Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

441–450 of 587 posts

Re: Lastpass Security Incident

#441

Earlier quoted context omitted.

But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor?

Making direct comparisons of software to trades generally needs to stop. I understand that it's merely an analogy, but it's not a good one. Nails are extremely well understood with little room for improvement while the smallest piece of software is not so well understood and has infinite room for improvement. There are a handful of traits about an engineer that can make them incredibly valuable to an org that you'll…

>I understand that it's merely an analogy, but it's not a good one.

Are there any good ones? I find that people introduce an analogy...it is discussed, another 'contradictory' analogy is introduced....and eventually someone has 'won' the argument referring to something completely unrelated, and thereby have 'won' the original argument, by default.

My boss is particularly good at his :-) To me, its a form of gaslighting.

As soon as i hear "But what if...?", or "it's as if...", I refuse to budge, and simply ask "Are we talking about 'the original subject', or 'Blacksmiths'? If it's the latter, let's talk about Japanese swordsmanship first, then the history of European metallurgy first - just to be on the same page."

Often used at the same time is the No True Scotsman fallacy.

Set ridiculous boundaries on the analogy, ignore the fallacies, and the original subject soon gets re-discussed. It's amazing how many people actualy find that uncomfortable.

Re: Lastpass Security Incident

#442

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

What would be considered a good alternative?

Re: Lastpass Security Incident

#443

Earlier quoted context omitted.

This sub-thread was talking about "that specific coding task", not about binary tasks [edit: trees] in general. You might be very valuable building, say, a database application, while not being able to balance a binary tree, but if you can't do whatever we can all come up with as a small coding assessment (" little deck of cards"). It sounds to me like a good first filter, plus then a good talking piece to have a con…

Ya, my bad (and also to your sibling comment), I have trouble with HN comment depth sometimes. Although I experienced recently what you said exactly! I was asked to build a deck of cards for the screening interview. It was a fun back-and-forth and I felt really good about things. Then in the next steps, I was asked to implement Conway's Game of Life. So like, I've been programming professionally for 13 years, I'm wel…

> I wish they would just say as much

Recruiters and subsequently hiring teams are often told they can't give much actual feedback to candidates, out of a fear for legal challenges. I cannot assess the validity of these fears, just relaying what I heard. I guess folks have been burned when their presumably-good faith attempts at feedback were twisted into inclusion and equal opportunity cases (which are also important subjects that I don't want to dismiss either).

Re: Lastpass Security Incident

#444
post #368

Earlier quoted context omitted.

I'm curious what did people migrate to, and is there any feature disparities?

I've tried LastPass, 1password, and Bitwarden. Bitwarden has been my favorite as I can selfhost it if I want (open source fork with feature parity)

But do you self host it?

Re: Lastpass Security Incident

#445
post #53

Earlier quoted context omitted.

Same. I use random passwords for any required security questions. It is funny when you call customer support and they ask you to verify a security question though.

Have you ever tried to see if they'd let you bypass the question? I've wondered if saying "it's a bunch of gibberish" could work.

I think the best way to do this is to use a passphrase so that it's clear that it's not just gibberish but you have the benefit that it's random text. Obviously at the end of the day, it all comes down to the person on the other end of the phone but I suspect they'd be more suspicious of someone saying "it's a bunch of gibberish" when they can see "grumpily siberian pampers panorama unroll aloof masculine mandatory" versus "YpZVpyQHsmPATt1P" (also the former is much easier to read over the phone).

Re: Lastpass Security Incident

#446

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

What would be considered a good alternative?

Bitwarden, Keypass and 1password seem to be some of the most popular ones.

Re: Lastpass Security Incident

#447

Earlier quoted context omitted.

You would also likely need a way to get this to work on a mobile phone too. I know from personal experience that there is plenty of times nowadays that I end up logging in to various places using my password manager (not lastpass) on mobile.

Android and iOS work with Bluetooth keyboards.

But not _as_ bluetooth keyboards, which is what the proposed feature requires.

Re: Lastpass Security Incident

#448

Earlier quoted context omitted.

Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…

That is a neat enumeration, but, the question did ask for classes and inheritance which this definitely isn't. Would you really just ignore the requirements and give the simplest starter as a way to start a conversation?

It’s important to be solving an actual problem. Modelling a deck of cards is probably not the problem — what are we actually solving? Building a new hearts.exe? Rendering a custom deck for a laser cutter? Tracking casino fraud?

Those would be better questions which could start off with a discussion about the general solution, followed by a quick “how would you model the cards part of this?” component.

Re: Lastpass Security Incident

#449

> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. https://blog.lastpass.com/2022/11/notice-of-recent-security-...

My wife's password for Instagram was hacked near September, which was stored there.

They lost user data and passwords and are lieing.

Re: Lastpass Security Incident

#450
post #297

Earlier quoted context omitted.

No offense, but this is such a hacker solution. :) And as mentioned, already exists in many forms. Passwords and login credentials are dead. No user wants to deal with them. Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. In that sense, they don't improve security overall, and introduce many other issues (a centrali…

Considering that 99% of web app password authentication reduces to email authentication via ‘forgot password’, a good first step would be dropping the password and just using emailed tokens (or links) directly.

except this is not good UX when sometimes the email links take minutes to arrive, if they arrive at all.
Post reply on HN