Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s in a PR statement: LastPass breach explained

palant.info

Post reply on HN
Print view View original

231–240 of 292 posts

Re: What’s in a PR statement: LastPass breach explained

#231

Post by CJefferson »

Beaver117 wrote: post #141
dgrin91 wrote: post #19

Earlier quoted context omitted.

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

Excuse me if this seems impolite, but is there a reason you need his passwords? Financial institutions have a very regulated pipeline for access of deceased accounts to relatives. And for personal email and stuff, well I think that should remain private unless the deceased explicitly wanted to share.

Having going through this experience, there is often lots of little things. Maybe there was a shared domain registered to your email account. Closing or moving Netflix, or Disney+, or your vegetable subscription service, is much easier if you can just log in and close the account -- this can be done by writing to the companies, or if you just stop paying and responding, but everything is just easier with email access.

Re: What’s in a PR statement: LastPass breach explained

#232

Post by didntreadarticl »

40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

I always struggled to find a decent Keepass implementation for my friend who uses Macs. Any recommendations?

Re: What’s in a PR statement: LastPass breach explained

#233

Post by firstSpeaker »

"We learn here that LastPass was storing your IP addresses. And since they don’t state how many they were storing, we have to assume: all of them. And if you are an active LastPass user, that data should be good enough to create a complete movement profile. Which is now in the hands of an unknown threat actor."

Scary for activists anywhere.

Re: What’s in a PR statement: LastPass breach explained

#234

Post by DrewADesign »

codexon wrote: post #216
counttheforks wrote: post #182

Earlier quoted context omitted.

> Developers shouldn't expect themselves to be able to do good design work Rude. People can learn to do multiple things without being pigeonholed, you know? > I see so many opportunities in FOSS lost to basic, unnecessary branding and usability oversights. It's FOSS. Feel free to contribute.

Speaking as someone who was mainly a "developer" for a while, one frequent problem I see from developers is that they assume they can excel at everything because they are good at coding. Since coding is a hard task that not everyone can do well, they think this talent applies to everything else. Just a few weeks ago on here, there was a developer complaining about not getting any attention through his efforts on soci…

Solid example, thanks. Worth specifically noting that we shouldn't be quick to judge, though. Every one of us has succumbed to novice cockiness at some point in our lives. People who build things, like developers, gain novice-level knowledge of everything from interface creation to domain-specific knowledge to copy writing to photo editing by osmosis. I'd be lying if I said I was any different.

Re: What’s in a PR statement: LastPass breach explained

#235

Post by manmal »

tasuki wrote: post #204
Flimm wrote: post #193

Earlier quoted context omitted.

Migrating from LastPass to another password manager is actually a pretty easy process. Many password managers can import passwords from LastPass.

Yes, sure that's easy. Also now there are twice as many places from which an attacker can get your passwords. Oops?

Have you read the 1Password whitepaper? This isn’t exactly an easy target for any attacker.

Re: What’s in a PR statement: LastPass breach explained

#236

Post by wmeredith »

irrational wrote: post #47
rietta wrote: post #29

Earlier quoted context omitted.

Have to plan ahead and have the keypass password in an envelope in the safe deposit box.

What else is in your self deposit box? I thought only rich people with gold and jewels and spies with fake passports and ready currency used safe deposit boxes.

I'm middle class. We have a safe deposit box where I keep stuff that would be a pain in my ass to replace in the event of a fire/flood/etc.

Said items are titles to my vehicles and home, my marriage license, the will of a family member I've been entrusted with, birth certificates for my self and family members, and a couple of keepsakes for the kids that I'm very long on. It only costs me about $80 per year, and it brings me a lot of peace of mind. I have photocopies of all those docs at home, because you rarely need the real thing.

Re: What’s in a PR statement: LastPass breach explained

#237

Post by isthisthingon99 »

FreakLegion wrote: post #174
isthisthingon99 wrote: post #140

Earlier quoted context omitted.

Since i use Google Authenticator for numerous services this is going to happen to me one day. So what I did was set it up on more than one phone.

You can back the secrets up to a text file, print them out, etc. too. They're short Base32 strings and TOTP is a standardized protocol with an RFC (6238) and everything.

Yes i did this too

Re: What’s in a PR statement: LastPass breach explained

#238

Post by mdaniel »

alex- wrote: post #230
mdaniel wrote: post #180

Earlier quoted context omitted.

> This appears to also be the case for 1password and bitwarden, so not specifically a lastpass failure. It is currently(?) the case for Bitwarden, yes, but that's incorrect for 1Password, as they have client-only key material that is never transmitted to the cloud: https://blog.1password.com/what-the-secret-key-does/

Yes, a secret key like this could have made this breach much less concerning. Assuming you trust the company to not also lose this data (that they generate and claim to not store). What I was really hoping to find was a paid, cross platform, cloud sync'ed solution that can be setup to require your password and physical key to decrypt. i.e. have 2FA protection from a data breach like this.

There's nothing that I'm aware of preventing one from putting the secret key material on a hardware wallet of your comfort level and having it type in the encoded value when signing onto a new device (the way the Yubikey pretends to be a keyboard when plugged in); obviously(?) 1Password is not incentivized to own such a complex workflow but there's nothing that I can see stopping you from doing it. FWIW they also support 2FA on login, which is different from the secret key to unlock the vault, so ... 3FA?

With regard to the "claim not not store" part, they've had multiple security audits including granting the auditor access to the underlying source code, so if there was something underhanded going on, I believe it would have gotten out by now: https://support.1password.com/security-assessments/

I'm with you that it's not as nice as open source clients, but given a choice between trusting 1Password with code I cannot see and trusting Bitwarden with code that I can see, I'm sticking with 1Password

Re: What’s in a PR statement: LastPass breach explained

#239

Post by janalsncm »

dgrin91 wrote: post #19
40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

Print password and detailed access instructions. Put instructions in safe deposit box. Allocate access to safe deposit box in your will.

Emergency access is a human problem. Seeking a technical solution to a human problem is just asking for trouble. This is why lawyers and customer service will always be necessary.

Re: What’s in a PR statement: LastPass breach explained

#240

Post by hn_throwaway_99 »

manmal wrote: post #235
tasuki wrote: post #204

Earlier quoted context omitted.

Yes, sure that's easy. Also now there are twice as many places from which an attacker can get your passwords. Oops?

Have you read the 1Password whitepaper? This isn’t exactly an easy target for any attacker.

I haven't read the 1Password whitepaper, could you elaborate? Would be curious what 1P is doing that is substantially more secure than what LP is doing (not counting the braindead stuff like not encrypting website URLs) Having been a 1P user, my guess is that, unlike LastPass, in 1P the data used to encrypt your vault includes both a completely random key and your master password, while in LastPass it's just your master password. Is there anything else?
Post reply on HN