Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass bug leaks credentials from previous site

zdnet.com

Post reply on HN
Print view View original

131–140 of 196 posts

Re: LastPass bug leaks credentials from previous site

#131

Post by dsissitka »

reilly3000 wrote: post #121
jsutton wrote: post #104

Earlier quoted context omitted.

The vast majority of people don't have the same threat model, and unfortunately just want the product to work, or they won't use it at all. If you can't provide relevant information for the current website, you just won't be able to succeed as a password manager outside of niche markets.

Yes, but that's the essence of the whole problem: there are ways to spoof what the current website is, causing your context-aware password manager to spit out data it shouldn't. Diabling autofill pretty much eliminates the whole vector though, without breaking UX that hard.

> there are ways to spoof what the current website is, causing your context-aware password manager to spit out data it shouldn't.

Can you give an example?

Re: LastPass bug leaks credentials from previous site

#132

Post by ericd »

kerng wrote: post #91
Someone1234 wrote: post #84

Earlier quoted context omitted.

Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. I'd prefer people are using any password manager than go for perfection and then quit completely because it was a terrible UX. KeePass may be more secure against certain specific attacks, but it is largely irrelevant if people are going to contrast it against using no…

>> Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. Sorry, not doomed to fail. I'm not gonna use a password manager that is "context aware" and has the capability to auto-fill for sensitive sites - that's just my threat model. I'm okay with context aware storing of less critical passwords.

What about the threat of misspelling the address or phishing? I get a lot of comfort from the fact that the extension verifies that I'm on the website I think I'm on.

Re: LastPass bug leaks credentials from previous site

#133

Post by kllrnohj »

tobib wrote: post #124
kllrnohj wrote: post #119

Earlier quoted context omitted.

> This works if your environment allows a) installing applications and b) cloud sync using consumer clouds (dropbox, gdrive, etc Re a) https://keeweb.info/ toss this onto any ol' free tier web host you want. No app install necessary. It's not as nice as the apps, but it works. Re b) Is there an environment that both has a web browser that you want password management with and doesn't let you access any consumer cloud…

There sure is. Most big companies work that way I would imagine. I can install browser extensions, no problem but local apps are restricted. Also Dropbox and others are blocked at the corporate firewall level.

> I can install browser extensions, no problem but local apps are restricted.

Yes, which is why I posted the alternative to installing an app. You can use Keepass + drive/dropbox sync without installing anything using keeweb.

You do not need to install apps to access drive, dropbox, etc...

Re: LastPass bug leaks credentials from previous site

#134

Post by symlinkk »

zeven7 wrote: post #45

I've been just using Chrome's built-in password storage feature, though I see a lot of people are still using extensions. Any reason to prefer an extension or third party over just using the built-in Chrome feature?

The cool thing about 1Password and similar is that not only do they work in other browsers (Firefox), they also work outside of the browsers (e.g. in iOS I can autofill login boxes with credentials pulled from 1Password)

Re: LastPass bug leaks credentials from previous site

#135

Post by mrbonner »

latchkey wrote: post #5

Switched to BitWarden a few months ago from years of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.

Ditto, they have my $10/year as well.

Re: LastPass bug leaks credentials from previous site

#136

Post by ahupp »

kerng wrote: post #91
Someone1234 wrote: post #84

Earlier quoted context omitted.

Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. I'd prefer people are using any password manager than go for perfection and then quit completely because it was a terrible UX. KeePass may be more secure against certain specific attacks, but it is largely irrelevant if people are going to contrast it against using no…

>> Anything that isn't context aware (i.e. knows which website you're on so can provide the relevant information) is doomed to failure right out the gate. Sorry, not doomed to fail. I'm not gonna use a password manager that is "context aware" and has the capability to auto-fill for sensitive sites - that's just my threat model. I'm okay with context aware storing of less critical passwords.

It's not just usability: The context awareness means it will prevent you from filling a password on a phishing site. I share your wariness of the browser extensions, but you're betting that a software bug is more likely than human error. Even skilled security-aware users fall victim to phishing on a regular basis, so I'd rather trust the software.

Re: LastPass bug leaks credentials from previous site

#138

Post by Someone1234 »

kllrnohj wrote: post #120
Someone1234 wrote: post #88

Earlier quoted context omitted.

Can you trust your own hosting though? Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. It is easy to misconfigure Linux to be insecure, most distro's ship with too much software, and auto-update is often inadequate to maintain a secure environment. There's far too many compromised Linux servers out in the world that people set up "to do one thing" turned on auto-update and t…

> Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. Yes it is. It's a docker image, you're not setting up anything about the host that's exposed to the internet. Toss on watchtower to auto-update it and why would you ever need to touch it again? The system hosting docker isn't getting updates, no, but it's not publicly reachable, so that's low risk. The system that is publicly…

You just repeated back the exact problem scenario I set out above but abstracted it into a Docker container, adding an additional point of failure, and then called it a solved problem.

Sorry, but nope. The Docker container itself is a fully functional machine. It also holds your most prized data (password database/password host). Turning on auto-updates and watchtower then leaving it unmaintained indefinitely was exactly the problem I was posting about above.

Scary that people think Docker is a security solution. It isn't. The Docker container is a full machine. The Docker host is a full machine. You've now doubled your points of failure and are zero percent more secure.

Re: LastPass bug leaks credentials from previous site

#139

Post by travisp »

nickthemagicman wrote: post #64

Confused as to why tech people in this thread are giving LastPass flak for a single bug. They've had a pretty good track record for the past half decade or so since I've been using them and they submitted a fix immediately for this bug. Bugs happen, and this is a particularly obscure/esoteric bug. Right?

I disagree that they've had a good track record.

https://www.martinvigo.com/even-the-lastpass-will-be-stolen-...

https://twitter.com/tqbf/status/836619941805764609

https://twitter.com/taviso/status/843965519371812864

I've seen very few security researchers recommend it, while they will recommend other services.

Re: LastPass bug leaks credentials from previous site

#140

Post by blahyawnblah »

bad_user wrote: post #106
buildzr wrote: post #38

Earlier quoted context omitted.

I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.

KeePass isn't a solution in case you want to share passwords with family or team members. KeePass is barely decent for personal use only, and only for the desktop. The quality of the available apps differs from platform to platform. For example Bitwarden has a decent iOS app, 1Password has a superb iOS app and in contrast the available KeePass app for iOS is a piece of shit – no offense intended but it's basically un…

I've used keepass in a team before. We just kept the file in a synced shared folder. Worked fine.
Post reply on HN