Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Lost All Faith in LastPass

infosec.exchange

Post reply on HN
Print view View original

181–190 of 322 posts

Re: I Lost All Faith in LastPass

#181

Post by piaste »

aflag wrote: post #130
sixothree wrote: post #92

Earlier quoted context omitted.

C# has SecureString. I assume BitWarden uses this. edit: https://learn.microsoft.com/en-us/dotnet/api/system.security...

Interestingly, in those docs they recommend against using that class and point to this github repo explaining the reason: https://github.com/dotnet/platform-compat/blob/master/docs/D...

To be pedantic, they're not saying the class is making things worse - it just doesn't do anything on .NET Core because it lacks cross-platform encryption APIs comparable to the ones used on .NET Framework. So it's basically just a String.

It's a little frustrating that their only recommended alternative is "just give us your secrets bro" though:

> The general approach of dealing with credentials is to avoid them and instead rely on other means to authenticate, such as certificates or Windows authentication.

Re: I Lost All Faith in LastPass

#182

Post by kcartlidge »

aflag wrote: post #130
sixothree wrote: post #92

Earlier quoted context omitted.

C# has SecureString. I assume BitWarden uses this. edit: https://learn.microsoft.com/en-us/dotnet/api/system.security...

Interestingly, in those docs they recommend against using that class and point to this github repo explaining the reason: https://github.com/dotnet/platform-compat/blob/master/docs/D...

Nice. Less of a SecureString and more of a SlightlySmallerWindowOfInsecurityString. TIL.

Re: I Lost All Faith in LastPass

#183

Post by tinco »

slim wrote: post #149
acatton wrote: post #84

Earlier quoted context omitted.

Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…

they don't know when it's going to be freed, but they do know when they're not going to need it anymore and can overwrite it exactly like in C. or am I missing something?

Yes. Except unless of course you're not certain if the buffer you have your secret in was copied at some point. Maybe by the text control you rendered it in.

Re: I Lost All Faith in LastPass

#184

Post by duped »

aflag wrote: post #115
acatton wrote: post #84

Earlier quoted context omitted.

Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…

You should be able to know all the references to a variable, if you are careful when writing your program. Also, you could write a destructor that scrambles the memory location before the object is collected. However, you would still not have control over copies that the GC may decide to make and it is a bit trickier to force a free, since the GC is in no obligation of freeing an object as soon as it has no more refe…

> Also, you could write a destructor that scrambles the memory location before the object is collected.

This assumes you can write destructor at all and that it's run deterministically.

> though you can probably force that to happen in most GCed languages

I'd actually be surprised if any GC'd language allows this. You normally need to resort to different kinds of tricks for RAII-like behavior.

Re: I Lost All Faith in LastPass

#186

Post by Dylan16807 »

acatton wrote: post #147

When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth. For me, my password…

> 1Password claims are the same claims as LastPass

And the whole post is about things other than the claims.

Re: I Lost All Faith in LastPass

#187

Post by kcartlidge »

samtho wrote: post #47

I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin…

> I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually.

Did it about 18 months ago. I was expecting it to be more cumbersome than it was. Export from LastPass, import to BitWarden, manually compare.

Simples. It all worked IIRC, though I only have a few dozen entries as I'm in the habit of clearing old ones down. Left LastPass going for a few weeks just in case, then closed it down and the data was deleted.

Edit: If I was doing it now, I'd do it from scratch and change every LastPass-aware credential as I go. That info is out there now; you don't want to be using it any more.

Re: I Lost All Faith in LastPass

#188

Post by aljarry »

sixothree wrote: post #92
tredre3 wrote: post #88

Earlier quoted context omitted.

I suppose it's a lot more difficult to wipe memory clean in a garbage collected language. For example: password = "my-secret-password"; // do stuff then remove the pass from memory password = "" or null or delete or unset We have no guarantee that the first string "my-secret-password" will be collected and removed any time soon whereas in C or C++ we could just memset it before freeing it. But that feels like a very…

C# has SecureString. I assume BitWarden uses this. edit: https://learn.microsoft.com/en-us/dotnet/api/system.security...

There's a pretty important note in the remarks, that you should not use SecureString in new code, as it only shortens the lifespan of the plaintext in memory.

Re: I Lost All Faith in LastPass

#190

Post by dijit »

manmal wrote: post #138
dijit wrote: post #64

Earlier quoted context omitted.

i think “trusting dropbox more” is not what i would necessarily expect. nonetheless i think the provider of my password manager should not themselves host my password vault. If anyone from 1password is reading this: I trust you, but you make it hard to do so if you cannot be flexible about not hosting everything. fd: I use 1password at home and for work.

How would you run a shared vault for work on a „dumb“ file hosting service? With the ability to add/remove team members, recover vaults in case of password loss etc? What about the fact that master passwords can be brute forced if they are weak, just as LP customers are now affected?

I mean, crypographically we’ve had solutions to those exact problems for 30 years.

PGP might not be very usable but it also had mechanisms to do this.

if you are scared of people copying the vault before they lose access to the storage: you’ll be very sad to know that this is already possible with the SaaS solutions.

if you're worried about people breaking the vault if they have access: then its even more of a reason to control the access.

Post reply on HN