Lastpass Security Incident • Hacker News Board

Re: Lastpass Security Incident

#151

Post by neilv » Thu, Dec 01, 2022, 12:50 AM UTC

bombcar wrote: post #20

Someday one of these password managers is going to be hacked wide open and it is NOT going to be pretty.

There were rumors a couple years ago that this already happened to one of them.

My layperson's armchair guess is that a successful attacker would probably seek to keep it quiet.

If you were a bad person, and you got access of tons of credentials from one of the major trust-us password managers, would you:

1. Focus on finding and looting big-payout cryptocurrency stashes, as quietly as you can (so you can keep doing it longer, before news gets out of how)?

2. Sell to a state actor to use for probably high-value purposes, while keeping it quiet?

3. Something else, and would that involve keeping it quiet, or making a big noisy mess?

Re: Lastpass Security Incident

#152

Post by waynesonfire » Thu, Dec 01, 2022, 12:51 AM UTC

clumsysmurf wrote: post #42

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

> the password export malfunctions

oh wow, what a surprise.

Re: Lastpass Security Incident

#153

Post by freeplay » Thu, Dec 01, 2022, 12:51 AM UTC

nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

Bitwarden is better, but Vaultwarden (the self-hosted version written in Rust) is the absolute best option. Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords.

Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via public IP.

Re: Lastpass Security Incident

#154

Post by tomxor » Thu, Dec 01, 2022, 12:51 AM UTC

LudwigNagasena wrote: post #28

geocrasher wrote: post #23

Great, now I'm going to have to rename my dog.

I never pick a real answer to my security questions. It just seems pointlessly dangerous.

I have sooo many pet and mother maiden names, but I can't remember any of them because they are all `openssl rand -hex 32`

Re: Lastpass Security Incident

#155

Post by next_xibalba » Thu, Dec 01, 2022, 12:52 AM UTC

> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture.

https://blog.lastpass.com/2022/11/notice-of-recent-security-...

Re: Lastpass Security Incident

#156

Post by sciurus » Thu, Dec 01, 2022, 12:52 AM UTC

aussieguy1234 wrote: post #132

cwkoss wrote: post #74

If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts

LastPass is architectured so that your master password is never sent to their servers. Decryption of your vault happens locally on your device. Maybe such an attacker might get your email address (username).

Unless the attacker is able to modify the LastPass client to upload your masters password.

Re: Lastpass Security Incident

#157

Post by waynesonfire » Thu, Dec 01, 2022, 12:52 AM UTC

aussieguy1234 wrote: post #132

cwkoss wrote: post #74

If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts

LastPass is architectured so that your master password is never sent to their servers. Decryption of your vault happens locally on your device. Maybe such an attacker might get your email address (username).

the architecture that was just hacked? Maybe in the next version of the update you'll find the architecture has mysteriously changed as well.

Re: Lastpass Security Incident

#158

Post by philliphaydon » Thu, Dec 01, 2022, 12:53 AM UTC

kawsper wrote: post #141

babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

I keep them local too, but I haven't found a solution on how to keep my laptop and phone in sync. It is not fun having to type a 30+ character password consisting uppercase+lowercase letters, numbers and special characters on a mobile device. But it has helped me to keep my phone clutter free, so maybe there's an upside to it too :)

Self-hosted BitWarden?

Re: Lastpass Security Incident

#159

Post by usefulcat » Thu, Dec 01, 2022, 12:53 AM UTC

wheels wrote: post #112

babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

> You just have to deal with the very mild inconvenience of keeping your database synchronized across devices. Which is pretty easy with SyncThing. Other services like Dropbox are also fine if you have a sufficiently high entropy password. The danger isn't in the "online", but a third party being able to decrypt your passwords.

> Which is pretty easy with SyncThing

Is SyncThing available for iOS? I thought it wasn’t but I’d love to be wrong.

Re: Lastpass Security Incident

#160

Post by adgjlsfhk1 » Thu, Dec 01, 2022, 12:53 AM UTC

kawsper wrote: post #141

babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

I keep them local too, but I haven't found a solution on how to keep my laptop and phone in sync. It is not fun having to type a 30+ character password consisting uppercase+lowercase letters, numbers and special characters on a mobile device. But it has helped me to keep my phone clutter free, so maybe there's an upside to it too :)

Dropbox works for this.