Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

381–390 of 587 posts

Re: Lastpass Security Incident

#381

Post by rtepopbe »

zzzeek wrote: post #255
Sakos wrote: post #136

Earlier quoted context omitted.

Far better than the blog post, which leaves out crucial info.

Just read it looking for that extra info and not seeing it? the blog post and this article seem to have the identical information in them. The blog post is in a series, so for background on the "four days in august" you can scroll down. it's certainly not acceptable that all they are saying is "certain elements of our customers’ information." very unacceptable, if it's credit card numbers or home addresses, they have…

They may have missed it, as I did.

The current update fits pretty well exactly on my screen, so I saw no hints that it was a series. After seeing the usual corporate speak and signoff, I assumed that was it.

I went looking in their history of posts for more information on the August incident but couldn't find anything, as the older installments do not show up individually.

Re: Lastpass Security Incident

#382

Post by neuronexmachina »

phphphphp wrote: post #198
nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

I’ll second the 1Password recommendations, it’s fantastic software that is becoming better and better. If you’re comfortable with cloud syncing, I can’t imagine a better option than 1Password. A top 1Password tip is that the business plans include free family plans for every member, so if you can get your employer to use 1Password then you’ll be able to get your personal account for free (which would include your fam…

> A top 1Password tip is that the business plans include free family plans for every member

Oh wow, thanks for that tip. My employer has 1Password Business and I had no idea about the deal: https://support.1password.com/link-family/

Re: Lastpass Security Incident

#383

Post by bendiksolheim »

zelon88 wrote: post #330
hn_throwaway_99 wrote: post #302

Earlier quoted context omitted.

LastPass blog post on Sept 15 said the hack was accomplished with a compromised developer machine: > Our investigation determined that the threat actor gained access to the Development environment using a developer’s compromised endpoint. While the method used for the initial endpoint compromise is inconclusive, the threat actor utilized their persistent access to impersonate the developer once the developer had succ…

You're missing the point entirely. When you're on prem you only have to worry about your own employees opening sketchy PDFs. When you're not, you have to worry about everyone in your supply chain opening sketchy PDFs. Nevermind the fact that the next time a major world conflict occurs, the big 4 cloud providers will probably be destroyed, taking about 90% of the western economy with it.

> When you're on prem you only have to worry about your own employees opening sketchy PDFs

This is just plain wrong. When you’re on prem you have to worry about configuring all of you hardware and software correctly yourself. Your firewalls, your SSH server(s), off site backup systems, hardware failures, software patching, access points to your network – the list goes on. Some of these are true for cloud services as well.

They are just different trade offs. Sometimes on prem makes sense, and sometimes cloud services makes sense. You can’t say that security is less of a concern in one of them.

> Nevermind the fact that the next time a major world conflict occurs, the big 4 cloud providers will probably be destroyed, taking about 90% of the western economy with it.

And it somehow does _not_ take your on prem system with it? Even though cloud providers are spread across the whole world, and your on prem system is most likely in one, single location?

Re: Lastpass Security Incident

#384

Post by fomine3 »

userbinator wrote: post #327
r1cka wrote: post #78

Earlier quoted context omitted.

This is years ago now, but every ampersand in my passwords came across wrong. I can't recall if it was missing or url encoded, but even passwords weren't safe.

That is especially surprising, considering that passwords are more than likely going to contain special characters.

Avoid such trouble is why I want to avoid using symbols for password. Just use more alphanum characters for strength.

Re: Lastpass Security Incident

#385

Post by Kostchei »

zelon88 wrote: post #330
hn_throwaway_99 wrote: post #302

Earlier quoted context omitted.

LastPass blog post on Sept 15 said the hack was accomplished with a compromised developer machine: > Our investigation determined that the threat actor gained access to the Development environment using a developer’s compromised endpoint. While the method used for the initial endpoint compromise is inconclusive, the threat actor utilized their persistent access to impersonate the developer once the developer had succ…

You're missing the point entirely. When you're on prem you only have to worry about your own employees opening sketchy PDFs. When you're not, you have to worry about everyone in your supply chain opening sketchy PDFs. Nevermind the fact that the next time a major world conflict occurs, the big 4 cloud providers will probably be destroyed, taking about 90% of the western economy with it.

yeh but it's not the saas/big 4 that has developer login locally as admin that gets owned and then is not segmented sufficiently to stop the spread, it's the scrappy startup. And I say this while working at a scrappy startup where there is no segmentation, every browses in a browser with sudo etc. see piriform and others. Your hate is not wrong of cloud but onprem is not necessarily more secure. Not at all. (IMO layers of abstraction and cost once you actually scale are the real negatives)

Re: Lastpass Security Incident

#386

Post by hgomersall »

Fire-Dragon-DoL wrote: post #351
heleninboodler wrote: post #343

Earlier quoted context omitted.

Wow. Is LastPass generally just really bad software? These bugs mentioned in this subthread make it sound like amateur hour.

It's packed with enormous amount of bugs that make the day to day experience terrible. I want to move but I'm terrified of the export process

I moved to 1password a few years ago and haven't regretted it for a second. I still have Lastpass installed, but it's probably getting to the point I can delete it.

Re: Lastpass Security Incident

#387

Post by Kiro »

nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

The built-in password manager in Chrome. Nothing to install and works seamlessly across all devices.

Re: Lastpass Security Incident

#388

Post by pprotas »

Barrin92 wrote: post #217
Gatsky wrote: post #175

Earlier quoted context omitted.

Can you give some idea why Bitwarden is better?

free for personal use, open source, cloud synced, no device limits. and as OP mentioned different server implementations if you want to host it yourself. No idea why people stick to any of the proprietary solutions.

You have no idea why people don’t want to self-host a service? Or don’t have the knowledge to do it (securely)?

Re: Lastpass Security Incident

#389

Post by kd5bjo »

patrickdavey wrote: post #364
gorgoiler wrote: post #341

Earlier quoted context omitted.

Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…

That is a neat enumeration, but, the question did ask for classes and inheritance which this definitely isn't. Would you really just ignore the requirements and give the simplest starter as a way to start a conversation?

When applying for a senior role, yes. Part of a senior developer’s job is to push back against “requirements” that don’t further business needs; in this case, an accurate, maintainable, and useful model of a deck of cards.

Re: Lastpass Security Incident

#390

Post by donkeyd »

zelon88 wrote: post #236

> We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement. EXACTLY why so many companies opt to stay on-prem, to the amazement and bewilderment of every vendor sales rep that calls on the phone. Go ahead and ask t…

> Ask them which open-source libraries their SaaS uses. Ask them to show you the audits they've performed on THEIR supply chain this year. You won't get any answers.

Well, even with private cloud and on-prem these are pretty relevant questions...

I Worked with a government organization where I was part of the team on-boarding a new on-prem system. It was purchased through a tender, where on-prem was a requirement. The product was SaaS by default, but they offered an on-prem version. We pretty much got a copy of the stack of containers and docker-compose file that they used to run their SaaS offering.

While running the application, I was missing a lot of context, since logging was minimal, so I asked the company how to connect a log store to get an overview of all the sub-systems. There was no option for this (then how did they monitor their SaaS?). So I used docker to get command line in the containers and see if I can find some logs there to then get into a log store. In one of them, I noticed an error because something in the container was trying to phone home with telemetry, to a server that wasn't owned by our supplier. 'Luckily', our on-prem box didn't have an internet connection, because of the sensitivity of our data.

This was when I realized that our supplier didn't roll their own containers, but just used off the shelf stuff they didn't even audit. So who knows what their SaaS offering was leaking from these containers? I mentioned this to both internal IT architects and the supplier and nobody really seemed to care.

This is a supplier that was named 'Leader' by Forrester and got a $30M funding round last year.

Post reply on HN