Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

231–240 of 587 posts

Re: Lastpass Security Incident

#231

Post by jiggawatts »

ihattendorf wrote: post #38
ilyt wrote: post #22

Earlier quoted context omitted.

Most of them are build without having decrypted passwords or keys for them on server, so attacker would need to get to the point where they can craft malicious update to the client (or exploit the client)

1. Get access to build infrastructure (e.g. via supply chain attack) 2. Inject code in build to export user's passwords to remote server after update is installed

This kind of thing has already happened. Chinese hackers got into the Juniper VPN source code and replaced a key pair with their own. They even updated the tests so that it would pass. This went unnoticed for years.

Re: Lastpass Security Incident

#232

Post by xienze »

Tijdreiziger wrote: post #215
freeplay wrote: post #153

Earlier quoted context omitted.

Bitwarden is better, but Vaultwarden (the self-hosted version written in Rust) is the absolute best option. Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords. Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via pub…

How much should you worry about security with a setup like this? I have reasonable Linux skills, but I wouldn’t want my VM to get pwned because I forgot to update it.

Honestly I don't even bother with hosting it in a cloud instance. I host Bitwarden on my home network, and whenever one of my devices opens the Bitwarden browser plugin or mobile app (at home), it will automatically sync everything. From that point on you can continue using Bitwarden without it needing to connect to the server.

So on one hand, I lose the ability to sync when I'm not on my home network. On the other hand, I don't change anything in my Bitwarden server _that_ often, and if I do, I can just quickly do a sync on whatever devices and I'm good to go. With the added benefit of not opening myself up to the outside world.

Re: Lastpass Security Incident

#233

Post by nr2x »

jph wrote: post #43

Kudos to the CEO for disclosing this as it's happening and writing the post. This disclosure post is direct, forthright about what's known, specific about engaging help, and explicit about notifying people as more happens. Hacking sucks, but the CEO's post is IMHO on the right track.

Depending on the specifics it may be a legal requirement to disclose. FTC does not look fondly in hiding data breeches. At all.

Re: Lastpass Security Incident

#234

Post by nordsieck »

kawsper wrote: post #141
babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

I keep them local too, but I haven't found a solution on how to keep my laptop and phone in sync. It is not fun having to type a 30+ character password consisting uppercase+lowercase letters, numbers and special characters on a mobile device. But it has helped me to keep my phone clutter free, so maybe there's an upside to it too :)

> It is not fun having to type a 30+ character password consisting uppercase+lowercase letters, numbers and special characters on a mobile device.

I find that it's much faster to type an all lowercase password that's a bit longer to get the same strength.

Re: Lastpass Security Incident

#235

Post by a2800276 »

Tyrubias wrote: post #200
clumsysmurf wrote: post #42

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

Uh oh, now I’m paranoid my LastPass export didn’t have everything, and I deleted my account years ago

Personally, I'm more paranoid concerning whether the deletion actually worked when I deleted my LastPass three or four major security incidents ago...

Re: Lastpass Security Incident

#236

Post by zelon88 »

> We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement.

EXACTLY why so many companies opt to stay on-prem, to the amazement and bewilderment of every vendor sales rep that calls on the phone.

Go ahead and ask them which Cloud providers their company uses. Ask them which open-source libraries their SaaS uses. Ask them to show you the audits they've performed on THEIR supply chain this year. You won't get any answers.

So sick and tired of everyone jumping on the "more links in the chain is better" bandwagon.

Re: Lastpass Security Incident

#237

Post by hk1337 »

Beaver117 wrote: post #229

I know people will deny it but don't underestimate security by obscurity. Why use the most well known password manager which is a huge target for nation states everywhere? Nobody is attacking my provider (which I won't say)

I have never really liked the idea of a password manager synched to a central server. Everyone always made excuses for it because each one is encrypted for each user and whatnot but it just means an attacker only needs to hit one spot to get a slew of vaults.

I liked 1Password for a long time because it gave you an option to sync with iCloud, Dropbox, FTP, etc. Then they started their own service like LastPass and started trying to push people to that. They got backlash initially and turned the other abilities back on but I'm sure they're trying to make it as difficult as possible to continue to use anything but synching to their server.

I've since moved to Keepass and sync it with my NAS

Re: Lastpass Security Incident

#238

Post by roywiggins »

Zamicol wrote: post #214
foobiekr wrote: post #164

Earlier quoted context omitted.

Zero knowledge, 100% authority on downloaded JavaScript.

I wish there was a bigger push for integrity checking in the browser. It would be foundational to any solution that fixes that problem. There is already integrity checking for subresources: https://developer.mozilla.org/en-US/docs/Web/Security/Subres... Newcastle University had a proposal for website wide integrity checking: https://github.com/toreini/DOMtegrity Note that only 7 people have starred it on Github.

I don't think either of those help if the website itself is pwned? SRI is fine if your website is secure but the CDN is pwned, the other one seems to be a defense a website can use against a malicious extension, but the risk with LastPass is if the LastPass website is pwned it can just read your password. You'd need some way to transfer essentially signed app bundles to the browser for the browser to verify, which seems like a different sort of project.

Re: Lastpass Security Incident

#239

Post by Johnny555 »

Beaver117 wrote: post #229

I know people will deny it but don't underestimate security by obscurity. Why use the most well known password manager which is a huge target for nation states everywhere? Nobody is attacking my provider (which I won't say)

Nobody is attacking my provider

Would you know if they did? Would your provider know?

Re: Lastpass Security Incident

#240

Post by chris_wot »

sp332 wrote: post #68
mattacular wrote: post #48

The conspicuous lack of detail in this statement doesn't bode well...

It's not unusual when the investigation has just started.

They known enough to say "We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information."

I'd want to know what information they have gained access to.

Post reply on HN