Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

541–550 of 587 posts

Re: Lastpass Security Incident

#541

Post by ocdtrekkie »

Marsymars wrote: post #540
ocdtrekkie wrote: post #18

Earlier quoted context omitted.

Post-It notes are a safer option than password managers. And it's absolutely outrageous to say this: But not every single account you have needs a unique password. Just ones which can actually allow someone to impersonate you meaningfully, cost you money, or gather sensitive data about you. Response to @palata because of rate-limiting: The problem is people tend not to only put unimportant accounts in their password…

> People have started storing their TOTP tokens in their password managers, which effectively reimplements single-factor authentication! The thing is that many services are now requiring TOTP in places where I don't want it , since I was already using a strong/unique password, and the TOTP requirement is effectively just to protect the service from having to deal with users who get their passwords stolen. If you're g…

I think you'd be drastically better off not wasting effort with a strong/unique password on places you "don't want" MFA, in favor of using MFA, which is always better at defeating an attacker than any password.

Re: Lastpass Security Incident

#542

Post by delecti »

dodgerdan wrote: post #377
a_c wrote: post #368

Earlier quoted context omitted.

I'm curious what did people migrate to, and is there any feature disparities?

1Password. The largest feature disparity is 1password is designed and built by competent engineers. The history of breaches and technical mistakes Lastpass has made over the years is amazing for a tech company let alone a password manager.

How is the user experience though? "Designed and built by competent engineers" is reassuring in the face of security breaches, but often means it's less convenient to interact with on a day-to-day basis.

Re: Lastpass Security Incident

#543

Post by tasuki »

goosesanta wrote: post #537
tasuki wrote: post #496

I've been looking to migrate off LastPass to Bitwarden or KeePassXC, but can't decide: 1. First off, who's to say LastPass will actually delete my data when I delete my account? Could I in practice be increasing my exposure by starting to use something different? 2. Bitwarden: They look cool but "In September 2022, the company announced $100M series B financing". In my experience, usually, financing = bad. 3. KeePass…

Just use keepassxc and be master of your keys. You have to move forward. Every 6 months I hear about a breach at lastpass. I assumed only clueless normies were left on it, but I guess their efforts to blockade data exports were effective.

Perhaps I'm a clueless normie :)

The KeePassXC browser extension doesn't have exactly stellar reviews. As for KeePassXC itself, I'm a little hesitant to use something that makes the UX so painful I have to copy the usernames and passwords.

That said, switching from LastPass to Bitwarden seems a little pointless: yes Bitwarden is a younger company and perhaps hasn't managed to mess up their product yet, but knowing life it's just a matter of time and then I'm at a worse place than where I've started.

> Every 6 months I hear about a breach at lastpass.

Have any led to leakage of users' passwords?

Re: Lastpass Security Incident

#544

Post by bee_rider »

eru wrote: post #374
bee_rider wrote: post #365

Earlier quoted context omitted.

You could have it MITM between your keyboard and computer. Depending on the mode it records your key presses to an entry, or replays an entry. Otherwise it just passes through. Probably just needs a screen and like 3 buttons: record/play/navigate mode (use your keyboard to actually navigate).

That model (with record) would need me to come up with passwords and type them. Seems like a hassle and a security problem.

Needs an “insert random text and record” button too I guess.

Re: Lastpass Security Incident

#545

Post by zzzeek »

xienze wrote: post #270
zzzeek wrote: post #260

Earlier quoted context omitted.

and what if your TV or thermostat, with access to your private network, gets compromised? do you have that machine locked down good enough to protect against an inside-the-firewall attack?

Stuff like that goes on a different VLAN that can only talk to the outside world (or not, depending on the case) and not the rest of the intranet.

Here's where I get a little more naive....do you....have one VLAN that's your "normie" network that your WIFI access points expose to all the devices, then the other VLAN is...only within the wired network, so if your phone wants to get to your bitwarden, it's always going out the wifi out the gateway first and back in, kind of thing?

right now all my "services", which are not bitwarden-level sensitive, are all on the same network as whatever crap I bought at home depot. I have an edgemax router and there is a third NIC I've never used, so I guess I'd finally plug a switch in there! ok. next project I guess

Re: Lastpass Security Incident

#546

Post by marginalia_nu »

lesuorac wrote: post #521
marginalia_nu wrote: post #394

Earlier quoted context omitted.

Yeah I'd model it as something like this maybe? public enum Color { RED, BLACK } public enum Suit { Diamonds(RED, '♦'), Hearts(RED, '♥'), Clubs(BLACK, '♣'), Spades(BLACK, '♠'); Color color; char symbol; public Suit(Color color, char symbol) { this.color = color; this.symbol = symbol; } } public enum Rank { Ace('A'), Two('2'), //... } public record Card(Suit suit, Rank rank) { // ... } The question is fundamentally br…

Hey, the client just said they want to play with Jokers can you add this in by lunch for the demo? Thanks!

In that case I'd probably add a Joker Rank and Suit and require in Card's constructor that either both fields say Joker, or none do.

Re: Lastpass Security Incident

#547

Post by ThunderSizzle »

bnmathm wrote: post #524
ThunderSizzle wrote: post #292

My wife's Instagram was hacked and then banned. It was using a Lastpass generated and managed password. I've since redid all her credentials in the password keeper I personally use. I suspected Lastpass was lieing about how significant their security leak was back in August, considering my wife's account getting hacked and banned was pretty soon after the news hit.

I have to believe that if hackers hit the treasure trove of Lastpass customer passwords, Instagram is not going to be their first target. We'd be seeing financial fraud first and foremost, likely sparingly at first, to not alert everyone to the fact that all of our passwords are compromised.

Your probably right, but I'd assume financial attacks would be highly targeted after verifying they have the proper passwords via using places like FB that will just ignore you endlessly if your account is hacked.

Re: Lastpass Security Incident

#548

Post by tasuki »

tasuki wrote: post #543
goosesanta wrote: post #537

Earlier quoted context omitted.

Just use keepassxc and be master of your keys. You have to move forward. Every 6 months I hear about a breach at lastpass. I assumed only clueless normies were left on it, but I guess their efforts to blockade data exports were effective.

Perhaps I'm a clueless normie :) The KeePassXC browser extension doesn't have exactly stellar reviews. As for KeePassXC itself, I'm a little hesitant to use something that makes the UX so painful I have to copy the usernames and passwords. That said, switching from LastPass to Bitwarden seems a little pointless: yes Bitwarden is a younger company and perhaps hasn't managed to mess up their product yet, but knowing li…

Ooh there's this thing called Auto-Type in KeePassXC. I am a clueless normie after all...

And it appears to be customizable how the Auto-Type types... meaning I don't have to copy-paste anything. Well gee...

Wrt Bitwarden, yes I know I can self-host a server, but, managing servers is a bit of a pain, especially for things which clearly need no server.

Re: Lastpass Security Incident

#549

Post by heleninboodler »

dspillett wrote: post #451
heleninboodler wrote: post #346

Earlier quoted context omitted.

I hope not. Not only is this often frustratingly slow, it really complicates things for people who use devices where they don't receive email. Myself, I only receive email on my computer and one mobile device. I have several devices where having to click a link in an email to log into a site means annoying gyrations trying to transfer links from one device to the next. This is especially annoying when whatever mechan…

> means annoying gyrations trying to transfer links from one device to the next There are alternatives to this, such as typing a code into the login prompt instead of following a link (which will be submitting that code). This does limit the size of token that can be used because it needs to not be too inconvenient for the user to type, but if the code's validity is sufficiently short-lived, and properly unguessable,…

Agreed. This is one reason I limit the number of devices that have my email credentials. Using 2FA everywhere is sadly not practical yet, so there are a nontrivial number of accounts that are, as you point out, effectively owned by anyone who can access my email.

I actually occasionally fantasize about implementing a mechanism that I could use from my desktop (where my password manager is) to send passwords as needed (e.g. one at a time) to my devices (I really like not worrying about syncing whole vaults). Encrypt the password using an epehemeral key (gets deleted after 60 seconds, for example) on the transfer service and a local key derived from a random six digit number. Display the number, send a url to the device, and anyone hitting that URL has 60 seconds to enter the six digit code and it decrypts the password and drops it on the device clipboard. This is about 1000 times better (and over-engineered, naturally) than my current practice of "paste it in a slack message to myself."

Re: Lastpass Security Incident

#550

Post by eropple »

caminante wrote: post #523
eropple wrote: post #360

Earlier quoted context omitted.

Typically, because one has other opportunities that are no less compelling and where potential employers show respect for candidates' time. I have a GitHub profile with a lot of code on it and on my resume I highlight projects I've done a lot of work on. "What if faked tho?"--there's literally too much there to be worth faking . If a hiring manager looks at my resume, has the option of going to my GitHub profile, and…

> "What if faked tho?" > If a hiring manager looks at my resume, has the option of going to my GitHub profile, and between the two goes "I'm going to hand him a college-level Java problem because I'm not sure," I know we're talking hypotheticals. I get your position 100%, and good for you. My view is that I'd tell you that 1. I've seen your Github profile 2. However, I didn't have time to go through your entire Githu…

> I want to do a quick, ad-hoc programming exercise to see how fast you operate on basic tasks (which #1 doesn't readily address).

Right. And to do so in good faith, this absolutely can and should be a collaborative exercise with an interviewer. It demonstrates that the employer has skin in the game and isn't body-shopping. Once you're out of junior/low-mid hiring, this is really, really important to getting quality candidates to go through your funnel.

> interviewers are trying to de-risk candidates as much (and as fast) as possible.

Of course they are. They should also be aware of the tradeoffs in doing so.

Post reply on HN