Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

291–300 of 587 posts

Re: Lastpass Security Incident

#291

Post by vel0city »

VoidWhisperer wrote: post #272
MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

You would also likely need a way to get this to work on a mobile phone too. I know from personal experience that there is plenty of times nowadays that I end up logging in to various places using my password manager (not lastpass) on mobile.

Android and iOS work with Bluetooth keyboards.

Re: Lastpass Security Incident

#292

Post by ThunderSizzle »

My wife's Instagram was hacked and then banned. It was using a Lastpass generated and managed password. I've since redid all her credentials in the password keeper I personally use.

I suspected Lastpass was lieing about how significant their security leak was back in August, considering my wife's account getting hacked and banned was pretty soon after the news hit.

Re: Lastpass Security Incident

#293

Post by deepfriedbits »

InvaderFizz wrote: post #277
chadash wrote: post #263

Earlier quoted context omitted.

I have interviewed many “senior” candidates who can’t do simple coding exercises. I think that starting out with a simple exercise like that weeds out a ton of people without putting undue burden on the good developers.

I ask a lot of questions that I preface with: I hope you are slightly insulted by the questions I'm about to ask. They get progressively more complex as we go, but the candidate is fully aware they are filter questions that I hope they clear with zero effort.

That's a clever approach to the situation.

Re: Lastpass Security Incident

#294

Post by k7sune »

How does LastPass implement their security challenge, where they rate your passwords and compare them to known mass password leak incidents? Does that require an upload of plaintext passwords to the server?

Re: Lastpass Security Incident

#295

Post by wizofaus »

k7sune wrote: post #294

How does LastPass implement their security challenge, where they rate your passwords and compare them to known mass password leak incidents? Does that require an upload of plaintext passwords to the server?

Not sure why you would think that was necessary or at all likely. We have these things called hashes...

Re: Lastpass Security Incident

#296

Post by marklyon »

k7sune wrote: post #294

How does LastPass implement their security challenge, where they rate your passwords and compare them to known mass password leak incidents? Does that require an upload of plaintext passwords to the server?

Doesn't it run zxcvbn to calculate the score on the logged-in client?

Re: Lastpass Security Incident

#297

Post by imiric »

MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

No offense, but this is such a hacker solution. :) And as mentioned, already exists in many forms.

Passwords and login credentials are dead. No user wants to deal with them. Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. In that sense, they don't improve security overall, and introduce many other issues (a centralized honeypot, in the case of services like LastPass).

The industry has been trending towards OTP, FIDO, WebAuthn, and all sorts of identity solutions, instead for years now. It's clear that nobody wants to manage credentials, and having a separate security device is not something mainstream audiences will adopt, so maybe by integrating it with smartphones, this will finally catch on.

It will likely take years for most of the industry to move away from passwords, and we'll likely still require traditional credentials in some cases. The myriad of standards out there is a hurdle for adoption, but it feels like we're settling on something that might be usable for everyone.

Re: Lastpass Security Incident

#298

Post by andirk »

k7sune wrote: post #294

How does LastPass implement their security challenge, where they rate your passwords and compare them to known mass password leak incidents? Does that require an upload of plaintext passwords to the server?

Oh like 1st interview question is: "What's your password?".

A few jobs ago I needed some IT help and the guy asked me that. I told him my very vulgar password loudly. Then went back to my desk and changed it.

Re: Lastpass Security Incident

#299

Post by darkhelmet »

the_svd_doctor wrote: post #210
aussieguy1234 wrote: post #132

Earlier quoted context omitted.

LastPass is architectured so that your master password is never sent to their servers. Decryption of your vault happens locally on your device. Maybe such an attacker might get your email address (username).

Is there a web UI ? If yes - I guess an attacker can just send "bad" JS to the client and steal the master password no? Or inject a malicious update. Most people probably have auto updates?

Yes, this is one of the concerns. In theory a browser addon should take a while for the bad guys to update and publish, but are the existing addons downloading and using server-provided JS? One would hope not, but that's hardly a safe assumption these days. I know Mozilla takes a pretty hard stance against this sort of thing, but it's not all caught in review. And then there's the electron style apps - those should be static too, right? right?? Also not a safe assumption. And yes, there is a pure-web UI where the code is downloaded from their servers.

Anyway - it's not a good position to be in.

Re: Lastpass Security Incident

#300

Post by bigDinosaur »

roywiggins wrote: post #238
Zamicol wrote: post #214

Earlier quoted context omitted.

I wish there was a bigger push for integrity checking in the browser. It would be foundational to any solution that fixes that problem. There is already integrity checking for subresources: https://developer.mozilla.org/en-US/docs/Web/Security/Subres... Newcastle University had a proposal for website wide integrity checking: https://github.com/toreini/DOMtegrity Note that only 7 people have starred it on Github.

I don't think either of those help if the website itself is pwned? SRI is fine if your website is secure but the CDN is pwned, the other one seems to be a defense a website can use against a malicious extension, but the risk with LastPass is if the LastPass website is pwned it can just read your password. You'd need some way to transfer essentially signed app bundles to the browser for the browser to verify, which se…

I assume ultimately something like signed releases will become a thing on the web, with the signing process being separate from the other processes so that a hack has to compromise two entirely different systems, not just the build pipeline, to allow new JS to run. Currently the only thing that is signed is the SSL certificate which of course guarantees precisely nothing about the actual website content served from the server other than that someone didn't tamper with it after it was sent.
Post reply on HN