Lastpass Security Incident • Hacker News Board

Re: Lastpass Security Incident

#211

Post by symlinkk » Thu, Dec 01, 2022, 1:54 AM UTC

SparkyMcUnicorn wrote: post #147

nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

I can never recommend 1Password enough. When it comes to hosted options, they are hands down the best. Worth pointing out that they also have integrated 2FA, if you're satisfied with first and second factor living in the same spot. https://1password.com

> if you're satisfied with first and second factor living in the same spot

It’s no longer “2FA” then.

Re: Lastpass Security Incident

#212

Post by grogenaut » Thu, Dec 01, 2022, 2:01 AM UTC

Years before these systems came out I thought of building a similar zero trust style system and I realized the level of attack that I would be putting myself under and the insecurity of JavaScript due to extensions, mitm, and client side malware made it ridiculously unpalatable. You would have nation state attackers coming after you as well as your nation state demanding you grant access to them. It felt pretty brazen to me that these companies came out but they did well. I still think it's an incredibly juicy target and a bad idea.

I at least know if someone broke into my physical safe.

Re: Lastpass Security Incident

#213

Post by sys_64738 » Thu, Dec 01, 2022, 2:04 AM UTC

SparkyMcUnicorn wrote: post #147

nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

I can never recommend 1Password enough. When it comes to hosted options, they are hands down the best. Worth pointing out that they also have integrated 2FA, if you're satisfied with first and second factor living in the same spot. https://1password.com

This costs a monthly subscription.

Re: Lastpass Security Incident

#214

Post by Zamicol » Thu, Dec 01, 2022, 2:05 AM UTC

foobiekr wrote: post #164

next_xibalba wrote: post #155

> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. https://blog.lastpass.com/2022/11/notice-of-recent-security-...

Zero knowledge, 100% authority on downloaded JavaScript.

I wish there was a bigger push for integrity checking in the browser. It would be foundational to any solution that fixes that problem.

There is already integrity checking for subresources: https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Newcastle University had a proposal for website wide integrity checking: https://github.com/toreini/DOMtegrity

Note that only 7 people have starred it on Github.

Re: Lastpass Security Incident

#215

Post by Tijdreiziger » Thu, Dec 01, 2022, 2:06 AM UTC

freeplay wrote: post #153

nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

Bitwarden is better, but Vaultwarden (the self-hosted version written in Rust) is the absolute best option. Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords. Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via pub…

How much should you worry about security with a setup like this? I have reasonable Linux skills, but I wouldn’t want my VM to get pwned because I forgot to update it.

Re: Lastpass Security Incident

#216

Post by nerdponx » Thu, Dec 01, 2022, 2:07 AM UTC

livueta wrote: post #206

nerdponx wrote: post #115

Earlier quoted context omitted.

This, very much so. I use KeepassXC (Strongbox on iOS) with Seafile to sync the database files. It's only gotten better over the years, and I'd rather see my donation money go directly to the developers than get slurped up into some SaaS that doesn't care about me or security anyway.

Does your sync setup work in realtime in the background? Earlier this year I was evaluating iOS devices and a showstopper was the apparent inability to have keepass database updates push-synced: the closest I got was a scheduled copy of the file at a given time daily, but my nightmare was making a change on one device, needing that change on the iOS device, having it not be there, and not having network to go fetch i…

No, that's a limitation in the setup but it's something I am willing to live with. I can make edits on my computer and "pull" them onto my phone, but not the other way around.

However I think this is a limitation of the app itself more than a limitation of the system in principle. As far as I can tell, the developer decided to only support a couple of the most popular cloud sync platforms. Maybe guess there is no consistent API for that sort of thing in iOS.

Re: Lastpass Security Incident

#217

Post by Barrin92 » Thu, Dec 01, 2022, 2:13 AM UTC

Gatsky wrote: post #175

freeplay wrote: post #153

Earlier quoted context omitted.

Bitwarden is better, but Vaultwarden (the self-hosted version written in Rust) is the absolute best option. Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords. Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via pub…

Can you give some idea why Bitwarden is better?

free for personal use, open source, cloud synced, no device limits. and as OP mentioned different server implementations if you want to host it yourself. No idea why people stick to any of the proprietary solutions.

Re: Lastpass Security Incident

#218

Post by fletchowns » Thu, Dec 01, 2022, 2:14 AM UTC

freeplay wrote: post #153

nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

Bitwarden is better, but Vaultwarden (the self-hosted version written in Rust) is the absolute best option. Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords. Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via pub…

> Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords.

> Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via public IP.

This isn't exactly a slam dunk, considering you now have to be knowledgeable about how to secure a machine that is on the internet and stay up to date with security patches which even tailscale itself isn't immune to: https://news.ycombinator.com/item?id=33695886

Re: Lastpass Security Incident

#219

Post by fletchowns » Thu, Dec 01, 2022, 2:15 AM UTC

Tijdreiziger wrote: post #215

freeplay wrote: post #153

Earlier quoted context omitted.

Bitwarden is better, but Vaultwarden (the self-hosted version written in Rust) is the absolute best option. Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords. Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via pub…

How much should you worry about security with a setup like this? I have reasonable Linux skills, but I wouldn’t want my VM to get pwned because I forgot to update it.

> How much should you worry about security with a setup like this?

One should be extremely worried about it

Re: Lastpass Security Incident

#220

Post by bawolff » Thu, Dec 01, 2022, 2:15 AM UTC

grogenaut wrote: post #212

Years before these systems came out I thought of building a similar zero trust style system and I realized the level of attack that I would be putting myself under and the insecurity of JavaScript due to extensions, mitm, and client side malware made it ridiculously unpalatable. You would have nation state attackers coming after you as well as your nation state demanding you grant access to them. It felt pretty braze…

> I realized the level of attack that I would be putting myself under and the insecurity of JavaScript due to extensions, mitm, and client side malware made it ridiculously unpalatable

This doesn't really make sense. These threats apply equally to people just memorizing and typing in their passwords into web forums. If the user's browser is compromised there is literally nothing to be done.