Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

271–280 of 587 posts

Re: Lastpass Security Incident

#271

Earlier quoted context omitted.

I have a different perspective. I feel that specific coding task tells me absolutely nothing about the seniority of the person performing the task and tells me very little about their qualifications.

But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor?

> But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor?

Yes.

But I think there's a reasonable upper limit to the amount of time a company can expect someone to spend on a job opportunity.

If they're burning an appreciable amount of that time on a trivial coding exercise, that's not great.

Re: Lastpass Security Incident

#272

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

You would also likely need a way to get this to work on a mobile phone too. I know from personal experience that there is plenty of times nowadays that I end up logging in to various places using my password manager (not lastpass) on mobile.

Re: Lastpass Security Incident

#273

Earlier quoted context omitted.

1. Get access to build infrastructure (e.g. via supply chain attack) 2. Inject code in build to export user's passwords to remote server after update is installed

This kind of thing has already happened. Chinese hackers got into the Juniper VPN source code and replaced a key pair with their own. They even updated the tests so that it would pass. This went unnoticed for years .

Arguably it wasn't secure in the first place if it had backdoor like that.

Re: Lastpass Security Incident

#274

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

You can use the Trezor as a password manager. Passwords are not stored on the device, but the key and all encryption/decryption happens on the device.

Re: Lastpass Security Incident

#275
post #184

The best is to use something like Keepassxc, synced peer to peer by Synchting or Resilio. Nobody will be involved with your passwords. Keepassxc supports Yubikey, so you can lock it down strongly!

Do you not suggest using Dropbox to sync KeePassXC? Their FAQ on site seems to support (and encourage?) the use of Dropbox for syncing.

Dropbox works really well with KP and I used it for years. The problem was that I ended up with more devices than Dropbox supported for free so I switched to Syncthing. If you only have three devices use Dropbox.

Re: Lastpass Security Incident

#276

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

such as this open source device? https://hackaday.com/tag/mooltipass/

Re: Lastpass Security Incident

#277
post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

I have interviewed many “senior” candidates who can’t do simple coding exercises. I think that starting out with a simple exercise like that weeds out a ton of people without putting undue burden on the good developers.

I ask a lot of questions that I preface with: I hope you are slightly insulted by the questions I'm about to ask.

They get progressively more complex as we go, but the candidate is fully aware they are filter questions that I hope they clear with zero effort.

Re: Lastpass Security Incident

#278

Earlier quoted context omitted.

But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor?

> But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor? Yes. But I think there's a reasonable upper limit to the amount of time a company can expect someone to spend on a job opportunity. If they're burning an appreciable amount of that time on a trivial coding exercise, that's not great.

It's 60 minutes as a very high estimate. You might spend a life time together.

Re: Lastpass Security Incident

#279
post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

It's a great way to weed out the junior devs that cheated their way through school (or are too dumb to figure it out via stackoverflow) and the senior devs that haven't actually done any real programming in a long time.

An engineer at our competitor got laid off and my PM found out and hired the guy to do FPGA work. My PM knew the guy through some contracts we had with the competitor and assumed he was an expert in the field. Turns out the guy was more of middleman between program management and the engineers so while he could talk about the work, he hadn't really done it in like 10 years. My PM got the hiring expedited and since we don't really do interview tests in our industry, the guy was now on our team before anyone could ask any pertinent questions.

Long story short, the FPGA team starts assigning him work but it's taking way too long and he's asking for more documentation and for help on things that he definitely would have worked on in his supposed previous job. Eventually we all figure out that he kinda overstated how fresh his skills are and we transition him to a sort of documentation role so he wasn't burning hours on things he just couldn't handle. While he was perfectly capable of doing that kind of work, it involved a lot of insight to our design so it took him a while to get onboarded to the system and able to properly describe the design. Eventually he was doing good work and got the project to the point where he wasn't needed but he left a bad taste in everyone's mouth. We could have hired two junior engineers to do the work he was doing for the same price and probably gotten it done much faster. After the guy transfered over to another project, we reamed out our PM about his hiring decision and begged him to give us some input next time. Of course, due to the waste of money from the last guy, the functional managers stopped taking hiring inputs from our project and would just assign whoever the fuck they thought we needed despite the kind of roles we actually needed.

Re: Lastpass Security Incident

#280
post #250

Earlier quoted context omitted.

It is still 2 factor, breaching the password manager is a corner case that you can decide to cover or not. It seems like for critical accounts you should NOT. For derived accounts, it should be better than just a password.

Only very marginally so. Or what would you say storing a (unique, long) password next to a TOTP hash actually achieves?

Well the totp (even in your passwd manager) defends against phishing I'd thought vs password alone.
Post reply on HN