Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

151–160 of 210 posts

Re: Lastpass setting the delete account div to display: none

#151

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

Bitwarden migration was flawless for me. Impressive given how mangled the csv export i got from lastpass was! I really dig the 2FA auto-copy to clipboard feature in bitwarden.

> the 2FA auto-copy to clipboard feature in bitwarden

is that if you're using bitwarden's 2FA authenticator instead of e.g. authy?

Re: Lastpass setting the delete account div to display: none

#152

I am a LastPass user. Unfortunately. I have things in passwords notes field (like answers to security questions) because I assumed that the notes section was encrypted. Some comments here on HN made me think they are actually not encrypted. I asked if they were encrypted or not to LastPass support and to the support forum. That was 2 days ago and there has been no response. I’m going to take that as a no. I’m working…

All notes fields are encrypted. Take a look at the following analysis of the LastPass data structure: https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

Do you mean secure notes or notes attached to passwords?

Re: Lastpass setting the delete account div to display: none

#153

I am a LastPass user. Unfortunately. I have things in passwords notes field (like answers to security questions) because I assumed that the notes section was encrypted. Some comments here on HN made me think they are actually not encrypted. I asked if they were encrypted or not to LastPass support and to the support forum. That was 2 days ago and there has been no response. I’m going to take that as a no. I’m working…

Metadata fields were unencrypted in last pass, sorry.

https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

This says notes (encrypted). Do you have a different source?

Re: Lastpass setting the delete account div to display: none

#154

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

Use an offline password manager, avoid SaaS. Make sure it's secured with Argon2 and burns a a few seconds of compute to unlock. Use hardware MFA tokens for your most critical accounts. You could also tie individual copies of the database to the machine's TPM and only sync after decrypting (yet another factor). > I believe there are alternatives that are more secure such as using a mental algorithm that generates a un…

These passwords have to be encrypted so they can be retrieved later, right? I don’t think Argon2 works for that purpose.

Re: Lastpass setting the delete account div to display: none

#155
post #22

Just deleted my account - everything was fine. One thing to note, there's nowhere in the UI or account settings tab to delete my account. I had to go directly to the link.

After migrating to another password manager, do you also need to rotate all your passwords? Or at least the most sensitive ones? Or is the LastPass hack so far unlikely to compromise the passwords? (since I understand only encrypted data is in hacker's hands)

Rotate the most sensitive ones first. Then incrementally rotate the others.

Re: Lastpass setting the delete account div to display: none

#156

Earlier quoted context omitted.

All notes fields are encrypted. Take a look at the following analysis of the LastPass data structure: https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

Do you mean secure notes or notes attached to passwords?

Both.

See the link.

Notes on a site/password go in the "extra" field, which is encrypted.

For most people it looks like the only field that should hold any user-provided unencrypted data is the URL field.

Re: Lastpass setting the delete account div to display: none

#157

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

Because it is better than the alternative. Pick two: (1) memorizable passwords (2) bruteforce-resistant passwords (3) account-unique passwords. The best tradeoff for me is (2)+(3) sacrificing (1), so I use a local password manager (named 'pass'). That said, I would never trust a 3rd party like LastPass.

Choose a complex base password + a memorizable _algorithm_ that combines (eg) domain names with the base password. That satisfies all of your requirements, and it's not super difficult to create an algorithm that is easy to perform mentally and hard to reverse.

I started doing this in college, and it's been super easy to keep up and my passwords are pretty secure.

Re: Lastpass setting the delete account div to display: none

#158

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

For the job I work at, I easily have 100-200 accounts that I need access to (we have multiple environments for the same projects, so things tend to get inflated very quickly). The accounts that I need to access are accounts that I did not make, and do not have admin control over. If I didn't have a password manager that someone could "share" these passwords to me, I would instead have to do some wonky method of:

Employee sends me two emails encrypted. Email 1 contains a list of usernames. Email 2 contains a list of passwords.

Any time I need to access any site, I need to open up the two files that were sent, count down to whatever line that project would be relevant to, then copy/paste the username from the first file. Then do the same with the other. (And hope that I didn't miscount.)

This also doesn't account for things like password expiration. Some of our projects require it, while others don't. I would constantly be receiving new encrypted emails with this info from people, and be struggling to keep the locally stored files updated.

This would then also open me up to higher risk in that, if my computer ever got compromised, or anyone elses for that matter, than then every single password would have to be changed for every single site, and new encrypted emails would have to be sent out.

It's stressing me out just to think about, honestly.

Password managers are, honestly, kind of a clunky and weird idea. I think that the sorts of problems we see are likely always going to be an issue, but until we get passed the entire idea of even using username/password as the standard, than we're going to need a means to manage them in this way. Basically, I wouldn't call Password Managers "secure" but I'd call them "secure-ish". It's making the best of a bad situation.

Re: Lastpass setting the delete account div to display: none

#159

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

I love my analog password manager.

Re: Lastpass setting the delete account div to display: none

#160

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

If you don't keep your 2FA keys in your password manager, it offers much better protection than anything you can come up with in your head.

What happens when you need to change a password on one site? How do you know which password algorithm you're using on which site now?

Why am I asking you this? Because I was in the same situation and it became difficult to track. Now I keep all my passwords in a password manager, my 2FA codes in another app/service, and my recovery codes in the third place that's not connect with the first two in any way. Similarly, obviously, I don't have my 2FA service account + password in my password manager.

Post reply on HN