Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Lost All Faith in LastPass

infosec.exchange

Post reply on HN
Print view View original

121–130 of 322 posts

Re: I Lost All Faith in LastPass

#121

Post by nequo »

aidos wrote: post #94
EMIRELADERO wrote: post #35

Earlier quoted context omitted.

That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible .

They are in the business of doing business. How much of the codebase that makes up their business model would you like them to expose?

Bitwarden is in the business of doing business, too. But their source code is publicly available. A lot of it is even under GPL:

https://github.com/bitwarden/server/blob/master/LICENSE_FAQ....

Re: I Lost All Faith in LastPass

#122

Post by [deleted] »

dylan604 wrote: post #93
EMIRELADERO wrote: post #35

Earlier quoted context omitted.

That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible .

Because they like being in business vs just giving away their software? Where is the repo of software that you've paid an unknown number of developers to work on for multiple years over multiple versions that you charge for and run a viable business employing all of the peoples?

[deleted]

Re: I Lost All Faith in LastPass

#123

Post by luckydata »

I just canceled my yearly family subscription and moved to Bitwarden which to be fair is less polished in some aspects and more in others. Support refunded me my yearly fee 3 months into the year which was nice, but my feedback for them was that the only way I would ever consider them again would be if they fired EVERYONE in management, got acquired by a company whose reputation I trust and completely rebuilt their product. Which is to say I will never be a customer again or recommend them to anyone ever again.

Re: I Lost All Faith in LastPass

#124

Post by brightball »

FatActor wrote: post #10

How do we know 1Password doesn't have similar glaring oversights like LP? We can't audit their code unless it is open source? I'm not going to just believe them at face value because some random internet personality says so. Unless some respected authority can publish an audit of the security posture and source code, we're just taking them at their word. Granted, if I had to chose today, I would instantly pick 1Passw…

One of the primary reasons I switched to Bitwarden.

That and prioritizing Linux.

Re: I Lost All Faith in LastPass

#125

Post by ilyt »

dylan604 wrote: post #93
EMIRELADERO wrote: post #35

Earlier quoted context omitted.

That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible .

Because they like being in business vs just giving away their software? Where is the repo of software that you've paid an unknown number of developers to work on for multiple years over multiple versions that you charge for and run a viable business employing all of the peoples?

Just because source code is available doesn't mean you can legally use it.

That's why every "the company source code got stolen!" news is nothingburger, no competitor can use it, it would be huge liability to be caught using it, and it "only" matters for people that might find bugs in it.

Re: I Lost All Faith in LastPass

#126

Post by [deleted] »

FatActor wrote: post #10

How do we know 1Password doesn't have similar glaring oversights like LP? We can't audit their code unless it is open source? I'm not going to just believe them at face value because some random internet personality says so. Unless some respected authority can publish an audit of the security posture and source code, we're just taking them at their word. Granted, if I had to chose today, I would instantly pick 1Passw…

[deleted]

Re: I Lost All Faith in LastPass

#127

Post by kivle »

PartiallyTyped wrote: post #59
Havoc wrote: post #58

Leaning strongly towards self-hosting. Name brand cloud managers just make too juicy a target for sophisticated attackers regardless of their competence/care of the pass manager co. I know it's got a bit of security via obscurity vibes, but I've concluded the combo of residential IP, wireguard, firewall and dedicated VM is probably more secure. That would require someone with decent skill targeting me specifically...…

You can always self-host BitWarden! NB: Not affiliated with the company, just a very happy customer.

I was self-hosting bitwarden-rs (alternative implementation in Rust) in a Docker container, and I had set up Watchtower to automatically update it nightly. I thought I would be relatively safe and keep up with updates.

Well, it turns out the project in question had to change their name from bitwarden-rs to vaultwarden-rs since they violated the trademark. Updates stopped being pushed to the original docker image url, and several months passed until I suddenly noticed this. In the meantime I could easily have missed some important security upgrades.

I understand it's only myself at fault here, but it made me migrate to a hosted account instead. As fun as it is to self host things, something this security critical is probably better left to dedicated people.

Re: I Lost All Faith in LastPass

#129

Post by luckydata »

samtho wrote: post #47

I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin…

you can ask them to cancel ahead of time and get a refund as long as you explain it's because the lost of trust and the fact that they don't provide the service they advertise. I did it yesterday and I encourage everyone to do it. Even if they stop, the refunds send a STRONG message to management. Also don't be shy to chargeback if your CC company allows you to. Companies like LastPass need to be made an example of, and you have the power in this situation.

Re: I Lost All Faith in LastPass

#130

Post by aflag »

sixothree wrote: post #92
tredre3 wrote: post #88

Earlier quoted context omitted.

I suppose it's a lot more difficult to wipe memory clean in a garbage collected language. For example: password = "my-secret-password"; // do stuff then remove the pass from memory password = "" or null or delete or unset We have no guarantee that the first string "my-secret-password" will be collected and removed any time soon whereas in C or C++ we could just memset it before freeing it. But that feels like a very…

C# has SecureString. I assume BitWarden uses this. edit: https://learn.microsoft.com/en-us/dotnet/api/system.security...

Interestingly, in those docs they recommend against using that class and point to this github repo explaining the reason: https://github.com/dotnet/platform-compat/blob/master/docs/D...
Post reply on HN