Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Lost All Faith in LastPass

infosec.exchange

Post reply on HN
Print view View original

241–250 of 322 posts

Re: I Lost All Faith in LastPass

#241

Post by Fire-Dragon-DoL »

RulerOf wrote: post #153
Fire-Dragon-DoL wrote: post #83

Earlier quoted context omitted.

I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer. Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked to…

>What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag How did you add the tag, or is it obvious in the UI? I've never used 1Password before but think I'm gonna land there instead of Bitwarden, and I like this idea.

So, keep in mind that 1Password works in a "weird way": you are expected to have the native app installed.

The web portion has *less edit capabilities* than the native app. You should have the extension and the native app installed at the same time, the extension should connect to the native app (and share login).

In the native app you can click on one item and then hold shift or control (Windows) to select multiple items, then you literally drag them on the tag on the left. It will feel laggy a few seconds if you tag 1000 items like I did and it might not work perfectly, so double check that all the items got tagged. To do that check, you have to: click on the tag, then scroll to the end. It will tell you the count of all the items for that tag. Repeat the "bulk tagging" until the count is what you expect. Do notice that if you click on one item and then hold shift and click on the item at the end of the list, it will select all of them, so this process is pretty fast. I had to do only 2 tries before all of the items got the tag.

EDIT: You must have added the tag to at least 1 item manually for the tag to show up in the sidebar. To do that just press "edit" on the item and at the bottom there is a "tags" field, you can add one. In the web version, you just type tags and separate them by commas. The native version has a way better control.

Secret about tag: if your tag is named `foo/bar` it will represent them in a tree-like structure in the native app, so `foo` -> `bar`.

Re: I Lost All Faith in LastPass

#242

Post by kcartlidge »

Fire-Dragon-DoL wrote: post #231
kcartlidge wrote: post #197

Earlier quoted context omitted.

> but that cache is not diligently kept up to date Is the ability to take a payment the only thing LastPass got right?

No, not true. I'm using 1Password and while I like it, there are a few things LastPass got right where it even beats 1Password. The one on top of my mind is that you can unlock LastPass with a PIN. My wife has a phone with a glass cover (to protect it from the children), which "broke" fingerprint unlock. She's required to type the full password every time to unlock it, which is particularly hard on phone (long passwo…

Fair enough. And I used it myself for many years.

TBH it was more of a throw-away sarcastic outburst, an exclamation, an out-breath, than a genuine question. And also based mainly on the security side of things. I didn't make that clear, however, so I apologise for leading you into expending so much effort on your excellent reply.

Re: I Lost All Faith in LastPass

#243

Post by [deleted] »

acatton wrote: post #161
aflag wrote: post #115

Earlier quoted context omitted.

You should be able to know all the references to a variable, if you are careful when writing your program. Also, you could write a destructor that scrambles the memory location before the object is collected. However, you would still not have control over copies that the GC may decide to make and it is a bit trickier to force a free, since the GC is in no obligation of freeing an object as soon as it has no more refe…

> You should be able to know all the references to a variable, if you are careful when writing your program. The issue is: what if thread A and thread B hold a reference to the password variable? And you don't know in which order they will execute. In which thread do you scramble the password before releasing the variable reference? From what I understand, OP's point is: because of the nature of C, you have to know w…

[deleted]

Re: I Lost All Faith in LastPass

#244

Post by gregmac »

acatton wrote: post #84
jrochkind1 wrote: post #46

> I'm less thrilled about it being written in a garbage collected language What are the security problems with garbage-collected languages? (not being sarcastic, don't have an agenda, I have no previous knowledge on this, and am not a security expert. Just had never heard this suggested before, and am curious what he meant. Legit question!)

Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. This way, if this chunk of data stays in memory (which is most likely the case with libc's free()) it cannot be read by exploiting a buffer overflow. With garbage collected language, programmers don't know when their variable is "free()ed", since it could be held in multiple thread, and the last t…

> it cannot be read by exploiting a buffer overflow

What does the attack that does this actually look like? Lastpass reads text off an html page and decides when to inject auto-fill prompts and/or enter in a password. Is it possible for a buffer overflow to be exploited there, that lets an attacker (who controls the site) gain access to a password for a different site? How does that work?

Is there some other attack possible here? Ie: is it possible another user-space application can read passwords from memory used by the password manager? How does another app know it's a password? How does it trigger a buffer overflow?

(I'm ignoring apps running with kernel or privileged access: that seems like game over)

Re: I Lost All Faith in LastPass

#245

Post by dpedu »

pentest_bob wrote: post #185
wirrbel wrote: post #148

Wondering how Enpass Performs

Closed source requires a lot of trust in this case.

While source code access is certainly a concern for some, it is worth pointing out that Enpass supports database sync methods such as Dropbox, Google Drive, and a proprietary "wifi" sync. This means that you can have sync like Lastpass or 1Password but retain complete control over your own data.

I can't speak to Enpass's security, but I have been a user for several years. It feels less polished than 1Password but is freer and more open.

Re: I Lost All Faith in LastPass

#246

Post by brightball »

ilyt wrote: post #143
brightball wrote: post #124

Earlier quoted context omitted.

One of the primary reasons I switched to Bitwarden. That and prioritizing Linux.

How good is browser addon in comparison to lastpass? This and vaultwarden being mature enough might be final push to make us move

I prefer it, but I haven’t used LastPass in about 3 years so I can’t give an up to date opinion.

Re: I Lost All Faith in LastPass

#247

Post by gregmac »

kcartlidge wrote: post #187
samtho wrote: post #47

I have been a LastPass customer for over 10 years and I think this January when my yearly subscription ends, I will finally not renewing. I’ve shrugged off a lot of strangeness that has been happening with them as a fledging company’s growing pains. Unfortunately, this incident is the final straw. I think we are going to see a lot more come to light and their lack of any sort of transparency on this is a cardinal sin…

> I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually. Did it about 18 months ago. I was expecting it to be more cumbersome than it was. Export from LastPass, import to BitWarden, manually compare. Simples . It all worked IIRC, though I only have a few dozen entries as I'm in the habit of clearing old ones down. Left La…

I also transitioned to bitwarden about 18 months ago, but I haven't deleted my lastpass account yet.

I've used LastPass for password history once, and a couple times for notes (which don't get exported).

Now I want to delete my lastpass account completely but what would be helpful is if I can mark all my bitwarden passwords that are still the same as the ones in LastPass, as I'd like to change all of them. Anyone know a way to do this?

Re: I Lost All Faith in LastPass

#248

Post by FatActor »

burkaman wrote: post #200
FatActor wrote: post #135

Earlier quoted context omitted.

https://www.grammarly.com/blog/appeal-to-authority-fallacy/

> if done improperly, this could be a logical fallacy Maybe I'm wrong but doesn't this put it in a totally different category than other fallacies? Circular arguments, for example. All circular arguments are wrong. If you identify a circular argument you don't even have to fully understand what is being said, you can immediately conclude "this is a bad argument". But appeal to authority isn't like that. "I'm not goin…

That's a good clarification. Thanks for the example.

Hmm... perhaps my concern is that expert opinions matter way more than non-experts, but we still can't blindly trust them.

...and I'm sure you're not saying to take everything they say as word of truth.

I withdraw my argument on the grounds it is poorly constructed.

Re: I Lost All Faith in LastPass

#249

Post by [deleted] »

Octokiddie wrote: post #240

> ... Padding oracle vulnerabilities, use of ECB mode (leaks information about password length and which passwords in the vault are similar/the same. recently switched to unauthenticated CBC, which isn't much better, plus old entries will still be encrypted with ECB mode), vault key uses AES256 but key is derived from only 128 bits of entropy, encryption key leaked through webui, silent KDF downgrade, KDF hash leaked…

[deleted]

Re: I Lost All Faith in LastPass

#250

Post by cogman10 »

blibble wrote: post #215
cogman10 wrote: post #152

Earlier quoted context omitted.

> Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. If you are worried, you can store the password in a byte array and zero that out. But further, a buffer overflow is practically impossible with a GCed language (especially a popular one). A programmer using a GCed language cannot write code which has a buffer overflow. That must come from a bug…

> If you are worried, you can store the password in a byte array and zero that out. if it's a copying collector this is no guarantee of anything but the same is true of general memory allocated with the OS (swap/THP/...), unless you use something like mlock()

Fair point, but really one of those situations where if an attacker is in the position to look at a password stored in a tombstone, you've got bigger problems (for example, would be trivial in that scenario to simply intercept the password rather than looking for it in VM memory).
Post reply on HN