Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

451–460 of 587 posts

Re: Lastpass Security Incident

#451

Post by dspillett »

heleninboodler wrote: post #346
danenania wrote: post #307

Earlier quoted context omitted.

Considering that 99% of web app password authentication reduces to email authentication via ‘forgot password’, a good first step would be dropping the password and just using emailed tokens (or links) directly.

I hope not. Not only is this often frustratingly slow, it really complicates things for people who use devices where they don't receive email. Myself, I only receive email on my computer and one mobile device. I have several devices where having to click a link in an email to log into a site means annoying gyrations trying to transfer links from one device to the next. This is especially annoying when whatever mechan…

> means annoying gyrations trying to transfer links from one device to the next

There are alternatives to this, such as typing a code into the login prompt instead of following a link (which will be submitting that code). This does limit the size of token that can be used because it needs to not be too inconvenient for the user to type, but if the code's validity is sufficiently short-lived, and properly unguessable, this can be done without compromising security any more than it already is by involving SMTP in the process.

Of course the other problem with email-only password resets is that users often receive email on the same device they are trying to authenticate – so if someone has left a machine unlocked with their mail account logged in, an attacker can gain access to any site/app that uses this password reset mechanism. One of the reasons that email and SMS are not great choices for a second factor, and even less good choices for what is sometimes effectively the only factor.

Re: Lastpass Security Incident

#452

Post by tsukikage »

eropple wrote: post #360
caminante wrote: post #303

Earlier quoted context omitted.

!!! You're missing the point. The premise is that someone capable can blast through trivial assignments in no time. Either this is the final proficiency challenge or there are subsequent, harder questions. In the former case, why not see the salary/offer and then decide?

Typically, because one has other opportunities that are no less compelling and where potential employers show respect for candidates' time. I have a GitHub profile with a lot of code on it and on my resume I highlight projects I've done a lot of work on. "What if faked tho?"--there's literally too much there to be worth faking . If a hiring manager looks at my resume, has the option of going to my GitHub profile, and…

Personally, I only ever ask people to solve coding/problem-solving questions live. The best experience IMO is when we talk through the problem together, since this approximates what collaborating with this person on real tasks will be like - not very well at all, but about as well as one can do in the amount of time available for a live interview.

However, I do understand where the offline exercise idea comes from - it's not necessarily about lack of respect for candidates' time, but is generally done with the best of intentions in response to feedback, because candidates complain that the interview technical exercise scenario is needlessly artificial: in a live interview candidates do not usually have easy access to their usual tools or Google/Stackoverflow, and many feel pressure and panic from having to code/problemsolve live while someone is watching and feel they would do better if left alone to do the same thing for the same length of time.

Given the incredibly strong feelings either way, perhaps it might not be a terrible idea to let people choose which approach they prefer; but I've never seen any company's hiring do that, though, thinking about it, there really is no good reason why not (provided I still get to talk through the results of the offline exercise with the candidate during the live bit!)

Re: Lastpass Security Incident

#453

Post by usrusr »

Cthulhu_ wrote: post #414
rjbwork wrote: post #393

Earlier quoted context omitted.

Pretty much. I hold the record for our coding question in my company - 3 minutes and 54 seconds. Granted, I'm one of the two people that put the question together, but still. We've had candidates with "20 years of experience" completely unable to do what amounts to "call a web service, deserialize some json, write a couple for loops and if statements, and post back some json to a web service" in over an hour, or in a…

To be fair: it might be they have never done this before. At my previous company, we had a technical assessment - this was about ten years ago now. It boiled down to: read XML, do some math / business logic, and build a REST API to do so. Interestingly, ten years ago, at least half the applicants said they found it interesting because they had never worked with REST or JSON before. A lot were Java developers, so the…

And far more likely: done before, but never on anything even remotely close to a blank slate. You can spend years doing X, be very good at doing X, but only ever adapt some pre-existing precedent implementation of doing X to a new use case, or to a new underlying library, but never any green-fielding. That "implement X in a vacuum" test will rate many experienced people lower than some who have never ventured beyond textbook examples. It's not impossible that your real tasks have so much green field work in them that those experienced brown-fielders might actually be bad matches, but I suspect that those situations are much less common than the tests that select for green-fielders.

Re: Lastpass Security Incident

#454

Post by tsukikage »

gorgoiler wrote: post #341
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…

Can you even commit to this much?

Many card games have a reduced deck - e.g. lots of French card games use a 36-card deck. Some card games use multiple decks mixed together (e.g. Canasta). Some have extra cards (jokers are common, there are others); some have entire extra suits (e.g. games that used to be played with various forms of tarot decks).

All this stuff needs to be parameterised, and suddenly you have an enterprise-worthy class hierarchy and a ton of complexity before you've even really started on game-specific stuff.

Re: Lastpass Security Incident

#455

Post by phyzome »

heleninboodler wrote: post #343
Spunkie wrote: post #254

Earlier quoted context omitted.

Also if you try to export multiple times it will start spitting out exports full of duplicates. Only safe way is to export right after a fresh session login.

Wow. Is LastPass generally just really bad software? These bugs mentioned in this subthread make it sound like amateur hour.

Last I checked, they still didn't have a useful Content-Security-Policy header on their Web Vault (which would prevent XSS), and also didn't have a way to separate "being logged into the extension" from "being logged into the Web Vault".

I... would definitely not recommend them, no.

Re: Lastpass Security Incident

#457

Post by milosmns »

a_c wrote: post #368
clumsysmurf wrote: post #42

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

I'm curious what did people migrate to, and is there any feature disparities?

Used BitWarden for years, happy with it. Recently switched to Nord Pass, also happy with it. Not sure about feature disparity though, just mentioning some ideas in case you're researching alternatives.

Re: Lastpass Security Incident

#459

Post by neevans »

8n4vidtmkvmk wrote: post #304
wizofaus wrote: post #295

Earlier quoted context omitted.

Not sure why you would think that was necessary or at all likely. We have these things called hashes...

that doesn't explain anything. they shouldn't be uploading unsalted hashes either. and if it's salted, it won't match with any database

if salted hash is leaked then it doesn't matter and does not need to be detected anyway.

Re: Lastpass Security Incident

#460

Post by pcthrowaway »

cwkoss wrote: post #74

If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts

Fuck. If you're a lastpass user, you kind of don't have a choice. I can't log into accounts I use for socializing, work, banking, etc. without lastpass
Post reply on HN