Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s in a PR statement: LastPass breach explained

palant.info

Post reply on HN
Print view View original

171–180 of 292 posts

Re: What’s in a PR statement: LastPass breach explained

#171

Post by counttheforks »

dgrin91 wrote: post #19
40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

It's KeePass, not KeyPass. And it's designed to be secure. If you want emergency access, tell someone your master password.

Re: What’s in a PR statement: LastPass breach explained

#173

Post by deepserket »

ericmcer wrote: post #165

Can someone point out a big flaw in my password management system? I have always felt kinda dumb for not using a PW manager but my system has worked for the last ~10+ years and I have never had any issues. I memorized a small function that takes the product name as input and spits out a password. it achieves the goal of having a unique pw for every service without having to write anything down (in software or on pape…

> function that takes the product name as input and spits out a password

Can someone infer the function starting from the password and the service name?

If yes, then there is a low (close to zero, unless you are specifically targeted) possibility to gain a clear password from a shitty website and calculate your other passwords.

Re: What’s in a PR statement: LastPass breach explained

#174

Post by FreakLegion »

isthisthingon99 wrote: post #140
mdaniel wrote: post #121

Earlier quoted context omitted.

> since the e2ee does not depend on a user chosen master password. What's the story with "my phone went in the lake" using that setup?

Since i use Google Authenticator for numerous services this is going to happen to me one day. So what I did was set it up on more than one phone.

You can back the secrets up to a text file, print them out, etc. too. They're short Base32 strings and TOTP is a standardized protocol with an RFC (6238) and everything.

Re: What’s in a PR statement: LastPass breach explained

#175

Post by flandish »

ericmcer wrote: post #165

Can someone point out a big flaw in my password management system? I have always felt kinda dumb for not using a PW manager but my system has worked for the last ~10+ years and I have never had any issues. I memorized a small function that takes the product name as input and spits out a password. it achieves the goal of having a unique pw for every service without having to write anything down (in software or on pape…

What about when a product changes names, between your logins?

Take protonmail - they started to use “proton.me” instead of “protonmail.com” more and more often. If your f(x) was f(“protonmail”) originally but after being away six months you try in the middle of the night while hungover and driving in snow f(“proton”) won’t get the same result?

Re: What’s in a PR statement: LastPass breach explained

#176

Post by Nifty3929 »

mrstone wrote: post #38

Incredibly pathetic. I am so disappointed in LastPass. I was willing to forgive their subpar UX because hey, at least my passwords were safe. I've moved over to Bitwarden and am happy for now, but man what a shitshow.

I love BitWarden, but coincidentally yesterday I saw a problem pop up on Reddit that was terrifying: There is a known issue where changing your master password can cause you to lose all your data:

https://bitwarden.com/help/account-encryption-key/#rotate-yo...

What?!

Of course, if you are careful and follow all the instructions, in theory you could avoid this. But why allow such a foot-gun?

Re: What’s in a PR statement: LastPass breach explained

#177

Post by temuze »

ericmcer wrote: post #165

Can someone point out a big flaw in my password management system? I have always felt kinda dumb for not using a PW manager but my system has worked for the last ~10+ years and I have never had any issues. I memorized a small function that takes the product name as input and spits out a password. it achieves the goal of having a unique pw for every service without having to write anything down (in software or on pape…

I used to do a similar thing, then I realized it was a potential problem.

Let's say you have an account at AcmeCo. Let's say AcmeCo has a breach and I can see your password hash. Let's say the company uses a weak password hash (e.g. MD5), or no salt and it's easy to reference a rainbow table.

From this rainbow table, I can look up your hash and see that your password is "lulzSecret2$AcmeCo".

Now let's say you're in another leak from BetaCo. Similar situation -- I see that your password is "lulzSecret2$BetaCo2". Maybe the two is because you were forced to rotate your password once.

It doesn't take a genius to guess what your algorithm is.

But we can take it another level. Maybe I'll try all the major banks and guess passwords using your algorithm ("lulzSecret2$bofa", "lulzSecret2$chase"). Most banks require 2fa, but most of the time they keep it to text-based 2fa.

If I know your phone number from one of the breaches (happens all the time), maybe I can hijack your SIM card (this also happens all the time) and boom, I'm into your bank account.

Re: What’s in a PR statement: LastPass breach explained

#178

Post by paranoidxprod »

flipbrad wrote: post #74
paranoidxprod wrote: post #17

Earlier quoted context omitted.

Thanks for posting this. I was about to post an "Ask HN" to see what password managers people here are using, but this seems very helpful to compare the various services.

Keepass and syncthing.

After doing some more research, I've pretty much come to the conclusion I should be using KeePass (or KeePassXC) but I wasn't really sure how I should go about syncing. I will definitely look into Syncthing, thanks!

Re: What’s in a PR statement: LastPass breach explained

#180

Post by mdaniel »

alex- wrote: post #161
nogridbag wrote: post #105

Assuming I'm a LastPass user and I have a sufficiently long master password with hardware based 2FA do I have anything to worry about? The one weak link is mobile authentication which bypasses 2FA. I honestly forget how that's configured.

I initially assumed I would be safe because of 2FA. Sadly it looks like this is not the case, the second factor is used to access the encrypted data, not decrypt the data. As the attacker already has the encrypted data, they have bypassed the stage where 2FA is providing protection. This appears to also be the case for 1password and bitwarden, so not specifically a lastpass failure.

> This appears to also be the case for 1password and bitwarden, so not specifically a lastpass failure.

It is currently(?) the case for Bitwarden, yes, but that's incorrect for 1Password, as they have client-only key material that is never transmitted to the cloud: https://blog.1password.com/what-the-secret-key-does/

Post reply on HN