Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

291–300 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#291

Post by AdmiralAsshat »

gregsadetsky wrote: post #114
sillysaurusx wrote: post #111

Earlier quoted context omitted.

One other breadcrumb: https://news.ycombinator.com/item?id=29706957 It's looking like you got phished a long time ago, or installed malware which targeted the lastpass extension. Did all of you use the same OS four years ago? (Windows perhaps?) Some malware targets Chrome/Firefox files on disk. A malicious extension probably wouldn't be able to affect your LastPass extension, but a malicious malware app could easily…

Yeah, all of us being phished years ago is a possibility (I just replied to your other comment) I used macOS/Chrome back in 2017. I definitely could have been phished then, or used a compromised extension.

How'd they get past the 2FA, though?

Or does LP shoot an email if it detects a suspicious geo-IP login before the 2FA prompt?

Re: Ask HN: How did my LastPass master password get leaked?

#292

Post by forix »

claudiojulio wrote: post #106

Please stop using this service. Use reliable, open source and auditable services. https://www.privacyguides.org/software/passwords/

This. I cringe every time I see a coworker log into some site using LastPass, 1Password, or really any other cloud-hosted password manager.

Re: Ask HN: How did my LastPass master password get leaked?

#293

Post by rhizome »

criley2 wrote: post #94
ComputerGuru wrote: post #43

Earlier quoted context omitted.

There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C…

Just because you put a warning label on a bad practice doesn't mean it's a good practice. Pumping your passwords through some random code on Github that has a "be smart" label doesn't make it a good idea. Would be so easy to imitate you, reupload the code with an exploit. For giggles, if I was making this into a hijack I'd leave all your warnings in and even make them bigger and more obvious, confident in the knowled…

BREAKING: There is no perfect security.

>Would be so easy to imitate you, reupload the code with an exploit.

Put your keyboard where your fingers are: do it by tomorrow morning and post here when you're done.

Re: Ask HN: How did my LastPass master password get leaked?

#294

Post by gregsadetsky »

AdmiralAsshat wrote: post #291
gregsadetsky wrote: post #114

Earlier quoted context omitted.

Yeah, all of us being phished years ago is a possibility (I just replied to your other comment) I used macOS/Chrome back in 2017. I definitely could have been phished then, or used a compromised extension.

How'd they get past the 2FA, though? Or does LP shoot an email if it detects a suspicious geo-IP login before the 2FA prompt?

LP shoots an email as soon as someone attempts to login with the correct password from a new IP.

Once the IP is approved (you have to follow a link from the email), then you login again with the correct password and then get the 2FA prompt.

Re: Ask HN: How did my LastPass master password get leaked?

#295

Post by miles »

ComputerGuru wrote: post #43
gkoberger wrote: post #22

Earlier quoted context omitted.

There's a level of irony in complaining about LastPass's security, followed by suggestion people run their passwords through random third-party software that you wrote. Even if your code isn't malicious (which I believe), it opens up so many potential attack vectors. For anyone reading this, please use the official 1Password import functionality, not this: https://support.1password.com/import-lastpass/

There was no 1Password to LastPass importer at the time I wrote that (believe me, I looked because I have better things to do than write apps to benefit a commercial entity like agilebits otherwise), and of course the code is published on GitHub and released under the MIT license. It's very short and simple and rather easy to review. It's also a .NET executable, which is ridiculously easy to reverse-compile back to C…

I am extremely grateful to ComputerGuru and others who freely share code and binaries they used to scratch a specific itch like this. As for security, I'd never dream of running anything like this outside of an isolated, offline system and would destroy the instance immediately afterwards.

Re: Ask HN: How did my LastPass master password get leaked?

#296

Post by judge2020 »

Nextgrid wrote: post #178
explaingarlic wrote: post #70

Earlier quoted context omitted.

Is there an official counter for phpBB RCEs/vulnerabilities that revealed user passwords? This has been going on for decades now. It's getting ridiculous.

Welcome to frameworkless PHP where code & user files are stored in the same root and any PHP file requested by a web client is executed by the server. In most proper frameworks, including PHP ones, the only thing responding to web requests is an entrypoint file (that gets passed the request metadata including URL) and the framework takes it from there. This means that with proper configuration, even requesting a mali…

> the server may still prioritize an exact path match and execute the file rather than defaulting to executing the framework's entrypoint

This is properly solved by frameworks having this entrypoint be in a ‘public’ folder and that also being the webroot, so only index.php and nothing else is available for a direct match (unless /../ in the url works, which would be a huge security hole).

Re: Ask HN: How did my LastPass master password get leaked?

#298

Post by Fnoord »

gregsadetsky wrote: post #272
fer wrote: post #269

Earlier quoted context omitted.

Yes, my bad,it's technically not a breach, since in theory it was never exploited.

No, it's super interesting. So presumably back in 2017, the vulnerability was found but considered to be un-exploited, but it's maybe turning out that our master passwords did get breached back then and laid dormant for a few years, to be finally used just now?

What happens with such data is the pastes get distributed eventually (used to happen on a forum like Hackforums or Chan, moved more towards Tor I can imagine). Then it recently got in the hands of an attacker who tried to exfiltrate the data.

We don't know if the attacker tried the same password on a different service, such as Gmail for example. It does not make sense to not try this, given the geoblock.

I remember seeing on a hacker conference in 2019 a demo by some Italians (in my mind I think about Evilsocket) of a phishing attempt where they automated the process of getting the 2FA from e-mail. Geoblock or IP whitelisting is essentially a form of 2FA.

Re: Ask HN: How did my LastPass master password get leaked?

#299

Post by chubs »

Just tried to delete my lastpass account and get the following message: "Something went wrong. : A" Not very confidence-building. Anyone know how to work around this?

Also: Went to https://support.logmeininc.com/lastpass/help/delete-your-las... and it doesn't actually tell you how to delete the account, just tells you how to recover your password. Methinks this is all a dark pattern.

Re: Ask HN: How did my LastPass master password get leaked?

#300

Post by Fnoord »

macrolime wrote: post #188
tlrobinson wrote: post #123

Earlier quoted context omitted.

Cool, great start, but something Yubikey sized would be more practical.

It can be done with yubikey. Passwords stored encrypted on disk and get decrypted on the yubikey with gpg. https://github.com/drduh/YubiKey-Guide https://attackpointsecurity.com/go-pass-yubikey-and-gpg

Isn't a hardware wallet airgapped?

For a cheap alternative you can use an old smartphone, and disable all radios. People will use a Librem 5 in 20 years still for this purpose wink.

Post reply on HN