Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

121–130 of 587 posts

Re: Lastpass Security Incident

#121

Post by justsomehnguy »

hprotagonist wrote: post #54
LudwigNagasena wrote: post #28

Earlier quoted context omitted.

I never pick a real answer to my security questions. It just seems pointlessly dangerous.

i use diceware. my mothers maiden name is sternness-ardently, and i am a proud graduate of blade-purge-satin-dash elementary! …apparently.

Just today we received an email with a password reset request from a person who:

could not login into the customer portal because he lost/forgot the password

could not perform the password recovery procedure because his answer for the security question is some nonsense like 'blade-purge-satin-dash'

*shrug_emoji*

Re: Lastpass Security Incident

#122

Post by sbarre »

babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

The password managers that I'm aware of store your vault locally on-device, even if they also sync to a cloud service.

That said I agree with you I would never use a cloud-only store for passwords!

Re: Lastpass Security Incident

#123

Post by nottorp »

n4bz0r wrote: post #104
sys32768 wrote: post #82

Time for hardware tokens based on DNA, so that nobody gets online unless they are exactly and uniquely who they are, and fully trackable from all points of contact. To get in, you must have the token. Bad actors lose access similar to jail time. Unless they can hack their DNA to be unique again, they don't get back in except on parole or after punishment. My guess is this way of solving old problems may create new on…

Wouldn't this be easily bypassed by, say, picking up a hair on a street and fabricating the token? If so, at least bad actors won't have the incentive to cut off your finger or pull an eye out as with the other biometric authentication options :')

That's how the voodoo doll myth was created.

And to the OP, any shared secret that you cannot change in case of compromise is kind of a bad idea.

Re: Lastpass Security Incident

#124

Post by slondr »

tux wrote: post #116

Never using online password manager is a good start. Only use encrypted local password manager preferably on encrypted file system and never use same passwords and emails. Best have seperate emails at least for the most important data. Also generating random 50+ alpha-numeric-symbols.

Easier said than done, sadly.

Re: Lastpass Security Incident

#125

Post by n4bz0r »

tylerhou wrote: post #61
kome wrote: post #25

it's so baffling to me that people give ALL their password to a third party, commercial, organization...

What's the alternative? 1. Have people manage their own secrets storage? Most people don't have the time or ability do this securely either. I'd rather pay someone else to secure infra, code, distribution, encryption, backups, etc. for me. 2. Reuse the same password on every site? One site gets hacked and now you're screwed. 3. Memorize a unique, long password for every site? Not feasible. Third-party/commercial pass…

The alternative to fully cloud-based solutions would be a local, open source kdbx client (Keepass, KepassXC, etc) with the password database situated on a cloud storage (Dropbox/Google Drive/etc). This way, one gets the best of both worlds.

Re: Lastpass Security Incident

#126

Post by rubysash »

I am by no means skilled as a programmer when compared to skilled programmers/scripters, but I did cobble this together a few days ago. Python version of a password keeper using sqlite. My motivation was precisely because I do not trust other password keepers. MIT license: https://github.com/rubysash/PythonPassKeep

Re: Lastpass Security Incident

#127

Post by TylerE »

justsomehnguy wrote: post #121
hprotagonist wrote: post #54

Earlier quoted context omitted.

i use diceware. my mothers maiden name is sternness-ardently, and i am a proud graduate of blade-purge-satin-dash elementary! …apparently.

Just today we received an email with a password reset request from a person who: could not login into the customer portal because he lost/forgot the password could not perform the password recovery procedure because his answer for the security question is some nonsense like 'blade-purge-satin-dash' *shrug_emoji*

Sometimes these questions are just asinine.

I ran into one once that a 6 character minimum length for the answer.

Re: Lastpass Security Incident

#128

Post by olyjohn »

theonething wrote: post #59
noirbot wrote: post #47

Earlier quoted context omitted.

What percentage of the population even thinks about "tech stacks"? That's the group of people who probably already is using something else. Everyone else is still catching up to not having a password that's just "password1234" People get their credential compromised via shared passwords way more than compromises of Lastpass or Chrome or 1Password. Sure, it's a bigger risk if your manager is compromised, but for most…

> password that's just "password1234" it's even worse than that. The world's most common password is... password.

I'm not sure about that. According to The Plague, the four most common passwords were God, love, sex and secret.

Re: Lastpass Security Incident

#130

Post by justsomehnguy »

TylerE wrote: post #127
justsomehnguy wrote: post #121

Earlier quoted context omitted.

Just today we received an email with a password reset request from a person who: could not login into the customer portal because he lost/forgot the password could not perform the password recovery procedure because his answer for the security question is some nonsense like 'blade-purge-satin-dash' *shrug_emoji*

Sometimes these questions are just asinine. I ran into one once that a 6 character minimum length for the answer.

Just checked: 'Your favourite computer game?'.

> I ran into one once that a 6 character minimum length for the answer

This is a problem too, but at least it works if you manage to talk to a living person - even if you don't remember exactly how did you wrote something you can prove you know the answer for the security question. With 'cp359-qreor-534wej' as an answer you have no chance.

Post reply on HN