I Lost All Faith in LastPass • Hacker News Board

Re: I Lost All Faith in LastPass

#111

Post by danShumway » Thu, Dec 29, 2022, 7:09 PM UTC

geocrasher wrote: post #11

After reading this, I acted on a decision I was on the fence about. I already have moved to Bitwarden and like it a lot better, but this post prompted me to go into LastPass and actively delete my account. The next thing to do will be to start changing passwords. As with most of us, that's a project of serious scope that I do not look forward to.

Same boat. I'm mentally kicking myself having moved off so long ago but not having taken the final action that would have prevented me from being caught up in this breach at all.

When I first moved off I didn't want to close the account just in case something went wrong with the transition. But after it was clear that the transition was fine, then I should have gone back and just finished up the final step.

I probably needed to do a full account cleanup anyway at some point, but I just wish I had been slightly more proactive about deleting my data. It's a good lesson to learn, I'm thinking that as part of the account cleanup I should also take a look at what other accounts I have lying around that are unnecessary.

Re: I Lost All Faith in LastPass

#112

Post by counttheforks » Thu, Dec 29, 2022, 7:09 PM UTC

enraged_camel wrote: post #107

EMIRELADERO wrote: post #35

Earlier quoted context omitted.

That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible .

I mean, even if their code was publicly available, how could you verify that they are running that code, and not some other code?

Compile it yourself & run the binary?

Re: I Lost All Faith in LastPass

#113

Post by buu700 » Thu, Dec 29, 2022, 7:09 PM UTC

dkokelley wrote: post #99

buu700 wrote: post #57

Earlier quoted context omitted.

Source code is necessary for trust, but not sufficient.

It's a nice data point, but it's not necessary to me. Do you have the source code to your mail service provider or your online banking software? [1] Having the source code available says a few nice things: 1. This company is confident enough to show their work 2. This company is "good" at software engineering (or it could reveal the opposite) [1] I know some people can and do run their own mail servers. I can respect…

My mail provider and bank may be fine for their intended purposes, but I definitely don't trust them for storage of secrets or keys.

Re: I Lost All Faith in LastPass

#114

Post by michaelcampbell » Thu, Dec 29, 2022, 7:10 PM UTC

Havoc wrote: post #66

PartiallyTyped wrote: post #59

Earlier quoted context omitted.

You can always self-host BitWarden! NB: Not affiliated with the company, just a very happy customer.

Yeah, trying to decide between bitwarden, vaultwarden and a sync'd KeePassXC implementation. My LP password is thankfully on the stronger side of things so hoping I've got time to try them all

FWIW, I've used Keepass format for years. Different clients, different syncing mechanisms, but currently on KeepassXC + Syncthing.

Re: I Lost All Faith in LastPass

#115

Post by aflag » Thu, Dec 29, 2022, 7:10 PM UTC

acatton wrote: post #84

jrochkind1 wrote: post #46

> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)

Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…

You should be able to know all the references to a variable, if you are careful when writing your program. Also, you could write a destructor that scrambles the memory location before the object is collected. However, you would still not have control over copies that the GC may decide to make and it is a bit trickier to force a free, since the GC is in no obligation of freeing an object as soon as it has no more references (though you can probably force that to happen in most GCed languages).

Re: I Lost All Faith in LastPass

#116

Post by TillE » Thu, Dec 29, 2022, 7:10 PM UTC

blobster wrote: post #62

This is why we need good OS-level password managers. Phones and now computers have dedicated security chips which are infinitely more secure than any cloud solution. Such an easy market to grab that it boggles me why Apple and Google aren't aggressively going for it.

Apple's solution seems just great if you only use Apple products. But I use Windows too.

So I don't really think the OS is the right place for a password manager, at least not without some standardized interoperability.

Re: I Lost All Faith in LastPass

#117

Post by ChrisClark » Thu, Dec 29, 2022, 7:10 PM UTC

danShumway wrote: post #22

I moved off of LastPass a while ago, but hadn't actually deleted my account because of laziness/inertia. This breach was finally the impetus to get me to full-on delete my vault and start the process of cleaning up my old accounts. Luckily I've been off of it long enough that I suspect most of my regularly used accounts are different anyways, but I'm still going through the process now of methodically rotating all of…

The scariest part was it was a backup of theirs that was stolen. So deleting all your info might not have even protected it. It could still be in an old backup and get stolen. :(

I've deleted my stuff now anyway, it's all we can do. :(

Re: I Lost All Faith in LastPass

#118

Post by msla » Thu, Dec 29, 2022, 7:11 PM UTC

zopa wrote: post #104

Espressosaurus wrote: post #44

Earlier quoted context omitted.

An appeal to authority is not a logical fallacy if the person in question is actually an authority in the domain .

Sure it is: an appeal to authority is not a valid step in a deductive logical argument, unless you have somehow established that the authority in question is literally infallible. Now, it's grounds for an (extremely) persuasive inference! And we know very little of what we consider known by strict deductive logic: we rely on weaker inferential reasoning the vast majority of the time. Grandparent's "means almost nothi…

If you want to go down this route, we know nothing of the real world from strict deductive reasoning because the axioms strict deduction flows from do not apply to the real world, but to mathematical universes where absolute truth is accessible to us. In reality, all statements we could use as premises are only probably true to a certain level of confidence, having themselves been constructed from inductive reasoning. Therefore, appeal to a good authority is as good of a step as any, by which I mean it's only provisionally worthwhile unless and until sufficient evidence comes in to demonstrate it is invalid in a specific case.

Re: I Lost All Faith in LastPass

#119

Post by LarryMullins » Thu, Dec 29, 2022, 7:11 PM UTC

ascendantlogic wrote: post #100

nine_k wrote: post #7

The post looks a bit weird on first sight: "I always knew LastPass has a ton of flaws, but promoted it anyway". This may make sense though. LastPass seemed to be the only one with a good enough UX. And without a good enough UX, you can't make users actually use it. Using an imperfect but usable password manager is still much better than not using one with better security but poor UX. (Here comes the old adage: make t…

Security is not a binary thing. It's a spectrum and for most normal end-users having _any_ password manager is better than trying to keep all your passwords in your brain, which leads to password re-use and easy-to-guess passwords, etc. It's only after multiple episodes of what amounts to malicious incompetence that the cure becomes worse than the disease. I think we're collectively agreeing we've reached that point…

> for most normal end-users having _any_ password manager is better than trying to keep all your passwords in your brain, which leads to password re-use and easy-to-guess passwords, etc

Indeed. Writing down passwords on a pad of paper next to your computer is a valid practice for most people if we're being realistic, particularly for personal computer use. Even leaving passwords in an unencrypted text file on your desktop is not nearly as bad today as it used to be 20 years ago. Pretty much anything is better than using the same 8 letter password on every single website. That's the status quo which needs to be toppled.

Re: I Lost All Faith in LastPass

#120

Post by shagie » Thu, Dec 29, 2022, 7:11 PM UTC

counttheforks wrote: post #112

enraged_camel wrote: post #107

Earlier quoted context omitted.

I mean, even if their code was publicly available, how could you verify that they are running that code, and not some other code?

Compile it yourself & run the binary?

If you could do that, what value would the business have?