Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

281–290 of 587 posts

Re: Lastpass Security Incident

#281

Post by lxgr »

rexreed wrote: post #258
lxgr wrote: post #241

Earlier quoted context omitted.

Yubikeys (and more generally CTAP) do not really help with locking down local password managers. The KeePassXC FAQ even explicitly explains that.

From the KeePassXC FAQ: "Additionally, you can use a key file filled with an arbitrary number of random bytes or a YubiKey to further enhance your master key" https://keepassxc.org/docs/#faq-keepassx

From the same FAQ:

> So in a sense, it makes your password stronger, but technically it doesn't qualify as a separate second factor, since this is not an authentication scheme and also because the expected response doesn't change every time you try to decrypt your database.

I'd argue that the biggest threat against a (non-cloud-synced) password manager is a local database compromise, and the Yubikey does not meaningfully help here.

To be fair, I don't think anything can help in this threat model – a password manager is ultimately a key/value storage for bearer tokens, and if an attacker can exfiltrate those key/value pairs, it's game over.

So the Yubikey certainly helps against an otherwise too short/reused password manager unlock password, or against somebody shoulder-surfing your password and able to steal your database, but not otherwise tamper with the device you're decrypting it on.

But other than that – if somebody can steal your local database and sniff your password (e.g. via a key logger), they can probably also sniff your Yubikey challenge/response, which is returned via the USB HID protocol as well.

Re: Lastpass Security Incident

#282

Post by Steltek »

VoidWhisperer wrote: post #272
MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

You would also likely need a way to get this to work on a mobile phone too. I know from personal experience that there is plenty of times nowadays that I end up logging in to various places using my password manager (not lastpass) on mobile.

The phone would still see the device as a Bluetooth or USB keyboard and the "alternate usage" should work.

Re: Lastpass Security Incident

#283

Post by cratermoon »

matthewwolfe wrote: post #249
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

Especially now that the "senior" titled is handed out to people with 3-5 years of experience.

Re: Lastpass Security Incident

#284

Post by aesh2Xa1 »

Tijdreiziger wrote: post #215
freeplay wrote: post #153

Earlier quoted context omitted.

Bitwarden is better, but Vaultwarden (the self-hosted version written in Rust) is the absolute best option. Host it yourself on a free tier VM in one of the clouds, configure a backup solution, and never worry about it again. And you don't need to trust anyone with your passwords. Use tailscale if you want to get fancy and keep it off the public internet or go the easy route and install fail2ban and expose it via pub…

How much should you worry about security with a setup like this? I have reasonable Linux skills, but I wouldn’t want my VM to get pwned because I forgot to update it.

You can “self-host” using a service like Cloudron or (if they’ll still manage it for you) Sandstorm.io.

https://blog.cloudron.io/sharing-passwords-with-teammates/

Re: Lastpass Security Incident

#285

Post by hedora »

ocdtrekkie wrote: post #18
KyleBerezin wrote: post #16

Earlier quoted context omitted.

No one who uses unique passwords can remember them forever. It's a compromise of post-it notes vs managers. Either that or do account recovery every time you need to do your taxes (SOL for encrypted files though). I sadly write passwords down, but dream of a better option.

Post-It notes are a safer option than password managers. And it's absolutely outrageous to say this: But not every single account you have needs a unique password. Just ones which can actually allow someone to impersonate you meaningfully, cost you money, or gather sensitive data about you. Response to @palata because of rate-limiting: The problem is people tend not to only put unimportant accounts in their password…

Where do you store your TOTP tokens, then? Post It note?

Re: Lastpass Security Incident

#286

Post by ghosts_ »

next_xibalba wrote: post #155

> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. https://blog.lastpass.com/2022/11/notice-of-recent-security-...

I think this gives people a false sense of security, yes zero knowledge is extremely useful + cool, and certainly reduces the risk in event of a breach, but all it really means is that _all_ of your passwords are behind some encrypted blob in the open, that would be extremely difficult to decrypt. Not impossible. Certainly any average or even very high-end machine today would have a pretty much 0 percent chance at decrypting the data, it's still out there in the open forever. Imagine in 10 years we have some leaps in quantum computing or discover a flaw in the algorithms use, all a hacker would need to do is go back & decrypt the data to try some credential stuffing attack, etc.

TL;DR is short-term I wouldn't be freaking out of my password manager was hacked, but I would still definitely update all credentials at some point & treat it as an actual breach, and not an "oh no we were hacked but it's okay because zero-knowledge!".

Also how many times have they been hacked now? Who's still using last pass?

Re: Lastpass Security Incident

#287

Post by kilolima »

bmitc wrote: post #205
tux wrote: post #116

Never using online password manager is a good start. Only use encrypted local password manager preferably on encrypted file system and never use same passwords and emails. Best have seperate emails at least for the most important data. Also generating random 50+ alpha-numeric-symbols.

Is that safer than 1Password? According to their documentation, passwords inside 1Password are fully encrypted and only ever decrypted locally on the user's devices. So, it seems identical to the local use case you describe except that it's much more difficult to lose your passwords on 1Password. With passwords only locally on a single machine, if you lose the machine, you lose your passwords. Plus, there's no easy w…

You can share password stores locally across multiple machines using a USB drive. Or Syncthing.

Re: Lastpass Security Incident

#289

Post by ghosts_ »

gcanyon wrote: post #92

Just in time to give a boost to passkeys. https://fidoalliance.org/passkeys/

These probably won't replace password managers, just result in passkey managers... Dashlane already supports passkeys & 1password just announced intent to support soon.

Re: Lastpass Security Incident

#290

Post by tobiasSoftware »

tylerhou wrote: post #61
kome wrote: post #25

it's so baffling to me that people give ALL their password to a third party, commercial, organization...

What's the alternative? 1. Have people manage their own secrets storage? Most people don't have the time or ability do this securely either. I'd rather pay someone else to secure infra, code, distribution, encryption, backups, etc. for me. 2. Reuse the same password on every site? One site gets hacked and now you're screwed. 3. Memorize a unique, long password for every site? Not feasible. Third-party/commercial pass…

I've never used password managers, partly because I don't trust them and partly because I've found an alternative that I feel is secure enough and more convenient. I split my passwords into two parts, one secure part that is memorized but reused and one weak part that is written down but not reused.

The main ways people are hacked are re-use of passwords and writing passwords down. If someone gets access to one of my passwords, trying it in other sites won't work. If someone finds the written parts of my passwords, that won't work either as they would need to know the secure part of the password that I memorize. I can even easily take the written part of my password with me if I want to use a password on a different computer.

The only issue with this technique would be if someone finds multiple passwords of mine, they might be able to figure out the scheme and brute force other passwords, but if someone already has multiple passwords of mine and is taking the time and effort to go after me individually then I figure I am probably screwed any which way.

Post reply on HN