Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

311–320 of 587 posts

Re: Lastpass Security Incident

#311

Post by bmitc »

kilolima wrote: post #287
bmitc wrote: post #205

Earlier quoted context omitted.

Is that safer than 1Password? According to their documentation, passwords inside 1Password are fully encrypted and only ever decrypted locally on the user's devices. So, it seems identical to the local use case you describe except that it's much more difficult to lose your passwords on 1Password. With passwords only locally on a single machine, if you lose the machine, you lose your passwords. Plus, there's no easy w…

You can share password stores locally across multiple machines using a USB drive. Or Syncthing.

Why? And why is that more secure?

Re: Lastpass Security Incident

#313

Post by [deleted] »

zelon88 wrote: post #236

> We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement. EXACTLY why so many companies opt to stay on-prem, to the amazement and bewilderment of every vendor sales rep that calls on the phone. Go ahead and ask t…

[deleted]

Re: Lastpass Security Incident

#314

Post by selcuka »

ilyt wrote: post #273
jiggawatts wrote: post #231

Earlier quoted context omitted.

This kind of thing has already happened. Chinese hackers got into the Juniper VPN source code and replaced a key pair with their own. They even updated the tests so that it would pass. This went unnoticed for years .

Arguably it wasn't secure in the first place if it had backdoor like that.

It doesn't have to a backdoor. A malicious employee can have access to the keys.

Re: Lastpass Security Incident

#315

Post by sodapopcan »

Mistletoe wrote: post #267
kamranjon wrote: post #264

Earlier quoted context omitted.

I have a different perspective. I feel that specific coding task tells me absolutely nothing about the seniority of the person performing the task and tells me very little about their qualifications.

But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor?

Making direct comparisons of software to trades generally needs to stop. I understand that it's merely an analogy, but it's not a good one. Nails are extremely well understood with little room for improvement while the smallest piece of software is not so well understood and has infinite room for improvement. There are a handful of traits about an engineer that can make them incredibly valuable to an org that you'll never measure by putting the most weight on their ability to balance a binary tree (to use the cliched example).

Re: Lastpass Security Incident

#316

Post by sodapopcan »

cratermoon wrote: post #283
matthewwolfe wrote: post #249

Earlier quoted context omitted.

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

Especially now that the "senior" titled is handed out to people with 3-5 years of experience.

Ya, most people who have been in the game for a year ask for "senior" position. I'm pretty sure this is why there is "staff" now. Well, I'm not sure how long "staff" has been a thing as I've never worked at a company that has that title, just interviewed for them (nb: I interviewed for "senior" positions at said companies).

Re: Lastpass Security Incident

#317

Post by Too »

MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

Isn’t this a yubikey? Except a yubikey can also do a lot more, primarily sign tokens without private key ever leaving the device.

Which, as someone else explained below, is far superior to plain text passwords.

Re: Lastpass Security Incident

#318

Post by adgjlsfhk1 »

bigDinosaur wrote: post #300
roywiggins wrote: post #238

Earlier quoted context omitted.

I don't think either of those help if the website itself is pwned? SRI is fine if your website is secure but the CDN is pwned, the other one seems to be a defense a website can use against a malicious extension, but the risk with LastPass is if the LastPass website is pwned it can just read your password. You'd need some way to transfer essentially signed app bundles to the browser for the browser to verify, which se…

I assume ultimately something like signed releases will become a thing on the web, with the signing process being separate from the other processes so that a hack has to compromise two entirely different systems, not just the build pipeline, to allow new JS to run. Currently the only thing that is signed is the SSL certificate which of course guarantees precisely nothing about the actual website content served from t…

Who hosts the signature? If you've hacked someones server enough to push out new JS what's to stop you from signing it?

Re: Lastpass Security Incident

#319

Post by sverhagen »

sodapopcan wrote: post #315
Mistletoe wrote: post #267

Earlier quoted context omitted.

But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor?

Making direct comparisons of software to trades generally needs to stop. I understand that it's merely an analogy, but it's not a good one. Nails are extremely well understood with little room for improvement while the smallest piece of software is not so well understood and has infinite room for improvement. There are a handful of traits about an engineer that can make them incredibly valuable to an org that you'll…

This sub-thread was talking about "that specific coding task", not about binary tasks [edit: trees] in general. You might be very valuable building, say, a database application, while not being able to balance a binary tree, but if you can't do whatever we can all come up with as a small coding assessment ("little deck of cards"). It sounds to me like a good first filter, plus then a good talking piece to have a conversation about in an in-person.

Re: Lastpass Security Incident

#320

Post by SoftTalker »

sodapopcan wrote: post #315
Mistletoe wrote: post #267

Earlier quoted context omitted.

But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor?

Making direct comparisons of software to trades generally needs to stop. I understand that it's merely an analogy, but it's not a good one. Nails are extremely well understood with little room for improvement while the smallest piece of software is not so well understood and has infinite room for improvement. There are a handful of traits about an engineer that can make them incredibly valuable to an org that you'll…

That's why the programming tasks are simple. FizzBuzz, or "implement a deck of cards."

Sure there are different ways to do this but it's a small enough task that the quality of the solution is easy to judge.

I think the nail analogy works. If a blacksmith can't make a decent nail he shouldn't be hired. Same if a developer can't use one of a few very well-known standard library data structures to implement a deck of cards.

Post reply on HN