Lastpass Security Incident • Hacker News Board

Re: Lastpass Security Incident

#201

Post by Jon_Lowtek » Thu, Dec 01, 2022, 1:40 AM UTC

DangitBobby wrote: post #174

n4bz0r wrote: post #125

Earlier quoted context omitted.

The alternative to fully cloud-based solutions would be a local, open source kdbx client (Keepass, KepassXC, etc) with the password database situated on a cloud storage (Dropbox/Google Drive/etc). This way, one gets the best of both worlds.

This can be a nice compromise, but it's not without downsides. Personally, 99% of the authenticated software I use is in my browser, and the usability of an extension that has a little badge to tell me I have an account on this site and autofill capabilities is really tough to pass up. Further, because it's an extension, it can know what site I'm on, which all but eliminates my risk of falling prey to phishing attemp…

KeepassXC does have a browser extension.

Re: Lastpass Security Incident

#202

Post by aborsy » Thu, Dec 01, 2022, 1:43 AM UTC

fredgrott wrote: post #162

For those that do not know Yubico hardware stuff does work with both Bitwarden and BitLocker It's the solution I will be transitioning to at some point. Note, GitHub requires 2-auth fall of 2023 in case anyone forgot.

If the software is compromised, Yubikey won’t help.

Re: Lastpass Security Incident

#203

Post by reiderrider » Thu, Dec 01, 2022, 1:45 AM UTC

next_xibalba wrote: post #155

> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. https://blog.lastpass.com/2022/11/notice-of-recent-security-...

Does this mean usernames and notes are not encrypted in the same way?

Re: Lastpass Security Incident

#204

Post by cwkoss » Thu, Dec 01, 2022, 1:46 AM UTC

next_xibalba wrote: post #155

> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. https://blog.lastpass.com/2022/11/notice-of-recent-security-...

Until a user logs in and the passwords are decrypted using client software that could be compromised

Re: Lastpass Security Incident

#205

Post by bmitc » Thu, Dec 01, 2022, 1:48 AM UTC

tux wrote: post #116

Never using online password manager is a good start. Only use encrypted local password manager preferably on encrypted file system and never use same passwords and emails. Best have seperate emails at least for the most important data. Also generating random 50+ alpha-numeric-symbols.

Is that safer than 1Password? According to their documentation, passwords inside 1Password are fully encrypted and only ever decrypted locally on the user's devices. So, it seems identical to the local use case you describe except that it's much more difficult to lose your passwords on 1Password. With passwords only locally on a single machine, if you lose the machine, you lose your passwords. Plus, there's no easy way to share the passwords across multiple machines and especially operating systems.

It seems to me that everyone stating that systems like this are terrible simply propose an alternative that is a hand-built version of the same solution.

Re: Lastpass Security Incident

#206

Post by livueta » Thu, Dec 01, 2022, 1:49 AM UTC

nerdponx wrote: post #115

babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

This, very much so. I use KeepassXC (Strongbox on iOS) with Seafile to sync the database files. It's only gotten better over the years, and I'd rather see my donation money go directly to the developers than get slurped up into some SaaS that doesn't care about me or security anyway.

Does your sync setup work in realtime in the background? Earlier this year I was evaluating iOS devices and a showstopper was the apparent inability to have keepass database updates push-synced: the closest I got was a scheduled copy of the file at a given time daily, but my nightmare was making a change on one device, needing that change on the iOS device, having it not be there, and not having network to go fetch it. It'd be neat if you've got a way to make this work more like Syncthing on Android.

Re: Lastpass Security Incident

#207

Post by rjzzleep » Thu, Dec 01, 2022, 1:49 AM UTC

aborsy wrote: post #179

rjzzleep wrote: post #167

Earlier quoted context omitted.

I haven't touched KeePass in a while(especially since it always had its quirks outside of Windows, being .NET), but KeePassXC which started as a merger of all the various patches to KeepassX(the QT implementation), has been very active. It has a more secure browser integration than the original had, although it's worth noting that nothing ever came close to the accuracy of 1Password when it comes to website quirk int…

On iOS there is strongbox and keepassium also.

I just bought Strongbox Pro just a couple of minutes ago. It's much nicer than KyPass. It's a bit pricey, but worth it if you can afford it.

Re: Lastpass Security Incident

#208

Post by bmitc » Thu, Dec 01, 2022, 1:51 AM UTC

n4bz0r wrote: post #125

tylerhou wrote: post #61

Earlier quoted context omitted.

What's the alternative? 1. Have people manage their own secrets storage? Most people don't have the time or ability do this securely either. I'd rather pay someone else to secure infra, code, distribution, encryption, backups, etc. for me. 2. Reuse the same password on every site? One site gets hacked and now you're screwed. 3. Memorize a unique, long password for every site? Not feasible. Third-party/commercial pass…

The alternative to fully cloud-based solutions would be a local, open source kdbx client (Keepass, KepassXC, etc) with the password database situated on a cloud storage (Dropbox/Google Drive/etc). This way, one gets the best of both worlds.

Why go through all that trouble? The passwords database or storage in 1Password is encrypted. It is only ever decrypted on a local device.

Re: Lastpass Security Incident

#209

Post by yeeeloit » Thu, Dec 01, 2022, 1:52 AM UTC

arjvik wrote: post #192

amerine wrote: post #44

Earlier quoted context omitted.

Can you elaborate more? Which? Why do you think this? I also agree with you and I think it’s one that rhymes with shome paus werd. But I think it happened early in their “cloud” journey

Are you talking about 1Password? What makes you think that?

No idea what they are talking about, or why they feel the need to withhold information, but a quick search turned up this interesting comment:

https://www.reddit.com/r/1Password/comments/lkfg5p/what_happ...

Re: Lastpass Security Incident

#210

Post by the_svd_doctor » Thu, Dec 01, 2022, 1:53 AM UTC

aussieguy1234 wrote: post #132

cwkoss wrote: post #74

If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts

LastPass is architectured so that your master password is never sent to their servers. Decryption of your vault happens locally on your device. Maybe such an attacker might get your email address (username).

Is there a web UI ? If yes - I guess an attacker can just send "bad" JS to the client and steal the master password no? Or inject a malicious update. Most people probably have auto updates?