Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Lost All Faith in LastPass

infosec.exchange

Post reply on HN
Print view View original

131–140 of 322 posts

Re: I Lost All Faith in LastPass

#131

Post by maccard »

EMIRELADERO wrote: post #24
weakfortress wrote: post #14

Earlier quoted context omitted.

1password has a document on their security arch: https://1passwordstatic.com/files/security/1password-white-p... . This alone lends credence to their claims. To this date there has been no major breaches despite being a large target (albeit smaller than LP). Moreover, the fact that your vault is both password protected and locked behind a secret key is about as good as you can get in terms of commercially offered sec…

If a document alone lends credence to their claims, the source code would do wonders. It's not about public contributions, it's about transparency and good faith.

Why do you trust the source code is actually what they deploy to your device, or that what they build isnt linked against extra libraries, maybe even internal library?

Re: I Lost All Faith in LastPass

#132

Post by ilyt »

Espressosaurus wrote: post #44
FatActor wrote: post #15

Earlier quoted context omitted.

Thank you for the link. > It's also been built by people who are respected in the security industry. This means almost nothing. It is an appeal to authority. Experts can still miss things. Yes, it is better than experts saying a product stinks, but still is not trustworthy without open source. Maybe I'm making my own fallacy here, I'm just trying out a position.

An appeal to authority is not a logical fallacy if the person in question is actually an authority in the domain .

Appeal to authority is, instead of giving actual arguments you throw a name and say, "well, they surely know their stuff!".

Whether they know stuff or not is irrevelant to the fact person is trying to avoid having constructive argument.

So it could really be dismissed by "okay, they are experts, but how you're sure they didn't wrote it all on hangover?"

Re: I Lost All Faith in LastPass

#133

Post by gretch »

acatton wrote: post #84
jrochkind1 wrote: post #46

> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)

Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…

An interesting point and I wonder if there are thoughts on if the JVM should implement flags that do overwrite before gc (obv worse perf but some cases have use for it).

Or at the least, let a program implement parts of the gc api and plug it in themselves.

Re: I Lost All Faith in LastPass

#134

Post by dagi3d »

EMIRELADERO wrote: post #18
samwillis wrote: post #12

Earlier quoted context omitted.

There is a white paper on 1passwords design: https://1passwordstatic.com/files/security/1password-white-p... They also regularly have audits and pen tests, with the reports pushed publicly: https://support.1password.com/security-assessments/ Finally, it's been built by people who are respected in the security industry.

Still doesn't explain why it's all not at least source-available. I'm not going to complain if they don't use open-source licenses such as MIT or (A)GPL, but straight up not making the source code publicly readable at all is a big strike against it.

Making it opensource is no guarantee at all(if there could be any), for instance it could be more dangerous: anyone could spot a security hole and take advantage of it without reporting it, there is no guarantee there would be a responsible disclosure.

Re: I Lost All Faith in LastPass

#135

Post by FatActor »

burkaman wrote: post #52
FatActor wrote: post #15

Earlier quoted context omitted.

Thank you for the link. > It's also been built by people who are respected in the security industry. This means almost nothing. It is an appeal to authority. Experts can still miss things. Yes, it is better than experts saying a product stinks, but still is not trustworthy without open source. Maybe I'm making my own fallacy here, I'm just trying out a position.

Appeal to authority is not a fallacy, it's basically a necessity to function in the world.

https://www.grammarly.com/blog/appeal-to-authority-fallacy/

Re: I Lost All Faith in LastPass

#136

Post by bobkazamakis »

acatton wrote: post #84
jrochkind1 wrote: post #46

> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)

Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…

>With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last thread dying will release the memory for this variable

And there is simply no way to deal with this, technology just isn't there yet.

Re: I Lost All Faith in LastPass

#138

Post by manmal »

dijit wrote: post #64
joshe wrote: post #30

Earlier quoted context omitted.

Which people? I've been very reluctant to use their cloud solution as I trust Dropbox more for security. So I still fight 1password to keep the vault stored in Dropbox. I figure there are maybe 4 organizations who are active enough to prevent a full download of all their user's data. Google, Dropbox, Amazon, and Facebook. (Maybe Apple, but they seem lethargic.) Because they store all the passwords to all of our servi…

i think “trusting dropbox more” is not what i would necessarily expect. nonetheless i think the provider of my password manager should not themselves host my password vault. If anyone from 1password is reading this: I trust you, but you make it hard to do so if you cannot be flexible about not hosting everything. fd: I use 1password at home and for work.

How would you run a shared vault for work on a „dumb“ file hosting service? With the ability to add/remove team members, recover vaults in case of password loss etc? What about the fact that master passwords can be brute forced if they are weak, just as LP customers are now affected?

Re: I Lost All Faith in LastPass

#139

Post by yjftsjthsd-h »

waboremo wrote: post #95
samtho wrote: post #47

I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin…

I've made the transition to multiple different services over the years, not on a large professional scale so I cannot comment on doing that and I reckon doing that would require completely different advice than I am suggesting below. I would highly recommend starting new. Every transition between managers has wound up leaving me having to manually delete fields after the fact anyways, or just keep those fields litter…

That's a good point; especially since LP just had a breach, it's a good time to ensure that none of your passwords are the same as what's in their database anyways.

Re: I Lost All Faith in LastPass

#140

Post by ilyt »

scubbo wrote: post #101
thefaux wrote: post #89

Earlier quoted context omitted.

The truth of a statement is what matters, not who uttered it.

And, when you are unable to evaluate the truth of a statement for yourself, the expertise of the person making the statement is a helpful datapoint when deciding how much to trust it.

Right but there is no statement by competent person made here.

The audits could be classified as that but not "well they hire security people, they must know what they are doing!"

Hyundai hires engine developers and their engines explode nonetheless!

Post reply on HN