Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

Post reply on HN
Print view View original

111–120 of 210 posts

Re: Lastpass setting the delete account div to display: none

#111

Post by flandish »

cirrus3 wrote: post #56

A lot of people here seem to be confused about what a breach of LastPass would actually mean. They should look into how LastPass actually works. Spoiler alert - they don't actually have your passwords, and anyone who hacked them and took all their data would not have your passwords either.

Except with unencrypted urls, combined with a dataset of previously leaked pws and someone who uses a pw at another leaked place as their master password … means that encrypted lastpass acct is now open.

The bottom line is: hacks are bad.

Re: Lastpass setting the delete account div to display: none

#112

Post by civopsec »

thot_experiment wrote: post #59
xconverge wrote: post #46

Earlier quoted context omitted.

If one site gets breached/exposed, your memorized username/password combination used all across the internet is now immediately available to the bad actors and you might not even know or remember everywhere it was used. Having a unique password for each site is the main advantage of a password manager to mitigate the damage in this case (to just the 1 site that was breached). Talking about your vault/passwords and "s…

I don't think that having a unique password per site is unachievable. I do it and I don't use a PW manager. Even something as simple as prepending the site name in ROT13 to a reused password greatly reduces your exposure to the sort of background infosec threat radiation that's like 99.99% of the threat model for most people

> Even something as simple as prepending the site name in ROT13 to a reused password greatly reduces your exposure to the sort of background infosec threat radiation that's like 99.99% of the threat model for most people

If one goes with the infosec advice that you should calculate the entropy of passwords based on the assumption that the attacker knows the password scheme, then this password scheme provides zero entropy. So if there is zero cost for the cracker to pwn you as well as all the others that don’t have this kind of leetspeak obfuscation then you’re still pwned.

Re: Lastpass setting the delete account div to display: none

#113

Post by drdec »

thot_experiment wrote: post #70
drdec wrote: post #55

Earlier quoted context omitted.

I assumed that the hackers have the encrypted vaults. Is it known that that they have unencrypted password data?

I believe they are only the encrypted vaults, but with the cost of compute plummeting and the inclusion of unencrypted data alongside the encrypted data I think you have reason to worry if you believe there are people who would perform a dedicated attack on you, or you are in a class likely to be identified as high value.

Oh, absolutely, you need to test that information as exposed and react accordingly.

Fortunately for me, I don't use LastPass.

Re: Lastpass setting the delete account div to display: none

#114

Post by optionalsquid »

dhdgrygev wrote: post #43
thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

The average person, when not allowed to use a convenient password manager, will either use the same password for every site or come up with a predictable pattern. Encouraging a password manager helps make sure they don't get destroyed completely when a blog they signed up on 5 years ago is hacked. This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impos…

> This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impossible to remember unique strings for each site.

I'd argue that it is not just about remembering passwords. A password manager also helps you remember that you even have an account. I have a similar number of passwords stored as you and there's no way I'd remember all the sites I signed up for (never mind the passwords) if not for the password manager I use.

If I was diligent I could probably track them via confirmation emails (or self-authored "confirmations" for services that don't send a confirmation email), but I can guarantee that a lot would slip through the cracks if I were to attempt that.

A password manager also gives you a convenient place to store (and share) secrets, recovery keys, SSH keys, and similar bits of security related information that you cannot memorize.

Re: Lastpass setting the delete account div to display: none

#115

Post by avianlyric »

thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

> having to go through the reset dance every once in a while because you forgot one.

So you do use a centralised password manager. You just call it email, rather than 1Password.

Re: Lastpass setting the delete account div to display: none

#116

Post by 6ak74rfy »

irrational wrote: post #109

I am a LastPass user. Unfortunately. I have things in passwords notes field (like answers to security questions) because I assumed that the notes section was encrypted. Some comments here on HN made me think they are actually not encrypted. I asked if they were encrypted or not to LastPass support and to the support forum. That was 2 days ago and there has been no response. I’m going to take that as a no. I’m working…

How are you trying to move off such that it’s “taking forever”? Did you consider exporting your data from LastPass and importing the file into something like Bitwarden or KeePassXC?

Re: Lastpass setting the delete account div to display: none

#117

Post by india_usa »

any password manager can be hacked, i had my master password for 20 characters with numbers, characters and special characters. It will take years to brute force and can i assume i have couple of months to change all of my 200 passwords? am i missing something

Re: Lastpass setting the delete account div to display: none

#118

Post by paulryanrogers »

kelnage wrote: post #67
Biganon wrote: post #48

Earlier quoted context omitted.

I'm on the opposite side: I don't understand how a password manager can be compromised. Your passwords are encrypted and decrypted OFFLINE, on your device. You only ever send the ENCRYPTED vault. Your key never transits. How is that complicated? And how did LastPass fuck this up anyway?

As far as I know, it’s only believed that the attackers have the encrypted vaults of LastPass users. However, that does mean they can attempt to “brute force” the encryption, trying any number of passwords as often as they like - and it seems some earlier versions of LastPass used rather poor choices with that cryptography, meaning the amount of effort needed to make an attempt is lower than other similar services (p…

Which is why it's strange to hear Steve Gibson so breathlessly defending LastPass, claiming secrets aren't really at risk. It's like he read some white papers, met some LP employees, and decided it's unhackable.

Consider that many users may have had very guessable vault passwords, and encryption generally gets weaker as hardware and techniques advance.

Re: Lastpass setting the delete account div to display: none

#119

Post by smnrchrds »

dhdgrygev wrote: post #43
thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

The average person, when not allowed to use a convenient password manager, will either use the same password for every site or come up with a predictable pattern. Encouraging a password manager helps make sure they don't get destroyed completely when a blog they signed up on 5 years ago is hacked. This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impos…

In addition, password managers are much better than the average human at avoiding phishing attacks. The chances of the password manager auto-filling your normalwebsite.com password on nomalwebsite.com or normal-website.com are infinitesimally low compared to the chances of an average user doing so.

Re: Lastpass setting the delete account div to display: none

#120

Post by nkrisc »

thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

Because it’s less bad than the alternatives. I can’t remember a unique password for every account I have.

> I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site.

I’m going to forget it.

Either I use a centralized password keeper or the real login process is the reset password flow.

Using a password manager is probably more secure and convenient than whatever solution a can feasibly come up with in my own.

Everything requires a password and I will not be able to remember them all. It took me about 15 years to finally remember my own SSN.

Post reply on HN