What could possibly go wrong with a centralized password database
Low value comment.
LastPass says DevOps engineer’s hacked computer led to security breach in 2022
81–90 of 270 posts
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#82Earlier quoted context omitted.
In the US, it's legal under threat of being fired, since companies can fire you for any reason as long as it's not discrimination of a protected class.
California also has this law: >Labor Code section 232.5 prohibits an employer from discharging or retaliating against an employee who discusses or discloses information about the employer’s working conditions. https://www.dir.ca.gov/dlse/howtofilelinkcodesections.htm I'm not sure if it applies, but I could see why lawyers might be nervous about forbidding employees from saying their role.
The actual law states:
No employer may do any of the following:
(a) Require, as a condition of employment, that an employee refrain from disclosing information about the employer's working conditions.
(b) Require an employee to sign a waiver or other document that purports to deny the employee the right to disclose information about the employer's working conditions.
(c) Discharge, formally discipline, or otherwise discriminate against an employee who discloses information about the employer's working conditions.
(d) This section is not intended to permit an employee to disclose proprietary information, trade secret information, or information that is otherwise subject to a legal privilege without the consent of his or her employer.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#83Definitely way past time to switch from passwords to mTLS or WebAuthn
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#84Earlier quoted context omitted.
Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if somethi…
> Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
I'm sure they meant something analog like on a sticky note rather than in a password manager, where it should be stored.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#85Earlier quoted context omitted.
Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if somethi…
> Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
[deleted]
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#86Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…
Doesn't sound good for the employee.
Why would people wanna work somewhere you can't speak about their job role? I think that'd filter out tons of applicants.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#87Earlier quoted context omitted.
Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if somethi…
> Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
Almost 20 years ago, I worked with this (not particularly competent) sysadmin. Policy said the root password had to be rotated once a month. So, in July 2003, they set the root password to blah0307 (where blah was some random word, which I forget now but knew at the time.) I wasn’t actually supposed to know the root password, but one of my colleagues let me in on the secret, including the repetitive pattern. I think the security auditor ticked the box “root password changed every 30 days”, but never asked what the password actually was.
I know some places have rules like “must have at least N characters different from previous passwords”. However, depending on the exact rule, people can come up with easy-to-remember workarounds: e.g. the “blah” bit is ”foo” in even months and “bar” in odd ones.
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#88[deleted]
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#89I'm not sure the description is what actually happened. It doesn't have the ring of truth to it. That said, LastPass is not deserving of any trust as a password product of any kind. That a password was captured by a keylogger on a Dev Ops home computer shows that they don't understand how to secure remote computers, the meaning of defense in depth, the importance of proper login authentication, or how to secure data…
Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…
Personally, I'm not a fan of the answers that amount to a cloud-hosted thin client. I use these at work, they're absolute technological marvels, but they suck.
The real answer is a zero trust network that implements:
- multi factor auth
- deployment approval gates
- end to end service encryption
- ALE for secrets and keys
- password managers
- WireGuard tunneling or equivalent
- read only production environments by default; major levers to pull in order to write
- fully partitioned environments, all of which partitioned away from the corporate network of laptops, printers, and security cameras
Re: LastPass says DevOps engineer’s hacked computer led to security breach in 2022
#90Earlier quoted context omitted.
> Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
I'm sure they meant something analog like on a sticky note rather than in a password manager, where it should be stored.
My bank still won’t let me paste a password so at least that bank doesn’t mean use a password manager!