Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

Post reply on HN
Print view View original

171–180 of 210 posts

Re: Lastpass setting the delete account div to display: none

#171

Post by noisy_boy »

thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

To those who are advocating storing the passwords in your head, what happens if a bus hits you and your partner has no idea about the passwords? You want to share the algorithm with them? What if they can't remember the algorithm/make a mistake? I would wager that keeping the secure database on cloud and/or a usb key along with master password in a bank safe deposit locker is a much safer way to pass the details to them.

Re: Lastpass setting the delete account div to display: none

#172

Post by c0balt »

gavinhoward wrote: post #162

This reminds me of something I want: a centralized password manager where * The entire file is encrypted, * Using OPAQUE, * On a FOSS local native client * That integrates with a FOSS browser extension that pulls the information only from the local copy. * And the only thing the server does is store the file and user account information. How hard could it be? (Well, outside of getting the cryptography right.) Looking…

Well, the stopgap solution for this scenario is quite simple: Keepassxc + Keepassxc Browser Extension + Cloud Storage of your choice. OPAQUE is not covered but I'd argue that that would puttoo much of a restraint on the storage layer.

Both Keepassxc[0] and the browser extension are FOSS and the cloud storage may be FOSS, like Nextcloud or "just" whatever works for you rn (Google Drive, Seafile, ...). On android Keepassdx[2] (with autofill) can help too.

The only major pitfalls of this model is cross-device sync, i.e., you edit the file on device A while saving a change on B etc. Though this isn't really a problem if you (a) are using it alone or (b) make sure you keep backups. In case they do conflict it can merge multiple versions.

[1]: https://keepassxc.org/ [2]: https://www.keepassdx.com/

Re: Lastpass setting the delete account div to display: none

#173

Post by TillE »

thot_experiment wrote: post #70
drdec wrote: post #55

Earlier quoted context omitted.

I assumed that the hackers have the encrypted vaults. Is it known that that they have unencrypted password data?

I believe they are only the encrypted vaults, but with the cost of compute plummeting and the inclusion of unencrypted data alongside the encrypted data I think you have reason to worry if you believe there are people who would perform a dedicated attack on you, or you are in a class likely to be identified as high value.

> the cost of compute plummeting

You should do some actual math to roughly estimate what it would take to crack a good password. Use a strong password, use a resource-intensive key derivation function, and you should feel extremely comfortable that your encrypted data will not be cracked within your lifetime.

Re: Lastpass setting the delete account div to display: none

#174

Post by dicknuckle »

SinParadise wrote: post #37
rippercushions wrote: post #30

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

Probably Bitwarden or KeepassXC. I just use KeepassXC with the db stored on pCloud.

KeePassXC with the DB stored in Resilio Sync for me. It's just convenient that way because I've got a home server that everything gets synced with so I don't have to rely on devices being awake at the same time.

Re: Lastpass setting the delete account div to display: none

#175

Post by r00fus »

rippercushions wrote: post #30

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

1Password or Bitwarden

Re: Lastpass setting the delete account div to display: none

#176

Post by utsuro »

weaksauce wrote: post #106
theturtletalks wrote: post #83

Earlier quoted context omitted.

I use BitWarden, but I'm thinking of self-hosting BitWarden. BitWarden's commercial offering might be tempting to crack from a hacker's perspective, but I don't think they would go after a specific user's instance.

there's a non-zero risk of hosting it yourself and not keeping up with the maintenance/security updates of whatever server you host it on. gotta weigh that in the calculus. It might not be likely that they target you specifically but there could be a drive by bot that slurps up your password vault.

Most people seem to think it needs to be accessible online. Remote Access =/= Internet Access. Self hosting an external vault, using VPNs, and requiring MFA access make the vault tricky to get to in the first place. You’re machine would need to be compromised first for an attacker to even connect to it—and at that point you’re compromised (and probably keylogged).

If you’re actively under attack no Password Manager, mental algorithm/ password pattern, Yubikey, or MFA will prevent someone from just using your authenticated session(s).

Does that mean we shouldn’t use these mechanisms? Of course not. When the risk is only realized with full compromise—saying XYZ could pose a threat is moot from a security perspective.

Re: Lastpass setting the delete account div to display: none

#177

Post by wutbrodo »

the8472 wrote: post #138
thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

Use an offline password manager, avoid SaaS. Make sure it's secured with Argon2 and burns a a few seconds of compute to unlock. Use hardware MFA tokens for your most critical accounts. You could also tie individual copies of the database to the machine's TPM and only sync after decrypting (yet another factor). > I believe there are alternatives that are more secure such as using a mental algorithm that generates a un…

This isn't a problem in practice. Ime you can cover 99.9% of sites with uppercase, numbers, and a special symbol like "!".

Re: Lastpass setting the delete account div to display: none

#178

Post by SQueeeeeL »

matheusmoreira wrote: post #169
burpee wrote: post #82

A while back I had an issue with Lastpass settings not being properly enabled on my account. I discovered that all settings were rendered, and in order to disable them they used 'display: none' rather than not rendering them on the dashboard at all. The fix was for me to disable Display: none and it gave me access to the feature in a limited way. After reaching out to support with screenshots, they fixed the issue an…

> it is clear to me that Lastpass uses 'display: none' as feature gating and that their software is absolute garbage I love it when web sites do stuff like this. Makes it so easy to reverse engineer and circumvent their little controls just like you did.

Yeah, it's probably some homie in engineering maliciously compiling with the directions of some wannabe MBA who hates their customers and couldn't keep a business running if it was handed to them on a silver platter.

Be the programmer homie

Re: Lastpass setting the delete account div to display: none

#179

Post by taneq »

yreg wrote: post #101
feanaro wrote: post #65

Earlier quoted context omitted.

Reusing passwords or having low entropy passwords is a larger risk. The thing is... Your password manager should be offline, not a cloud service.

>Your password manager should be offline, not a cloud service. Why?

Think about it for a moment. Which is more likely to be compromised: A widely advertised central location storing thousands of peoples’ passwords, or a single user’s passwords on their local computer accessed through an app which doesn’t even access the internet?

Re: Lastpass setting the delete account div to display: none

#180

Post by TechBro8615 »

tempestn wrote: post #122
nkrisc wrote: post #120

Earlier quoted context omitted.

Because it’s less bad than the alternatives. I can’t remember a unique password for every account I have. > I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site. I’m going to forget it. Either I use a centralized password keeper or the real login process is the reset password flow. Using a password manager is probably more secure and convenie…

Not only could you forget it, I imagine it's going to be pretty difficult to have a mental algorithm that's going to be secure against a couple of your passwords being compromised. So if someone wanted to target you, I bet they'd have a decent chance of cracking the algorithm. Now of course, unless you're a prominent figure, that's very unlikely. But so is a full breach of a major PW manager (preferably not LastPass)…

I don't think you need to be a prominent figure to be worried about being targeted specifically. If you date someone in infosec and then break up with them they could easily become a stalker who searches haveibeenpwned for your accounts and starts whittling away at your passwords...
Post reply on HN