Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

21–30 of 210 posts

Re: Lastpass setting the delete account div to display: none

#21

The title would make more sense with quotes around the CSS keywords: I'm sure LastPass setting the delete account to "display: none" was coincidental

I got it right the first time. Too much time spend with CSS.

Nevertheless you are right. Clarity is needed here.

Re: Lastpass setting the delete account div to display: none

#23

Is LastPass one of those password managers that only encrypt passwords and leave other data as is? I always cringe when password managers do that. This is a funny joke for anyone who understands even a little about cryptography.

This is very frustrating... I operated with LastPass on the assumption that the other data was encrypted in there. So backup authentication codes stored. Alas, time to invalidate a bunch of crap.

Re: Lastpass setting the delete account div to display: none

#24

Earlier quoted context omitted.

Our new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months. I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass. Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well. When the news broke that the breach was worse than predicted, I sent ano…

You are reading too much into it. Probably ciso is busy with other things and cannot respond to every's smartass wishes.

How much of a smartass can you be when Lastpass keeps lying about how bad each of the numerous hacks actually were?

Re: Lastpass setting the delete account div to display: none

#26

I work at a large company and against the opinion of many engineers and infosec folks, lastpass was picked as our preferred corporate password storage. I'm just waiting for a call from infosec asking me to log on and to rotate a bunch of creds. Happy Holidays.

Our new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months. I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass. Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well. When the news broke that the breach was worse than predicted, I sent ano…

You may want to reach to a higher level on this one.

Re: Lastpass setting the delete account div to display: none

#27

Earlier quoted context omitted.

Our new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months. I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass. Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well. When the news broke that the breach was worse than predicted, I sent ano…

He doesn’t need to be getting a kickback. He probably just wants to spin as hard as he can that his poor choice cost did not cost the company a bunch of money.

If it only costs some money that's a good outcome.

Re: Lastpass setting the delete account div to display: none

#28
post #22

Just deleted my account - everything was fine. One thing to note, there's nowhere in the UI or account settings tab to delete my account. I had to go directly to the link.

> Just deleted my account - everything was fine. One thing to note, there's nowhere in the UI or account settings tab to delete my account. I had to go directly to the link.

That's the point OP is making - the button to do it from within the UI has been hidden with CSS attribute

    display: none
it's there, but the fact that it was hidden with CSS suggests it was done deliberately to stem attrition.

Re: Lastpass setting the delete account div to display: none

#29

Is LastPass one of those password managers that only encrypt passwords and leave other data as is? I always cringe when password managers do that. This is a funny joke for anyone who understands even a little about cryptography.

I see why it's a bad idea, but what does that have to do with cryptography?

At a minimum a bunch of non-encrypted data might give you some cribs to try.

HN12345[*] is easier to find if you know that the website used is called Hacker News.

[*] Not my actual password.

Re: Lastpass setting the delete account div to display: none

#30
So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?
Post reply on HN