Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

521–530 of 587 posts

Re: Lastpass Security Incident

#521

Post by lesuorac »

marginalia_nu wrote: post #394
gorgoiler wrote: post #341

Earlier quoted context omitted.

Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…

Yeah I'd model it as something like this maybe? public enum Color { RED, BLACK } public enum Suit { Diamonds(RED, '♦'), Hearts(RED, '♥'), Clubs(BLACK, '♣'), Spades(BLACK, '♠'); Color color; char symbol; public Suit(Color color, char symbol) { this.color = color; this.symbol = symbol; } } public enum Rank { Ace('A'), Two('2'), //... } public record Card(Suit suit, Rank rank) { // ... } The question is fundamentally br…

Hey, the client just said they want to play with Jokers can you add this in by lunch for the demo?

Thanks!

Re: Lastpass Security Incident

#522

Post by CheBuzz »

sillyapple wrote: post #505
tasuki wrote: post #496

I've been looking to migrate off LastPass to Bitwarden or KeePassXC, but can't decide: 1. First off, who's to say LastPass will actually delete my data when I delete my account? Could I in practice be increasing my exposure by starting to use something different? 2. Bitwarden: They look cool but "In September 2022, the company announced $100M series B financing". In my experience, usually, financing = bad. 3. KeePass…

I've been very happy with Bitwarden. If things go south because of getting funding there are some good forks of the server you can self-host (vaultwarden).

Another happy vaultwarden self-hoster here. It requires almost not maintenance from me once I got everything setup.

Re: Lastpass Security Incident

#523

Post by caminante »

eropple wrote: post #360
caminante wrote: post #303

Earlier quoted context omitted.

!!! You're missing the point. The premise is that someone capable can blast through trivial assignments in no time. Either this is the final proficiency challenge or there are subsequent, harder questions. In the former case, why not see the salary/offer and then decide?

Typically, because one has other opportunities that are no less compelling and where potential employers show respect for candidates' time. I have a GitHub profile with a lot of code on it and on my resume I highlight projects I've done a lot of work on. "What if faked tho?"--there's literally too much there to be worth faking . If a hiring manager looks at my resume, has the option of going to my GitHub profile, and…

> "What if faked tho?"

> If a hiring manager looks at my resume, has the option of going to my GitHub profile, and between the two goes "I'm going to hand him a college-level Java problem because I'm not sure,"

I know we're talking hypotheticals. I get your position 100%, and good for you.

My view is that I'd tell you that

1. I've seen your Github profile

2. However, I didn't have time to go through your entire Github profile looking at your efficiency and productivity. I want to do a quick, ad-hoc programming exercise to see how fast you operate on basic tasks (which #1 doesn't readily address). I expect you to crush it really fast and this is the only coding exercise I'll have you do.

To me, that doesn't seem unreasonable if I'm upfront about expectations. Your response will also say a lot about you (not necessarily negative, but for fit).

These requirements come up because someone always slips through diligence. While you might be getting punished, interviewers are trying to de-risk candidates as much (and as fast) as possible.

Re: Lastpass Security Incident

#524

Post by bnmathm »

ThunderSizzle wrote: post #292

My wife's Instagram was hacked and then banned. It was using a Lastpass generated and managed password. I've since redid all her credentials in the password keeper I personally use. I suspected Lastpass was lieing about how significant their security leak was back in August, considering my wife's account getting hacked and banned was pretty soon after the news hit.

I have to believe that if hackers hit the treasure trove of Lastpass customer passwords, Instagram is not going to be their first target. We'd be seeing financial fraud first and foremost, likely sparingly at first, to not alert everyone to the fact that all of our passwords are compromised.

Re: Lastpass Security Incident

#525

Post by neurostimulant »

tasuki wrote: post #496

I've been looking to migrate off LastPass to Bitwarden or KeePassXC, but can't decide: 1. First off, who's to say LastPass will actually delete my data when I delete my account? Could I in practice be increasing my exposure by starting to use something different? 2. Bitwarden: They look cool but "In September 2022, the company announced $100M series B financing". In my experience, usually, financing = bad. 3. KeePass…

> Bitwarden: They look cool but "In September 2022, the company announced $100M series B financing". In my experience, usually, financing = bad.

You can self-host bitwarden using the opensource implementation of bitwarden server. It includes everything, even the pro features, and supports multiple accounts for the whole family for example: https://github.com/dani-garcia/vaultwarden

Re: Lastpass Security Incident

#526

Post by neurostimulant »

celestialcheese wrote: post #5
snailmailman wrote: post #4

Earlier quoted context omitted.

How is it a PITA to move off lastpass? I switched to Bitwarden and it was a piece of cake. Exported all passwords. Imported all passwords. Pretty much all password managers can import/export as a CSV or similar.

It's easy if you don't share passwords with others. I have my whole family and business using it, and there's lots of shared folders. Convincing my wife and colleagues to all switch simultaneously isn't feasible unless this data fiasco gets worse.

It'll only going to get worse. Better move now before it's too late.

Re: Lastpass Security Incident

#527

Post by neurostimulant »

symlinkk wrote: post #211
SparkyMcUnicorn wrote: post #147

Earlier quoted context omitted.

I can never recommend 1Password enough. When it comes to hosted options, they are hands down the best. Worth pointing out that they also have integrated 2FA, if you're satisfied with first and second factor living in the same spot. https://1password.com

> if you're satisfied with first and second factor living in the same spot It’s no longer “2FA” then.

Eh, it's still a lot better than sms 2fa.

Re: Lastpass Security Incident

#528

Post by [deleted] »

eropple wrote: post #497
tsukikage wrote: post #452

Earlier quoted context omitted.

Personally, I only ever ask people to solve coding/problem-solving questions live. The best experience IMO is when we talk through the problem together, since this approximates what collaborating with this person on real tasks will be like - not very well at all, but about as well as one can do in the amount of time available for a live interview. However, I do understand where the offline exercise idea comes from -…

I think this is a good analysis of where the offline idea started from, but in my experience the majority of interviewers who want you to do a "take home" thing are asking you to sign up for a multiple-hour mess of a project. That's where the lack of respect comes from, and the lack of acknowledgment of the market--most people you want to hire are already employed, after all, and time pressure from life is a thing. M…

[deleted]

Re: Lastpass Security Incident

#529

Post by [deleted] »

sodapopcan wrote: post #316
cratermoon wrote: post #283

Earlier quoted context omitted.

Especially now that the "senior" titled is handed out to people with 3-5 years of experience.

Ya, most people who have been in the game for a year ask for "senior" position. I'm pretty sure this is why there is "staff" now. Well, I'm not sure how long "staff" has been a thing as I've never worked at a company that has that title, just interviewed for them (nb: I interviewed for "senior" positions at said companies).

[deleted]

Re: Lastpass Security Incident

#530

Post by wonderwonder »

jaywalk wrote: post #504
wonderwonder wrote: post #488

Earlier quoted context omitted.

My favorite is when they actually limit what special characters you can use. Must include 1 of x special characters. Why? I always just assume they baked their own password storage and couldn't figure out how to handle the whole set of special characters

Multiple times I've found that this is caused by a web application firewall that is intended to mitigate SQL injection attacks. So they disallow the characters that would commonly be used in those attacks.

Interesting, I had never considered that
Post reply on HN