Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

Post reply on HN
Print view View original

161–170 of 210 posts

Re: Lastpass setting the delete account div to display: none

#161

Post by messutied »

mdaniel wrote: post #135
messutied wrote: post #72

Earlier quoted context omitted.

Does Bitwarden support a keyword shortcut that brings up the password search? (outside of browser preferably), couldn't find one.

It appears not, since there's a feature request for it: https://community.bitwarden.com/t/global-keyboard-shortcut/3... (and their keyboard shortcuts doc doesn't mention any such thing) Yet another fine reason to use 1Password, which puts a lot of time and attention into user experience stuff like this. I know Bitwarden is the Internet's darling, but holy hell the user experience is so aggressively bad

Thanks! Any idea of how 1password compares with bidwarden in terms of security?

Re: Lastpass setting the delete account div to display: none

#162

Post by gavinhoward »

This reminds me of something I want: a centralized password manager where

* The entire file is encrypted,

* Using OPAQUE,

* On a FOSS local native client

* That integrates with a FOSS browser extension that pulls the information only from the local copy.

* And the only thing the server does is store the file and user account information.

How hard could it be? (Well, outside of getting the cryptography right.)

Looking at this incident and the behavior of LastPass, it seems it's impossible. Or it's too inconvenient for users.

Re: Lastpass setting the delete account div to display: none

#163

Post by nonethewiser »

eurticket wrote: post #80
dhdgrygev wrote: post #43

Earlier quoted context omitted.

The average person, when not allowed to use a convenient password manager, will either use the same password for every site or come up with a predictable pattern. Encouraging a password manager helps make sure they don't get destroyed completely when a blog they signed up on 5 years ago is hacked. This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impos…

What are some good methods to not create patterns, while allowing yourself to have an easier time remembering more complicated passwords?

Honestly a somewhat sophisticated pattern that you write down somewhere is probably pretty secure. Outside of a very targeted attack.

Re: Lastpass setting the delete account div to display: none

#164

Post by simooooo »

dividedbyzero wrote: post #108
lopkeny12ko wrote: post #90

Earlier quoted context omitted.

I have been self-hosting bitwarden_rs for many years now, and am very happy with it. It's free as in freedom, open source, and designed to be run and operated and secured by you exclusively, so you have full control over your data and don't need to rely on a third party being available.

> designed to be run and operated and secured by you exclusively Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.

The official bit warden self host runs something like 13 docker containers. Good luck securing that as a normal person

Re: Lastpass setting the delete account div to display: none

#165

Post by xboxnolifes »

thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

The attack vector I'm worried about is a website I use improperly storing passwords (plaintext, etc) and having a leak. To protect against this I use a unique password per website. I cannot possibly remember a unique, secure password for every website I use.

So, I use a password manager.

Re: Lastpass setting the delete account div to display: none

#166

Post by the8472 »

aobdev wrote: post #154
the8472 wrote: post #138

Earlier quoted context omitted.

Use an offline password manager, avoid SaaS. Make sure it's secured with Argon2 and burns a a few seconds of compute to unlock. Use hardware MFA tokens for your most critical accounts. You could also tie individual copies of the database to the machine's TPM and only sync after decrypting (yet another factor). > I believe there are alternatives that are more secure such as using a mental algorithm that generates a un…

These passwords have to be encrypted so they can be retrieved later, right? I don’t think Argon2 works for that purpose.

Argon2 can be used as KDF, not just as a password hash in an authentication database.

Re: Lastpass setting the delete account div to display: none

#167

Post by mdaniel »

messutied wrote: post #161
mdaniel wrote: post #135

Earlier quoted context omitted.

It appears not, since there's a feature request for it: https://community.bitwarden.com/t/global-keyboard-shortcut/3... (and their keyboard shortcuts doc doesn't mention any such thing) Yet another fine reason to use 1Password, which puts a lot of time and attention into user experience stuff like this. I know Bitwarden is the Internet's darling, but holy hell the user experience is so aggressively bad

Thanks! Any idea of how 1password compares with bidwarden in terms of security?

I would give 1Password the advantage if for no other reason than they've been at it longer, and thus have seen more crazy stuff. I believe Bitwarden claims to have multiple security audits, so I do believe they take it seriously, but (and this part is just my opinion) they execute so much other stuff so poorly that alone lowers my trust in them. For clarity, 1Password also has multiple security audits, and have done a very good job of publishing the specifications for their formats, which further contributes to my trust in their execution

Bitwarden's previous(?) on-premises deployment script was a raging tire fire, which I openly admit is not exactly a _security_ issue, but it further lowers my lack of faith in them

With all that said, I think both Bitwarden and 1Password are miles and miles ahead of LastPass, so one will for sure be better off just picking one and trying it out. It seems to be a reversible decision, if you wanted to switch again

Re: Lastpass setting the delete account div to display: none

#168

Post by noisy_boy »

scarab92 wrote: post #85
Schnitz wrote: post #58

Earlier quoted context omitted.

A local keepass is a great alternative, been doing that for ages and honestly copying my keepass db to a device every once in a while is way less troublesome than quadruple factoring into lastpass/1password or whatever.

For most people, the keepass db will need to be synced and they’ll also want clients on their computers and phones to access it. What’s the difference, security wise, to an all in one offering that works the same way under the hood, like 1password cloud or bitwarden? It seems to me that those syncing keepass databases around are just incurring pain without any real increase in security.

Syncing is basically painless and automatic with Syncthing[0] - you only need to set it up once per device (unless you are adding devices frequently which isn't the typical usecase for personal use).

[0]: https://syncthing.net/

Re: Lastpass setting the delete account div to display: none

#169

Post by matheusmoreira »

burpee wrote: post #82

A while back I had an issue with Lastpass settings not being properly enabled on my account. I discovered that all settings were rendered, and in order to disable them they used 'display: none' rather than not rendering them on the dashboard at all. The fix was for me to disable Display: none and it gave me access to the feature in a limited way. After reaching out to support with screenshots, they fixed the issue an…

> it is clear to me that Lastpass uses 'display: none' as feature gating and that their software is absolute garbage

I love it when web sites do stuff like this. Makes it so easy to reverse engineer and circumvent their little controls just like you did.

Re: Lastpass setting the delete account div to display: none

#170

Post by TillE »

yreg wrote: post #101
feanaro wrote: post #65

Earlier quoted context omitted.

Reusing passwords or having low entropy passwords is a larger risk. The thing is... Your password manager should be offline, not a cloud service.

>Your password manager should be offline, not a cloud service. Why?

There's this persistent vague myth on HN that there's something terrible about having an encrypted blob publicly exposed, which to me demonstrates a total lack of understanding about cryptography. Or they're just using weak passwords. Don't do that.

The problem here is that a bunch of unencrypted data was exposed, which is really bad and dumb of LastPass.

Post reply on HN