Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

561–570 of 587 posts

Re: Lastpass Security Incident

#561

Post by whoami_nr »

MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

I won't lie but I lost you in the steps mentioned here. Finally, IMO, people just want auto-fill/auto-logged in instances without having to enter OTP/type password/do 2FA etc. No matter how you slice it, that's the way people want. Now, how do I compress all these requirements within the boundaries of what is acceptable as a provable source of identity, it becomes a harder problem than you describe.

PS: I have worked in computer security and I am drunk. Eat your salt

Re: Lastpass Security Incident

#562

Post by joshstrange »

delecti wrote: post #542
dodgerdan wrote: post #377

Earlier quoted context omitted.

1Password. The largest feature disparity is 1password is designed and built by competent engineers. The history of breaches and technical mistakes Lastpass has made over the years is amazing for a tech company let alone a password manager.

How is the user experience though? "Designed and built by competent engineers" is reassuring in the face of security breaches, but often means it's less convenient to interact with on a day-to-day basis.

1Password has the best UI/UX of any that I've used. It's clean, pretty, and solid in my experience. Honestly it's a joy to use which I prioritize in the software I choose to use daily.

Re: Lastpass Security Incident

#563

Post by greyhair »

Fire-Dragon-DoL wrote: post #350
clumsysmurf wrote: post #42

Just a reminder: if you are deciding to migrate from LastPass to something else, the password export malfunctions for unknown reasons. If you have memos, it could be a character in the memo. You must make sure the exported CSV file has everything!

Is there an api to fetch all the data instead?

Being that the blob is never decrypted off your local machine, it would have to be a local data API.

Re: Lastpass Security Incident

#564

Post by greyhair »

imiric wrote: post #297
MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

No offense, but this is such a hacker solution. :) And as mentioned, already exists in many forms. Passwords and login credentials are dead. No user wants to deal with them. Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. In that sense, they don't improve security overall, and introduce many other issues (a centrali…

FIDO, UTF, WebAuthn. It can't get here fast enough.

User authentication has been a hot mess for at least two decades. Passwords need to go.

Re: Lastpass Security Incident

#565

Post by greyhair »

aussieguy1234 wrote: post #370
the_svd_doctor wrote: post #210

Earlier quoted context omitted.

Is there a web UI ? If yes - I guess an attacker can just send "bad" JS to the client and steal the master password no? Or inject a malicious update. Most people probably have auto updates?

I think I misread the initial comment. Yes, if the build server is compromised code could be injected into the next build/release cycle to pilfer your master password. Not only that, but also anything else in the vault since it is decrypted locally and visible to the extension. Still, local decryption is more secure than sending the master password to the server (so, just compromising the server holding your vault wo…

Are you certain bitwarden has not? I read a thread here some time ago where 1password was bragging that they have never been breached, and someone basically commented back "they have never been breached that they are aware of".

I am concerned at some level on the lastpass breaches, but I am less affected so far than I have been by the equifax, target, and t-mobile breaches. I have had years of free credit monitoring since each one of those handed out enough data to compromise my identity several times over.

Re: Lastpass Security Incident

#566

Post by greyhair »

genewitch wrote: post #358
wildzzz wrote: post #279

Earlier quoted context omitted.

It's a great way to weed out the junior devs that cheated their way through school (or are too dumb to figure it out via stackoverflow) and the senior devs that haven't actually done any real programming in a long time. An engineer at our competitor got laid off and my PM found out and hired the guy to do FPGA work. My PM knew the guy through some contracts we had with the competitor and assumed he was an expert in t…

I am one of those people who just won't exaggerate or lie on my CV or during an interview. I say "i'm not sure, i'd google it the first couple times it came up". I'm not a programmer though. I have a weird skillset that doesn't mesh or gel with what recruiters are looking for, so on the rare occasion i get a recruiter on the phone, i tend to get a job offer at the end of the sequence. I've had a few startup jobs, a c…

I have been developing in embedded systems for 38 years, and I have the shortest skill set you will ever see on a resume. I only put down the things I know.

On the other hand, I have reviewed resumes from people with five years of experience that are 'experts' at twenty five unrelated technologies. As soon as I see that, I think, 'yeah..... no'. I worked with some genius level folk at Bell Labs back in the mid 1990s, ten years into my career, and they were each really good at two or three things. I took note of that. Yes, they could figure other stuff out, they could move on to new technology, updating the three things that they were good at, but that list always seemed to be short.

You have to laugh at 'experienced' or 'expert at' followed by JS, JAVA, Full Stack, Python, Linux, BSD, C#, AWS, C, C++, MySQL, PostGRES, Lisp, Lua, Azure, MathCAD, DSP, AI, Excel, SystemC, Perl, regex, Bash, git, assembly, Verilog, ...

Re: Lastpass Security Incident

#567

Post by yencabulator »

r_c_a_d wrote: post #439
fomine3 wrote: post #384

Earlier quoted context omitted.

Avoid such trouble is why I want to avoid using symbols for password. Just use more alphanum characters for strength.

I want to as well, but annoyingly there are many sites that insist on a "special" character because their strength measure says "low" for the 20 character alphanumeric string I generated %-}

On those sites, I generally insert the same fixed uppercase-and-symbol string on my zbase32ed-entropy passwords. Zbase32 tends to produce numbers already, and that combo tends to satisfy the silly sites.

Re: Lastpass Security Incident

#568

Post by greyhair »

AlotOfReading wrote: post #356
ohdannyboy wrote: post #331

Earlier quoted context omitted.

I'm currently doing interviews for a senior firmware dev position and was stunned by this. Today I talked to a guy who couldn't tell me what an interrupt was in any technical detail. His coding was worse than a first year college students. 5 of the 6 people I've talked to so far bombed the coding portion.

This isn't intended as a rebuttal, but I've learned to stay away from deeply technical questions in embedded. As long as the interviewee is sufficiently paranoid about C, is recognizably experienced via conversation, and knows the basic concepts I don't press too hard on their specific skillset. There are just too many niches where the knowledge we each consider necessary simply isn't. I had one particularly bad inte…

I agree. Why memorize something that is well documented? Do you understand basic interrupt management and the existence of interrupt controllers? Good. Understanding basic concepts matter, but silicon implementations of a concept? No.

One question I have found useful in embedded development is asking someone to discuss the difference between a thread and a process, and the difference between thread based OSs and process based OSs. It is a general question, not bound by anything like CPU architecture, but just gives an idea into whether the person is comfortable about general memory domains.

I have mentored people, bright programmers that never worked in small embedded systems, that initially tripped all over the thread model, but eventually came to understand it.

Re: Lastpass Security Incident

#569

Post by gcanyon »

ghosts_ wrote: post #554
gcanyon wrote: post #328

Earlier quoted context omitted.

How do they "manage" passkeys? There's nothing to manage except your fingerprint/face authentication.

They're essentially certificates, so most implementations will only store them on-device, and most implementations I've seen seem to favor the phone as the device you use. It really depends on the platform - but in short you'll either need a phone, or be locked into an ecosystem (browser, OS, etc) making using them on multiple devices & browsers difficult or impossible. A password manager supporting passkeys makes th…

Given that Apple and Google (at least) are collaborating on a shared standard, shouldn't lock-in to an ecosystem not be a thing?

And: does using a third-party passkey manager open up passkeys to the same security issues as password managers? Specifically, more than remaining within the Apple-or-Google-supplied system?

Re: Lastpass Security Incident

#570

Post by gcanyon »

greenicon wrote: post #424
gcanyon wrote: post #328

Earlier quoted context omitted.

How do they "manage" passkeys? There's nothing to manage except your fingerprint/face authentication.

You get some form of cross-platform sync. Apple, Google, and so on each have syncing, but in their ecosystem only. You can break out with the QR codes, but this might not be the preferred solution to some.

Given that Apple and Google (at least) are collaborating on a shared standard, shouldn't cross-platform sync be possible?
Post reply on HN