Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

571–580 of 587 posts

Re: Lastpass Security Incident

#571

Post by RulerOf »

mccorrinall wrote: post #329
danenania wrote: post #307

Earlier quoted context omitted.

Considering that 99% of web app password authentication reduces to email authentication via ‘forgot password’, a good first step would be dropping the password and just using emailed tokens (or links) directly.

When I was studying we had to use the computers in uni when presenting homework. It gets really annoying when you want to sign into $service on those machines, but you need to use a magic link. Because the you need to login into your gmail, which requires an additional 2fa (and you can’t receive sms in a building that has 6 stories but no femto cells). Unfortunately google requires either their app or SMS. They dropp…

>Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

You have to add a phone number, turn that on for 2fa.

Then you can add TOTP.

Then you can disable SMS.

SMS will still work for at least a week because fuck you.

Re: Lastpass Security Incident

#572

Post by SparkyMcUnicorn »

sys_64738 wrote: post #213
SparkyMcUnicorn wrote: post #147

Earlier quoted context omitted.

I can never recommend 1Password enough. When it comes to hosted options, they are hands down the best. Worth pointing out that they also have integrated 2FA, if you're satisfied with first and second factor living in the same spot. https://1password.com

This costs a monthly subscription.

Good. When it comes to hosted options, this is one I'd rather pay for to ensure long-term sustainability.

If nobody is paying, they are probably the product.

Re: Lastpass Security Incident

#573

Post by MaxBarraclough »

zelon88 wrote: post #503
hn_throwaway_99 wrote: post #491

Earlier quoted context omitted.

> When you're not, you have to worry about everyone in your supply chain opening sketchy PDFs. That's absolutely not correct. Besides, I have more respect for the security and operations procedures for AWS, GCP and Azure than I do for 99% of startups running their own infrastructure. But my primary point is that you seem to be arguing that being on prem is inherently more secure, and more importantly, being in the cl…

It doesn't matter how secure 4 providers are. There are only 4. OpSec won't stop a submarine from bombing underwater fiber. OpSec won't stop a missile heading for the data center. The strategic importance of our consolidated infrastructure WILL be a paramount target for any enemy of the west. On-prem business is a diversified attack vector. Cloud storage is a consolidated attack vector. Would russia rather attack 100…

If your goal is to avoid downtime in case of nuclear war, you could use a managed distributed database solution from a cloud provider.

Also, attacks against 'on-prem' services still scale, in the sense that an exploit against a service's code can be used on any number of independent deployments of that code. The solution to that is to actively avoid monoculture. [0]

[0] https://indieweb.org/monoculture

Re: Lastpass Security Incident

#574

Post by michaelcampbell »

rexreed wrote: post #253
aborsy wrote: post #184

The best is to use something like Keepassxc, synced peer to peer by Synchting or Resilio. Nobody will be involved with your passwords. Keepassxc supports Yubikey, so you can lock it down strongly!

Do you not suggest using Dropbox to sync KeePassXC? Their FAQ on site seems to support (and encourage?) the use of Dropbox for syncing.

It works, but I had problems with the Windows Dropbox client failing... silently, so my wife and I would end up with different versions of files, or not being able to "send" them to each other because her client was down and we wouldn't know.

Syncthing works, has no central server to be beholden to, is free, and I have much more stability with it.

Re: Lastpass Security Incident

#575

Post by greyhair »

pakl wrote: post #340
MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

The Precursor should tick your boxes, and with an FPGA-based SOC. https://www.crowdsupply.com/sutajio-kosagi/precursor/updates...

I love the price on that.

Re: Lastpass Security Incident

#576

Post by Marsymars »

ocdtrekkie wrote: post #541
Marsymars wrote: post #540

Earlier quoted context omitted.

> People have started storing their TOTP tokens in their password managers, which effectively reimplements single-factor authentication! The thing is that many services are now requiring TOTP in places where I don't want it , since I was already using a strong/unique password, and the TOTP requirement is effectively just to protect the service from having to deal with users who get their passwords stolen. If you're g…

I think you'd be drastically better off not wasting effort with a strong/unique password on places you "don't want" MFA, in favor of using MFA, which is always better at defeating an attacker than any password.

The effort of using a strong/unique password is trivial. The effort of using MFA on my phone is not.

Re: Lastpass Security Incident

#577

Post by MetaWhirledPeas »

NationOfJoe wrote: post #276
MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

such as this open source device? https://hackaday.com/tag/mooltipass/

Yeah that's pretty close to it. It has some unexpected features though, like automatic logout. Weird!

Re: Lastpass Security Incident

#578

Post by Fire-Dragon-DoL »

greyhair wrote: post #563
Fire-Dragon-DoL wrote: post #350

Earlier quoted context omitted.

Is there an api to fetch all the data instead?

Being that the blob is never decrypted off your local machine, it would have to be a local data API.

That's fine too!

They seem to have a CLI to export attachments!

Re: Lastpass Security Incident

#579

Post by ghosts_ »

gcanyon wrote: post #569
ghosts_ wrote: post #554

Earlier quoted context omitted.

They're essentially certificates, so most implementations will only store them on-device, and most implementations I've seen seem to favor the phone as the device you use. It really depends on the platform - but in short you'll either need a phone, or be locked into an ecosystem (browser, OS, etc) making using them on multiple devices & browsers difficult or impossible. A password manager supporting passkeys makes th…

Given that Apple and Google (at least) are collaborating on a shared standard, shouldn't lock-in to an ecosystem not be a thing? And: does using a third-party passkey manager open up passkeys to the same security issues as password managers? Specifically, more than remaining within the Apple-or-Google-supplied system?

It's shared standard in the sense that all implementations will be the same, AFAIK passkeys you generate on iOS systems aren't easily used on windows ones, etc. Or they'd require scanning a QR code from a phone which IMO sucks when a password manager has it in the browser already.

Also what security issues with password managers? There's some potential concerns with extension-based over OS based systems, but if your device is compromised where someone can actually access memory then they'd both be equally void to some extent, AFAIK there's nothing seriously concerning security wise on a password manager vs keychain, etc.

Post reply on HN