LastPass bug leaks credentials from previous site

#122

Post by [deleted] »

vz8 wrote: post #60
latchkey wrote: post #5

Switched to BitWarden a few months ago from years of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.

Love to hear more about why BitWarden is a safer choice than Lastpass if anyone cares to chime in. Thanks.

[deleted]

Re: LastPass bug leaks credentials from previous site

#123

Post by tastroder »

syntheticnature wrote: post #46
JshWright wrote: post #36

Earlier quoted context omitted.

Your comment implies that you're no longer changing your credentials?

Perhaps they mean just not all of them Right Now.

Yeah, that and especially not all the nonsense that's stored in there at once. I kind of wanted to migrate away to something local I'd also trust with mail and banking credentials but lastpass is one of those things for me that works just well enough to not push me over the edge to actually change anything.

Re: LastPass bug leaks credentials from previous site

#124

Post by tobib »

kllrnohj wrote: post #119
tobib wrote: post #112

Earlier quoted context omitted.

This works if your environment allows a) installing applications and b) cloud sync using consumer clouds (dropbox, gdrive, etc You are right that this is a good approach for many it will certainly break for many as well.

> This works if your environment allows a) installing applications and b) cloud sync using consumer clouds (dropbox, gdrive, etc Re a) https://keeweb.info/ toss this onto any ol' free tier web host you want. No app install necessary. It's not as nice as the apps, but it works. Re b) Is there an environment that both has a web browser that you want password management with and doesn't let you access any consumer cloud…

There sure is. Most big companies work that way I would imagine. I can install browser extensions, no problem but local apps are restricted. Also Dropbox and others are blocked at the corporate firewall level.

Re: LastPass bug leaks credentials from previous site

#125

Post by simcop2387 »

acidburnNSA wrote: post #13
simcop2387 wrote: post #8

Earlier quoted context omitted.

While it's definitely more work to setup, I've been using KeePassXC + NextCloud for syncing. I've got it working on my phone with keepass2android (think that's the name) and also use a yubikey challenge-response key to help ensure that even with a bad password i've got decent protection of my passwords. There's browser extensions for basically every browser out there, and it even supports auto-typing into non-browser…

I've been using something very similar, though I only have a local keyfile that I independently put on my synced machines rather than the yubikey thing. How do you like the yubikey process? Not too much of a pain?

Not much of an issue at all, it does mean that when i need to unlock my manager or save the database, i have to have my [physical] keys around but it's otherwise not an issue. I've got two duplicated yubikeys for it, a neo with nfc and a 5 with usb-c. I generally use the neo for everything but needed the usb-c one for laptops with no USB-A ports and my tablet which also has no USB-A or NFC. Just the march of progress.

They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.

Re: LastPass bug leaks credentials from previous site

#126

Post by Ajedi32 »

Someone1234 wrote: post #84
buildzr wrote: post #38

Earlier quoted context omitted.

I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.

Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. I'd prefer people are using any password manager than go for perfection and then quit completely because it was a terrible UX. KeePass may be more secure against certain specific attacks, but it is largely irrelevant if people are going to contrast it against using no…

The bigger issue is that anything that's not context-aware is vulnerable to phishing.

You might think you'd notice if the site you're on had a different URL than the one you're expecting, but that level of constant vigilance might turn out to be more difficult to maintain than you expect. Especially when you take into account some of the more exotic phishing techniques like IDN homograph attacks.

Re: LastPass bug leaks credentials from previous site

#127

Post by munchbunny »

w8rbt wrote: post #56

This is one reason why I believe that browser based password managers are flawed. I've written about this in the past (link below). These apps are popular with normal people (due to convenience), but long-term, we should not trust web browsers plugins or add-ons as password managers. https://github.com/w8rbt/dpg#why-traditional-password-manage...

I agree with your assessment of why traditional password managers have flaws, but I disagree with your conclusion.

Security has always been a balance between usability and safety, and when you set security policy, you always do it in the context of who is using it and their needs.

Integrating the password manager into the browser makes a lot of things easier as an end user. If I told my parents/grandparents and non-programmer friends to use something like DBG or Password Safe, they would just go back to guessable and reused passwords. Given the choice, I would rather have them use a browser based password manager.

If we're really talking about how to move the needle on protecting logins, I would rather push FIDO/U2F. Keeping a cryptographic second factor on your keychain, phone, or computer carries more added safety at a lower usability cost.

Re: LastPass bug leaks credentials from previous site

#128

Post by cat199 »

Someone1234 wrote: post #84
buildzr wrote: post #38

Earlier quoted context omitted.

I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.

Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. I'd prefer people are using any password manager than go for perfection and then quit completely because it was a terrible UX. KeePass may be more secure against certain specific attacks, but it is largely irrelevant if people are going to contrast it against using no…

> Anything that isn't context aware .. is doomed to failure > ... I'd prefer people are using

why should I as someone who is securing my own passwords care about your preferences or what will and won't work for someone else too lazy to be concerned?

Re: LastPass bug leaks credentials from previous site

#129

Post by Wowfunhappy »

kerng wrote: post #91
Someone1234 wrote: post #84

Earlier quoted context omitted.

Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. I'd prefer people are using any password manager than go for perfection and then quit completely because it was a terrible UX. KeePass may be more secure against certain specific attacks, but it is largely irrelevant if people are going to contrast it against using no…

>> Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. Sorry, not doomed to fail. I'm not gonna use a password manager that is "context aware" and has the capability to auto-fill for sensitive sites - that's just my threat model. I'm okay with context aware storing of less critical passwords.

What is your concern exactly? Bitwarden by default doesn't autofill forms, you have to open the Bitwarden menu and click on the title of the website you're on.

There is an option to autofill, but it's buried in advanced settings and Bitwarden will display a warning if you try to enable it. (This message ought to be worded more explicitly—it currently says "this feature is in beta" rather than "this feature will decrease you're security"—but, still, not a default.)

Re: LastPass bug leaks credentials from previous site

#130

Post by triceratops »

buildzr wrote: post #38
latchkey wrote: post #5

Switched to BitWarden a few months ago from years of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.

I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.

Use Lastpass but not the browser extension. Keep a different browser just for opening the Lastpass website and copy-paste the passwords from there.
Post reply on HN