Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

261–270 of 587 posts

Re: Lastpass Security Incident

#261

Post by bigDinosaur »

sirmarksalot wrote: post #149
bigDinosaur wrote: post #41

Earlier quoted context omitted.

The core problem is really that passwords suck and should never be the entirety of authentication. Time for hardware tokens! (admittedly there are some big problems when people lose tokens, but at least that's not a problem of insecurity ;-))

Depends on how you define "insecurity". Availability is one of the pillars of security, so even your joke falls apart. Several years ago the trendy thing to do for security was to get a USB-A security dongle and lock your important accounts with it. Nowadays, laptops from several major manufacturers no longer ship with a USB-A port, so if you need to log in again and don't have a USB-C dock handy, you're locked out u…

Isn't availability usually from the service still being accessible in a technical sense? Password lockout policies will also result in people being locked out often until manual review or the use of some (hopefully secure) second factor. With hardware tokens there just needs to be an established - and efficient - process to replace them or allow access on an ad-hoc basis for exceptional cases (a bit iffy perhaps but also possibly necessary given practicalities). There's no dispute that passwords mean you don't have to worry about things like what USB ports your laptop has, but that's mainly because of the fact they're just strings that you type in which is also their entire issue for phishing/hacking etc.

Either way, availability can be compromised by a hack due to passwords being phished and I think I'd prefer dealing with hardware tokens than the fallout of being phished or otherwise suffering credential compromise. That said at this point I probably wouldn't issue hardware tokens en masse until proper processes are in place to manage them (and their loss/breakage/etc) - it's certainly not solved to my satisfaction yet.

Re: Lastpass Security Incident

#262

Post by caminante »

matthewwolfe wrote: post #249
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

FizzBuzz interview questions are fair game[0] , especially if you're not networking in via referrals and are 1/5000 online applicants like the parent.

[0] https://www.joelonsoftware.com/2006/10/25/the-guerrilla-guid...

Re: Lastpass Security Incident

#263

Post by chadash »

mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

I have interviewed many “senior” candidates who can’t do simple coding exercises. I think that starting out with a simple exercise like that weeds out a ton of people without putting undue burden on the good developers.

Re: Lastpass Security Incident

#264

Post by kamranjon »

matthewwolfe wrote: post #249
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

I have a different perspective. I feel that specific coding task tells me absolutely nothing about the seniority of the person performing the task and tells me very little about their qualifications.

Re: Lastpass Security Incident

#265

Post by [deleted] »

zelon88 wrote: post #236

> We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement. EXACTLY why so many companies opt to stay on-prem, to the amazement and bewilderment of every vendor sales rep that calls on the phone. Go ahead and ask t…

[deleted]

Re: Lastpass Security Incident

#266

Post by somehnguy »

clumsysmurf wrote: post #42

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

Well, this completely explains where one of my Truecrypt volume passwords disappeared to after migrating away from LastPass years ago. Too bad the account has long since been deleted.

Re: Lastpass Security Incident

#267

Post by Mistletoe »

kamranjon wrote: post #264
matthewwolfe wrote: post #249

Earlier quoted context omitted.

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

I have a different perspective. I feel that specific coding task tells me absolutely nothing about the seniority of the person performing the task and tells me very little about their qualifications.

But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor?

Re: Lastpass Security Incident

#268

Post by MetaWhirledPeas »

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places.

- OS sees the device as a keyboard

- Two versions. One with bluetooth, and one with only USB for a little more security.

- Open source software package to sync your collection of PSDs

- Open source browser extension to autofill passwords

- Tiny keyboard on the device (detachable to share between your collection?)

Usage:

1. Install browser extension

2. Navigate to a password field

3. Follow prompt to populate password

Alternate usage:

1. Manually search for password using the device keyboard

2. Click into password field in browser

3. Press button on device to have it type the password

Or of course you could just view the password on the device if you prefer.

Re: Lastpass Security Incident

#269

Post by nindalf »

matthewwolfe wrote: post #249
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

No doubt when GP refused to complete the coding assessment the people who designed it thought “aha! Yet another non-coder filtered out by our process!”

Re: Lastpass Security Incident

#270

Post by xienze »

zzzeek wrote: post #260
xienze wrote: post #232

Earlier quoted context omitted.

Honestly I don't even bother with hosting it in a cloud instance. I host Bitwarden on my home network, and whenever one of my devices opens the Bitwarden browser plugin or mobile app (at home), it will automatically sync everything. From that point on you can continue using Bitwarden without it needing to connect to the server. So on one hand, I lose the ability to sync when I'm not on my home network. On the other h…

and what if your TV or thermostat, with access to your private network, gets compromised? do you have that machine locked down good enough to protect against an inside-the-firewall attack?

Stuff like that goes on a different VLAN that can only talk to the outside world (or not, depending on the case) and not the rest of the intranet.
Post reply on HN