Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

511–520 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#511

Post by emkowale »

As a 35+ year software engineer with a very strong networking background I cannot understand why anyone would put anything in the cloud. The likelihood of me getting hacked is pretty rare. I'm just not that important. Now put me on a server with dumb/non-tech savy rich important bankers, politicians and celebrities on a publicly accessible network and I am a target. So stupid. What's even dumber is that people pay for this service!

Hosea 4:6 My people are destroyed from lack of knowledge.

Re: Ask HN: How did my LastPass master password get leaked?

#512

Post by ivanhoe »

replete wrote: post #278
ivanhoe wrote: post #243

Earlier quoted context omitted.

I see no big diff actually. It offers you no more security if you're directly compromised. It also doesn't help much in reducing the risk of the 3rd party services being hacked, as your data still travels through someone else's cloud. The one attack you avoid by it is LastPass being hacked and your encrypted vault stolen - but then you also open up yourself for Dropbox being hacked and your data stolen attack (which…

There is a fairly big difference, you are decrypting a local file using a master password NOT stored on the internet. No data is going over the wire, no 'other peoples computers'. Even if someone got your vault file, with a _very strong_ master password it's just not going to get brute forced any time soon. [1] With an online-only solution you have no idea how they are storing your data. I think 1p local vault (only)…

> There is a fairly big difference, you are decrypting a local file using a master password NOT stored on the internet.

That's the same thing that LastPass does AFAIK. According to their site: "Your data is encrypted and decrypted at the device level. Data stored in your vault is kept secret, even from LastPass. Your master password, and the keys used to encrypt and decrypt data, are never sent to LastPass’ servers, and are never accessible by LastPass."

So they pull down the encrypted vault to the local machine before decrypting it, it's never on the wire in an unencrypted form, nor keys leave your local machine.... which is essentially exactly the same thing that you do with 1Password + Dropbox for sync, just in one service. (At least that's my understanding, I might be interpreting the LastPass statements wrong, in which case please do correct me.)

Re: Ask HN: How did my LastPass master password get leaked?

#513

Post by phyzome »

ComputerGuru wrote: post #48
gkoberger wrote: post #18

Earlier quoted context omitted.

After a bit of searching, I wasn't able to find any PHP forum software that LastPass lets you log in to. I could only find one official-seeming forum, and it uses a different login. So, I think this is FUD... I don't use LastPass, but accusing them of something like this (and using the phrase "or whatever") is pretty serious without proof.

They appear to have sunset their phpBB instance. It was the main hub and support portal on their website with up to thousands of active visitors at any given time. You can see it archived here: https://web.archive.org/web/20150629081250/https://forums.la... Here's the archived phpBB login page. It asks for your LastPass login and password (not your forum account, your actual LastPass login and actual LastPass master…

I don't think this is accurate. It appears that the phpBB instance performs a redirect to a SAML login, meaning the login page where you're being asked for your master password is the regular login page.

Now, the fact that they have a web-based vault access requiring entry of your master password? Pretty bad, considering you can't disable it, and it's automatically activated even when just using the browser extension (at least as of a few years back, when I asked them to fix that.)

Re: Ask HN: How did my LastPass master password get leaked?

#514

Post by eksployted »

pupppet wrote: post #400
wutwutwutwut wrote: post #384

Earlier quoted context omitted.

Let me preface by saying I'm speculating of course. > Did the malware wait for me to open my keepass vault and snoop the password then? It's not impossible at least. There's been vulnerabilities in Keepass RPC which allowed any javascripts on Internet reading your passwords [1]. If a simple javascript can read secrets from keepass, I would not be at all surprised if that has happened. > the less probable it is that w…

I copy/pasted the password from 1Password, it may lend credence to the malware Chrome extension theory, at least in my case. Anybody else using these? uBlock Origin, Google Images Restored, Allow Right-Click, Clear Cache, StartMeeting.com Launcher, ShowPassword, Tampermonkey, Usability Hike: Find usability problems, Window Resizer, Tag Assistant Companion, Google Analytics Debugger, Google Docs Offline, Google Optimi…

happened to me too, the only one there I have is uBlock origin, matched what somebody also had. Hard to imagine it's ublock origin though because it has so many users.

Re: Ask HN: How did my LastPass master password get leaked?

#515

Post by bugstomper »

LastPass posted on their blog Dec 28 that they have identified a problem that resulted in emails being sent incorrectly:

https://blog.lastpass.com/2021/12/unusual-attempted-login-ac...

"However, out of an abundance of caution, we continued to investigate in an effort to determine what was causing the automated security alert emails to be triggered from our systems. Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved."

Re: Ask HN: How did my LastPass master password get leaked?

#516

Post by aNopBxEjtX »

halpert wrote: post #474
aNopBxEjtX wrote: post #392

Earlier quoted context omitted.

they can't

They can. Look up native messaging ports.

that doesn't let you launch processes, it lets you interact with running ones. even if the chrome extensions could launch new processes, they run inside Untrusted integrity level on Windows, you can verify this at chrome:sandbox and checking the Chrome task manager (shift+esc). You cannot interact with processes above your own integrity level nor launch processes with an integrity level higher than your current.

Re: Ask HN: How did my LastPass master password get leaked?

#517

Post by pxx »

yawaworht1978 wrote: post #485
EVa5I7bHFq9mnYK wrote: post #365

Earlier quoted context omitted.

MD5 is long considered a broken, weak hash algorithm. Here is the MD5 hash of a password: d9afca35a87a2af4168500640fcf2370 Password is 16 characters long, all lower case, no numbers, no special symbols. Please tell me the password.

The best I could find is this https://stackoverflow.com/questions/10041298/how-to-recover-... But can you show me the way how you'd go on about this? Really curious.

You can't. That's the point of the post. There is no known feasible pre-image attack on MD5.

Re: Ask HN: How did my LastPass master password get leaked?

#518

Post by palant »

Havoc wrote: post #510
palant wrote: post #500

Earlier quoted context omitted.

It’s unlikely to be due to a browser extension. A browser extension that can steal your master password can steal all the other passwords as well, it doesn’t need LastPass for that. More importantly, an extension can only steal your master password when it is used – yet several people reported not having used LastPass for a year or more. It’s still not impossible that an extension has been stealing master passwords f…

>Given that most people write about old accounts, my original suspicion No - there are now reports of same thing happening with recent changes to password https://twitter.com/Valcristerra/status/1475734357805572098

Yes, I’ve already seen this. I’ve written https://palant.info/2021/12/29/how-did-lastpass-master-passw... discussing the possibilities here. So far the most likely suspicion is that LastPass infrastructure is compromised and a pass-the-hash attack is going on.

Re: Ask HN: How did my LastPass master password get leaked?

#519

Post by benhurmarcel »

neop1x wrote: post #367
haberman wrote: post #330

Earlier quoted context omitted.

This page does not provide any information why the recommended solutions (Bitwarden, KeePassXC) are more secure than the products it warns against (1Password, LastPass, Roboform, and iCloud Keychain).

Because Bitwarden and KeePassX are open-source and auditable?

Audited is better than auditable

Re: Ask HN: How did my LastPass master password get leaked?

#520

Post by mod »

NmAmDa wrote: post #496
40four wrote: post #442

Earlier quoted context omitted.

Probably pretty low. I use 64 character passwords, or if there is a length limit, always the longest possible. That’s the beauty of using a password manager :)

Do you use 64 character master password?

I consider mine pretty long, and it's right around 30 characters.
Post reply on HN