Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s in a PR statement: LastPass breach explained

palant.info

Post reply on HN
Print view View original

91–100 of 292 posts

Re: What’s in a PR statement: LastPass breach explained

#91

Post by rkagerer »

dgrin91 wrote: post #19
40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

One option (albeit not the simplest): Shamir shares + a few trusted individuals or locations (eg. family, lawyer, safe) + "in the event of my death" instructions enclosed with your will.

Re: What’s in a PR statement: LastPass breach explained

#92

Post by ok_dad »

dml2135 wrote: post #57
mrstone wrote: post #38

Incredibly pathetic. I am so disappointed in LastPass. I was willing to forgive their subpar UX because hey, at least my passwords were safe. I've moved over to Bitwarden and am happy for now, but man what a shitshow.

Same, I held onto Lastpass much longer than I would have put up with any less-essential SaaS product. Finally moved to Bitwarden and couldn't be happier. Still trying to decide if I want to self-host it or not, but more breaches of cloud-based password managers like this one may push me in that direction.

At least Bitwarden encrypts the whole vault as a blob. I don't bother self-hosting because I figure I know less about hosting a Bitwarden vault than they do so it's not much more secure. If I had a local server on my LAN I might consider it, because then at least I have a few firewalls between me and the internet. I've been a happy paying Bitwarden user for several years now, since just before the first "minor" Lastpass breach.

Re: What’s in a PR statement: LastPass breach explained

#93

Post by heresie-dabord »

betaby wrote: post #20

For non-tech-savvy people - https://www.amazon.ca/Password-Book-Alphabetical-Colorful-Le... For tech-savvy people - https://www.passwordstore.org/ The rest doesn't work unfortunately, proven over and over.

Debian (or any GNU/Linux) terminal:

    head -c 256 /dev/random| openssl sha384 -binary | base64 | sed 's/[=\/\\+]//g' | cut -b1-22
where "22" is the desired length of password.

Re: What’s in a PR statement: LastPass breach explained

#94

Post by FatActor »

prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

Sweet. I've been looking for this. I decided to ditch my home-grown solution and switch to a real manager this week.

One note:

1Password uses WebAuth for Yubikey and LastPass uses text input. This makes LastPass work across *remote terminals* where you don't have access to the physical machine. Now, there might be a vulnerability lurking in there, but I often find myself working on a remote windows machine and need to log into something.

Maybe this should be a footnote in your Yubikey row? Or its own row, if it isn't already in there and I missed.

Re: What’s in a PR statement: LastPass breach explained

#95

Post by KomoD »

prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

Broken as hell for me. "no?yes" "unknown?yes"

"1 undefined" "2 undefined" "3 undefined"

Re: What’s in a PR statement: LastPass breach explained

#96

Post by Espressosaurus »

wlll wrote: post #77
dml2135 wrote: post #61

Earlier quoted context omitted.

Because there needs to be a baseline level of convenience in order to get less-technical people to even consider using a password manager at all. If the alternative is using the same handful of weak passwords for every site, the risk of your password manager suffering a security breach doesn't look so bad in comparison.

There is a pretty large gap between "cloud based password storage" and "using the same password for each site". 1Password for /years/ worked with a local vault (and no remote sign-in requirement), and had relatively simple syncing to iOS via wifi (no idea on other OSes, that's what I use). I've shared my password vault between these two places with no issues and it didn't need a cloud account and I wasn't re-using pa…

That's literally the option though if you've managed to convince someone to use a password manager.

I convinced a family member and their response to the breach was "okay, who should I use instead? Or do I go back to using one password for everything?"

Re: What’s in a PR statement: LastPass breach explained

#97

Post by mtlmtlmtlmtl »

bikeformind wrote: post #32

Catastrophic breach after catastrophic breach since 2011. Lastpass has failed their fiduciary duty as a steward of sensitive information and IMO exhibited gross negligence in not encrypting URI data, ostensibly as a trade off for consumer functionality. not to be overly vindictive, as I understand the near impossibility of running a perfectly secure service at absolutely enormous scale…but does anyone else feel LastP…

More interesting to me is that this shouldn't be an issue, they should just lose out to the competition organically.

And yet here we are.

Re: What’s in a PR statement: LastPass breach explained

#98

Post by balaji1 »

balaji1 wrote: post #81
40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

What about just using chrome’s saved passwords and syncing? It would be great if someone can succinctly destroy that idea :D

More info about browser password management in https://news.ycombinator.com/item?id=34149738

Re: What’s in a PR statement: LastPass breach explained

#99

Post by palant »

edflsafoiewq wrote: post #80
palant wrote: post #70

Earlier quoted context omitted.

You just exposed all your passwords to bruteforcing attacks. Unless “hash” in this case is something like scrypt with sane parameters. Originally (before I started writing my own password manager) I also thought that this is a safe method of password generation. And then I realized that it isn’t. Wrote about it here: https://palant.info/2016/04/20/security-considerations-for-p...

Assuming you have the password and key, you'd need to brute force hash and masterPasswd. Seems hard.

It isn’t. You certainly used MD5, SHA1, SHA256 or SHA512 as hash, with SHA256 being the most likely one. All of these are very easy to bruteforce – if someone has one of your passwords, bruteforcing your master password won’t take all too long.

Re: What’s in a PR statement: LastPass breach explained

#100

Post by Hackbraten »

RubberSoul wrote: post #10
prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

Great overview! I think 1Password's Linux support has been improving [0]. I use 1Password with an Ubuntu desktop and have been happy with it. [0]: https://support.1password.com/explore/linux/

It’s hardly working at all under Wayland. Copying to clipboard has been broken for at least 18 months. AgileBits doesn’t seem to care. [0]

There are also sync issues (items created in the desktop app won’t appear in the browser extension unless I restart my browser), which aren’t occurring under Windows nor macOS.

„Poor“ Linux support absolutely does the situation justice.

[0]: https://1password.community/discussion/comment/667970

Post reply on HN