Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

511–520 of 587 posts

Re: Lastpass Security Incident

#511

Post by closeparen »

zelon88 wrote: post #236

> We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement. EXACTLY why so many companies opt to stay on-prem, to the amazement and bewilderment of every vendor sales rep that calls on the phone. Go ahead and ask t…

Pretty sure on prem storage appliances have vulnerabilities in them just like everything else.

Re: Lastpass Security Incident

#513

Post by [deleted] »

tasuki wrote: post #496

I've been looking to migrate off LastPass to Bitwarden or KeePassXC, but can't decide: 1. First off, who's to say LastPass will actually delete my data when I delete my account? Could I in practice be increasing my exposure by starting to use something different? 2. Bitwarden: They look cool but "In September 2022, the company announced $100M series B financing". In my experience, usually, financing = bad. 3. KeePass…

[deleted]

Re: Lastpass Security Incident

#514

Post by avnigo »

clumsysmurf wrote: post #42

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

Yeah, in any migration—if you can—it's good practice to run both simultaneously for a while until you're convinced you've checked everything and you're ready to drop the old for the new without much downtime.

Re: Lastpass Security Incident

#515

Post by tomjen3 »

InvaderFizz wrote: post #277
chadash wrote: post #263

Earlier quoted context omitted.

I have interviewed many “senior” candidates who can’t do simple coding exercises. I think that starting out with a simple exercise like that weeds out a ton of people without putting undue burden on the good developers.

I ask a lot of questions that I preface with: I hope you are slightly insulted by the questions I'm about to ask. They get progressively more complex as we go, but the candidate is fully aware they are filter questions that I hope they clear with zero effort.

Why not just start with the questions you consider the minimum level to clear?

Re: Lastpass Security Incident

#516

Post by [deleted] »

tsukikage wrote: post #454
gorgoiler wrote: post #341

Earlier quoted context omitted.

Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…

Can you even commit to this much? Many card games have a reduced deck - e.g. lots of French card games use a 36-card deck. Some card games use multiple decks mixed together (e.g. Canasta). Some have extra cards (jokers are common, there are others); some have entire extra suits (e.g. games that used to be played with various forms of tarot decks). All this stuff needs to be parameterised, and suddenly you have an ent…

[deleted]

Re: Lastpass Security Incident

#517

Post by hn_throwaway_99 »

zelon88 wrote: post #503
hn_throwaway_99 wrote: post #491

Earlier quoted context omitted.

> When you're not, you have to worry about everyone in your supply chain opening sketchy PDFs. That's absolutely not correct. Besides, I have more respect for the security and operations procedures for AWS, GCP and Azure than I do for 99% of startups running their own infrastructure. But my primary point is that you seem to be arguing that being on prem is inherently more secure, and more importantly, being in the cl…

It doesn't matter how secure 4 providers are. There are only 4. OpSec won't stop a submarine from bombing underwater fiber. OpSec won't stop a missile heading for the data center. The strategic importance of our consolidated infrastructure WILL be a paramount target for any enemy of the west. On-prem business is a diversified attack vector. Cloud storage is a consolidated attack vector. Would russia rather attack 100…

If your primary concern is global thermonuclear war, then like other commenters have said, I think we'll have much more important things to worry about.

Re: Lastpass Security Incident

#518

Post by frankhoward »

Finding your partner cheating isn’t easy. People who cheat are generally smart enough to hide it. Therefore, their partners often spend nights awake wondering if their suspicions are true or not. Luckily today you are going to read about a way through which you can know for sure if your partner is cheating on you. This happens by sending a mail to Jeffreyethicalhacker Don’t worry, you aren’t going to need your partner’s phone in order to see what your partner had been up to. The way I told you worked for me, and it was remotely. contact him via email; Jeffreyethicalhacker@gmail.com whatsapp or Text on : +1 (747)345-9036 umyu

Re: Lastpass Security Incident

#519

Post by frankhoward »

Finding your partner cheating isn’t easy. People who cheat are generally smart enough to hide it. Therefore, their partners often spend nights awake wondering if their suspicions are true or not. Luckily today you are going to read about a way through which you can know for sure if your partner is cheating on you. This happens by sending a mail to Jeffreyethicalhacker Don’t worry, you aren’t going to need your partner’s phone in order to see what your partner had been up to. The way I told you worked for me, and it was remotely. contact him via email; Jeffreyethicalhacker@gmail.com whatsapp or Text on : +1 (747)345-9036 ymjh

Re: Lastpass Security Incident

#520

Post by cmsj »

tornato7 wrote: post #498
tasuki wrote: post #496

I've been looking to migrate off LastPass to Bitwarden or KeePassXC, but can't decide: 1. First off, who's to say LastPass will actually delete my data when I delete my account? Could I in practice be increasing my exposure by starting to use something different? 2. Bitwarden: They look cool but "In September 2022, the company announced $100M series B financing". In my experience, usually, financing = bad. 3. KeePass…

Why no 1Password on your list?

1Password has the same fundamental flaw that LastPass does - they insist on hosting your vault on their servers.

That is a bad idea and you shouldn't use a service with that requirement. Use something you can self host, or have the choice of DropBox/iCloud/etc for syncing.

Post reply on HN