Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

Post reply on HN
Print view View original

71–80 of 210 posts

Re: Lastpass setting the delete account div to display: none

#71

Post by ncallaway »

thot_experiment wrote: post #45
Saris wrote: post #35

Earlier quoted context omitted.

Well, what's the alternative besides a local keepass DB or something?

I use a mental algorithm that generates a unique password for each site. It's easy to remember the algorithm and I get a complex unique password for every site. I don't think a password existing outside of your head makes sense. (though some sites force unique passwords/and password changes, which can be annoying as I have to remember to bump a value mentally for how many times i've been forced to do it, luckily for…

That’s great but for 95% of the population they’ll never do that. They’ll come up with a generic low security password that’s easy to both remember and type. And they’ll reuse essentially that same password on every site.

So, for your practices maybe a password manager is a step down. But for 95% of the popular it’s a step up.

Security is a spectrum, and password managers move most people to a more secure stance. You can yell at people that they can be more secure until you’re blue in the face, but most of them will shrug and ignore you.

Re: Lastpass setting the delete account div to display: none

#72

Post by messutied »

CraigJPerry wrote: post #34
rippercushions wrote: post #30

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

Bitwarden migration was flawless for me. Impressive given how mangled the csv export i got from lastpass was! I really dig the 2FA auto-copy to clipboard feature in bitwarden.

Does Bitwarden support a keyword shortcut that brings up the password search? (outside of browser preferably), couldn't find one.

Re: Lastpass setting the delete account div to display: none

#73

Post by codetrotter »

dhdgrygev wrote: post #43
thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

The average person, when not allowed to use a convenient password manager, will either use the same password for every site or come up with a predictable pattern. Encouraging a password manager helps make sure they don't get destroyed completely when a blog they signed up on 5 years ago is hacked. This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impos…

> This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impossible to remember unique strings for each site.

How many of those accounts are essential?

I create throw-away accounts on the regular.

There are many accounts, but few that really matter. For the ones that matter I take care to make sure I have the passwords. For the rest, who cares :)

Re: Lastpass setting the delete account div to display: none

#74

Post by george_probably »

thot_experiment wrote: post #59
xconverge wrote: post #46

Earlier quoted context omitted.

If one site gets breached/exposed, your memorized username/password combination used all across the internet is now immediately available to the bad actors and you might not even know or remember everywhere it was used. Having a unique password for each site is the main advantage of a password manager to mitigate the damage in this case (to just the 1 site that was breached). Talking about your vault/passwords and "s…

I don't think that having a unique password per site is unachievable. I do it and I don't use a PW manager. Even something as simple as prepending the site name in ROT13 to a reused password greatly reduces your exposure to the sort of background infosec threat radiation that's like 99.99% of the threat model for most people

Cool, now go explain that to your parents. NOW make sure they go through and change every single password on every single account they currently have and don't just get annoyed like 5 passwords deep and decide not to bother.

The issue isn't you or me, it's what 99% of the world has to use. For the large majority of people, a password manager with one super strong password (and 2FA) makes WAY more sense.

Re: Lastpass setting the delete account div to display: none

#76

Post by neilv »

jiggawatts wrote: post #6
bigmattystyles wrote: post #4

I work at a large company and against the opinion of many engineers and infosec folks, lastpass was picked as our preferred corporate password storage. I'm just waiting for a call from infosec asking me to log on and to rotate a bunch of creds. Happy Holidays.

Our new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months. I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass. Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well. When the news broke that the breach was worse than predicted, I sent ano…

> I'm starting to suspect that the CISO is getting some sort of kickback from LastPass, because he's doubling down with every breach on a bad decision.

Corporate Occam's Razor says that either the CISO thinks that reverting the LastPass move right now would be a business mistake, or that ordinary big-company politics is a factor (in either doubling-down to protect from political fallout, or having to do things delicately behind the scenes).

On corporate politics, your paper trail letters to the CISO could be awkward. You might've tried collegial verbal dialogue with them first.

Corporate INFOSEC has a lot of nonsense, the CISO is often the predetermined fall-person when something inevitably goes wrong, and a paper trail that looks like the CISO made an oops despite being warned isn't a great situation for the CISO.

Fortunately for the CISO, mess-ups by vendors like LastPass are commonplace in enterprise software, and people routinely go unscathed for much obviously worse corporate purchasing/deployment decisions. Bad decisions are almost the norm.

Re: Lastpass setting the delete account div to display: none

#77

Post by lucideer »

Biganon wrote: post #48
thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

I'm on the opposite side: I don't understand how a password manager can be compromised. Your passwords are encrypted and decrypted OFFLINE, on your device. You only ever send the ENCRYPTED vault. Your key never transits. How is that complicated? And how did LastPass fuck this up anyway?

> How is that complicated?

I'm not saying for a moment that Lastpass are competent (there's plenty of evidence to the contrary), but... saying that this isn't complicated seems a bit much. This is an extremely complex set of transactions where many many things can be done incorrectly.

There's also of course the general as-yet-not-conclusively-solved problem of non-reproducible builds / trusting remotely-updated code.

Re: Lastpass setting the delete account div to display: none

#78

Post by JoshuaEN »

drdec wrote: post #55
Biganon wrote: post #48

Earlier quoted context omitted.

I'm on the opposite side: I don't understand how a password manager can be compromised. Your passwords are encrypted and decrypted OFFLINE, on your device. You only ever send the ENCRYPTED vault. Your key never transits. How is that complicated? And how did LastPass fuck this up anyway?

I assumed that the hackers have the encrypted vaults. Is it known that that they have unencrypted password data?

Not passwords, but the hackers have some unencrypted data because LastPass did not encrypt all vault data client-side:

"The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs" - https://blog.lastpass.com/2022/12/notice-of-recent-security-...

The "such as..." without enumerating everything is very ominous as well.

Re: Lastpass setting the delete account div to display: none

#79

Post by kmeisthax »

jacksnipe wrote: post #9
jiggawatts wrote: post #6

Earlier quoted context omitted.

Our new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months. I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass. Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well. When the news broke that the breach was worse than predicted, I sent ano…

He doesn’t need to be getting a kickback. He probably just wants to spin as hard as he can that his poor choice cost did not cost the company a bunch of money.

Emotional kickbacks are still kickbacks.

Re: Lastpass setting the delete account div to display: none

#80

Post by eurticket »

dhdgrygev wrote: post #43
thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

The average person, when not allowed to use a convenient password manager, will either use the same password for every site or come up with a predictable pattern. Encouraging a password manager helps make sure they don't get destroyed completely when a blog they signed up on 5 years ago is hacked. This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impos…

What are some good methods to not create patterns, while allowing yourself to have an easier time remembering more complicated passwords?
Post reply on HN