Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Lost All Faith in LastPass

infosec.exchange

Post reply on HN
Print view View original

251–260 of 322 posts

Re: I Lost All Faith in LastPass

#251

Post by SailingCactus33 »

pjungwir wrote: post #174

I use a mix of pass(1) and LastPass, but this incident has convinced me to put everything on pass. But I don't really use it the "recommended" way, where you put the password on the first line. It's not a great fit for a consultant when half my customers want to give me my own Gmail/Atlassian/etc account. So I tend to keep big files of free-form text instead. But if I'm going to use it with a browser, the manual copy…

I consider the flexibility of pass(1) to be one of the best features. In my case, I use a hierarchy to manage secrets across different orgs and classifications. The structure I use is:[ORGANIZATION]/[CLASSIFICATION]/[SITE|APP]/[USER]

e.g.: Personal/Confidential/google.com/pjungwir@gmail.com Client1/Secret/google.com/pjungwir@example.com

The folder structure allows for different keys to be used in .gpg-id files, so secret access can be limited on different devices based on which keys are available. For example, only a subset of keys are available on my android phone via the Password Store app from F-Droid, with all devices using a shared password-store synced using git(1).

Completion with bash works well (on Fedora) and following the convention of having the password on the first line allows for the android app to work and you don't need to worry about someone looking over your shoulder by using 'pass -c ...'.

Re: I Lost All Faith in LastPass

#252

Post by cogman10 »

acatton wrote: post #170
cogman10 wrote: post #152

Earlier quoted context omitted.

> Usually security nuts like to override the clear-text string with zeros or random characters before calling free() on it. If you are worried, you can store the password in a byte array and zero that out. But further, a buffer overflow is practically impossible with a GCed language (especially a popular one). A programmer using a GCed language cannot write code which has a buffer overflow. That must come from a bug…

> But further, a buffer overflow is practically impossible with a GCed language (especially a popular one) Because the JVM had no buffer overflow? [1] Also I purposefully wrote "buffer overflow & co" because buffer overflow are not the only possibility. Shellcodes could ptrace() and inspect the memory of the program. > > the last thread dying will release the memory for this variable. > Really not how GCed languages…

> Because the JVM had no buffer overflow?

Happens extremely rarely and is frequently not in JVM core code but rather something like the 2d renderer or applets. Code not likely to be executed on a server.

Take a deeper look into those CVEs and count how many are for Java 8+ and server code (it's a pretty short list).

You might as well argue the linux kernel is insecure because there's been buffer overflows in the various drivers.

> Shellcodes could ptrace() and inspect the memory of the program.

Certainly, and they can redirect socket traffic and inject a MITM for any process to directly intercept a password. Even if you are zeroing memory, there will be a period of time when a password is present in memory which means the ptrace attack also works with C.

The bad part of a managed language is that passwords stay in memory for longer, but that risk is somewhat moot considering exploiting requires a compromised system. In which case, there's little reason to pull out passwords by sniffing memory.

Re: I Lost All Faith in LastPass

#253

Post by Faark »

aflag wrote: post #229
kmeisthax wrote: post #168

Earlier quoted context omitted.

In most GC languages, the String type itself is not a managed handle to a single memory buffer, but a reference into a whole copy-on-write datastore. So you can't even scramble the underlying memory - mutating the string to erase it will not zap the original, it will just create a copy. Your best bet is to ensure no references to the password string exist - including in library code you may use, which means constant…

You don't need to use the String type for your sensitive data, though. You can create your own type that acts the way you want.

There are strong incentives to use the built-in String class. APIs for UI will use it. The first google result for "c# Clipboard" certainly uses string. It'll be a lot of extra effort, that you might not have with a different language. That is, if actually you consider the risk worth it... i probably wouldn't.

Re: I Lost All Faith in LastPass

#254

Post by blobster »

easeout wrote: post #70
blobster wrote: post #62

This is why we need good OS-level password managers. Phones and now computers have dedicated security chips which are infinitely more secure than any cloud solution. Such an easy market to grab that it boggles me why Apple and Google aren't aggressively going for it.

iCloud Keychain syncing, strong password suggestions in Safari, and WebAuthn passkeys are all part of Apple's strategy. When they don't buy a third party and deeply integrate it, they tend to operate by insinuating themselves as the platform default. What would you have them add to that?

Their "password manager" on Mac is called Keychain Access. The UX is very bad, the interface is old and clunky and it doesn't sync with iOS (if for example you create a secure note there's no way to access it on iOS) - not to mention that most people don't even know it exists, it's kind of a hidden feature. Meanwhile, on iOS the password manager is hidden in the settings and again it has pretty bad UI/UX. I understand that they want to hide the complexity away from the end user and make these kinds of features "just work", but in practice they feel pretty half-baked.

Re: I Lost All Faith in LastPass

#255

Post by [deleted] »

RulerOf wrote: post #153
Fire-Dragon-DoL wrote: post #83

Earlier quoted context omitted.

I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer. Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked to…

>What I did though was tag all my password with "lp-breach-aug-2022" and then as I go through them and change them, I remove the tag How did you add the tag, or is it obvious in the UI? I've never used 1Password before but think I'm gonna land there instead of Bitwarden, and I like this idea.

[deleted]

Re: I Lost All Faith in LastPass

#256

Post by Fire-Dragon-DoL »

metabagel wrote: post #102
Fire-Dragon-DoL wrote: post #83

Earlier quoted context omitted.

I just did the migration (to 1password though, sorry the lack of tags is very bad for organization), 6 years old customer. Key points: - Refresh the website list from the extension before starting, ideally clear the extension cache first (will sign out) - export from the extension - attachments and password history are not exported - there is a lastpass-cli that will help you export attachments - there is a hacked to…

>> Key points: - Refresh the website list from the extension before starting I didn't understand any of your explanation of how to migrate from Lastpass to 1Password.

To perform a LastPass migration, there are 4 phases involved:

  1. Export passwords
  2. Export attachments
  3. Export password history
  4. Export form fills (THIS IS NOT POSSIBLE FROM MY UNDERSTANDING, form fills also appear to not be encrypted?!)
# 1. Export passwords

In the extension, go to Account Options -> Advanced -> Clear Local Cache, this WILL LOG YOU OUT. Then, log-in and Account Options -> Advanced -> Refresh Sites, this will update your local cache. Finally, begin the export process and follow the instructions, make sure to USE THE EXTENSION (not the website): Account Options -> Advanced -> Export -> LastPass CSV file. When saving the CSV, do not copy-paste the content of the HTML manually, instead use the popup to download the file that LastPass provides. You might need to allow popups for LastPass extension the first time you perform the export, then perform another one to get the popup.

# 2. Export attachments

Use lastpass-cli to export attachments. A script is provided in version 1.3.4: https://github.com/lastpass/lastpass-cli/blob/v1.3.4/contrib... Keep in mind that the script works also on version 1.3.3, which is the one provided pre-compiled by Ubuntu, you just have to copy-paste the script to your local machine.

# 3. Export password history

This is not possible natively, you can use my modified PR, but it's not trivial, bash knowledge, familiarity with C syntax is expected: https://github.com/lastpass/lastpass-cli/issues/245#issuecom... Keep in mind that YOU SHOULD AUDIT THE SOURCE CODE, I modified an existing PR and it's hacked together, I brought it only to where I needed it to, to get the password history out for my specific use-case.

# 4. Export form fills

Unsupported from my understanding

# Conclusion

Tag the items or mark them in your new password manager with something to remind you that they were breached on lastpass in august 2022 and remove such mark when you change their password.

Re: I Lost All Faith in LastPass

#257

Post by kcartlidge »

gregmac wrote: post #247
kcartlidge wrote: post #187

Earlier quoted context omitted.

> I would be interested to see some people write about this transition as I’m not sure if I want to export/import or start anew and move things manually. Did it about 18 months ago. I was expecting it to be more cumbersome than it was. Export from LastPass, import to BitWarden, manually compare. Simples . It all worked IIRC, though I only have a few dozen entries as I'm in the habit of clearing old ones down. Left La…

I also transitioned to bitwarden about 18 months ago, but I haven't deleted my lastpass account yet. I've used LastPass for password history once, and a couple times for notes (which don't get exported). Now I want to delete my lastpass account completely but what would be helpful is if I can mark all my bitwarden passwords that are still the same as the ones in LastPass, as I'd like to change all of them. Anyone kno…

Sorry, no. All I can think of is exporting from them both, stripping each down to just the account name, login, and password, sorting them the same way, then doing a diff. Laborious, but possibly less so than a manual comparison if you have quite a few.

Re: I Lost All Faith in LastPass

#258

Post by Fire-Dragon-DoL »

kcartlidge wrote: post #242
Fire-Dragon-DoL wrote: post #231

Earlier quoted context omitted.

No, not true. I'm using 1Password and while I like it, there are a few things LastPass got right where it even beats 1Password. The one on top of my mind is that you can unlock LastPass with a PIN. My wife has a phone with a glass cover (to protect it from the children), which "broke" fingerprint unlock. She's required to type the full password every time to unlock it, which is particularly hard on phone (long passwo…

Fair enough. And I used it myself for many years. TBH it was more of a throw-away sarcastic outburst, an exclamation, an out-breath, than a genuine question. And also based mainly on the security side of things. I didn't make that clear, however, so I apologise for leading you into expending so much effort on your excellent reply.

All good, appreciate the apology, I'm bad at reading sarcasm, sorry!

And I'm very angry at LastPass too.

To be fair, the thing I'm the most angry about at LastPass is how the product felt completely stale. I remember signing up 6 years ago and there has been no change at all across the board. Bugs, issues, improvements, NOTHING.

They could have avoided all this, they just didn't.

Re: I Lost All Faith in LastPass

#259

Post by manmal »

dijit wrote: post #190
manmal wrote: post #138

Earlier quoted context omitted.

How would you run a shared vault for work on a „dumb“ file hosting service? With the ability to add/remove team members, recover vaults in case of password loss etc? What about the fact that master passwords can be brute forced if they are weak, just as LP customers are now affected?

I mean, crypographically we’ve had solutions to those exact problems for 30 years. PGP might not be very usable but it also had mechanisms to do this. if you are scared of people copying the vault before they lose access to the storage: you’ll be very sad to know that this is already possible with the SaaS solutions. if you're worried about people breaking the vault if they have access: then its even more of a reason…

> I mean, crypographically we’ve had solutions to those exact problems for 30 years.

My point exactly - 1password.com addresses those problems (e.g. by adding a random key to the master password, and via Secure Remote Password auth), while using just a master password (sans random key) in a dumbly file-hosted vault does not.

Re: I Lost All Faith in LastPass

#260

Post by dijit »

manmal wrote: post #259
dijit wrote: post #190

Earlier quoted context omitted.

I mean, crypographically we’ve had solutions to those exact problems for 30 years. PGP might not be very usable but it also had mechanisms to do this. if you are scared of people copying the vault before they lose access to the storage: you’ll be very sad to know that this is already possible with the SaaS solutions. if you're worried about people breaking the vault if they have access: then its even more of a reason…

> I mean, crypographically we’ve had solutions to those exact problems for 30 years. My point exactly - 1password.com addresses those problems (e.g. by adding a random key to the master password, and via Secure Remote Password auth), while using just a master password (sans random key) in a dumbly file-hosted vault does not.

When you talk about “master key”, are you aware about multi-key cryptography?

me and my friend can have private keys to a ”vault” (or, file) that are solely our keys, even if they decrypt the same secret.

No need for a “master password” to unseal the vault.

Here is the gpg docs for it: https://www.gnupg.org/gph/en/manual.html#AEN111

section 5.1 of RFC 2440 explains how it works: https://www.ietf.org/rfc/rfc2440.txt

Post reply on HN