191–200 of 270 posts
Earlier quoted context omitted.
Banks are a lot less secure than eg Google. And Google has fewer government mandates on them than banks do. (I worked both in banks and at Google.) However you are right that Google thinks they would lose a lot from being less secure.
Banks' true security is rooted in the real world.
Earlier quoted context omitted.
I expect the amount of companies that would get fucking owned by simply managing to execute cat ~/.aws/* | On a devops/senior dev machine is colossal.
What I want is a secure shell (somehow) where my env variables are encrypted and on access I get a prompt to either use a fingerprint reader or a password to unlock them for the process. Anyone know of any such option? What I've come to use are separate env files that I source in various directories before running the commands that need crednetials, or a tool that decrypts a file, loads it into an subprocesses env va…
Only 4 engineers had this level of privilege at lastpass, how did the attacker identify the target? Linkedin... that's why you should not list where you work until you're no longer working there or list a completely different role than what you're currently in. I'm listed as a janitor of where I work. Only those that know me, know what I really do. I've tried to sell the policy forbidding employees from listing their…
Do you get a lot of janitorial service headhunting spam?
So LastPass, a security company, has people who are tasked with both delivering features as fast as possible using a variety of development tools (dev) and administer their production systems where critical data lies (ops). On the same machine, from home.
It seems that this breach is not really an accident and more a logical conclusion.
Earlier quoted context omitted.
"DevOps enables coordination and collaboration between formerly siloed roles like development, IT operations, quality engineering, and security." - https://learn.microsoft.com/en-us/devops/what-is-devops It's not a job title, it's an engineering practice. People who participate in DevOps include "software engineer", "network engineer", "IT operations engineer", "platform engineer", "cloud engineer", "quality engineer…
I do not like the title either, but I do understand the motivation of taking all those "non-software engineering", technical roles and putting them under the same umbrella, due to a lack for a better title, because a company might not afford to have separate roles for each of those areas you have listed above. "OPERATIONS ENGINEER" might work, but it raises another set of problems, e.g. does it imply operational resp…
There are many options that don't tack "dev" into your non-dev job titles.
Ironically, if they’d used a LastPass generated pass on plex, it would have been infeasible to crack the breached plex password. Using LastPass would literally have prevented a breach of LastPass.
Earlier quoted context omitted.
Are there any reliable ways to secure remote computers from keyloggers _and_ still provide an efficient software development environment for non-trivial projects? All of the software engineers I have seen have a fairly unrestricted environment -- Linux machines, with sudo access, often with passwordless root access via "docker" group, and with non-intrusive "endpoint protection" system. It would be normal to for some…
My company operates in a Windows centric industry and our software team uses it as well. It turns out you don't need administrative privileges for a lot of dev work (installing and running vs code, python, node, many databases, etc...). My experience is that sudo apt-get install is a Linux Distro thing, most programs don't need special permissions as long they are installed in user scope. So, answering your question,…
Earlier quoted context omitted.
How would you fix this problem with 2fa? I can't imagine how this would work technically. Maybe I am missing something.
Require the second factor for decrypting the vault. It seems the second factor is "removed" as soon as you cache the vault on your machine.
So, with most password managers, when you authenticate on a new device, you are prompted for MFA. The user had a keylogger installed on their machine, so the attacker could collect the master password, but how did they login to the vault on a new machine without MFA? Did they get the MFA seed and login on a different machine, and nobody received a "You're using LastPass on a new machine, if this wasn't you..." messag…
I work for a LastPass competitor. As far as I know, no popular password manager seriously includes "fully compromised local device" in their threat model. I don't think it can be done without hurting seriously usability (like having one 2fa verification each time you use a credential would work) and the predictable outcome of hurting usability too much is that people will find more handy insecure ways to store their…
I'm interested in the technical idea here. You have a set of credentials encrypted with AES. So each vault item is encrypted with a symmetric key. How would you build a system to generate those keys using a rotating 2FA that isn't reversible by an attacker that can watch the entire process and can fake the timestamp or other elements on the computing device as needed?
I can see that you have code that enforces 2FA on each vault access, but that code is run on the local system, so it can be trivially bypassed by an attacker with root.
There's a weird combination of "what happened" and causation in here: >> the credentials for the servers were stolen from a DevOps engineer who had access to cloud storage at the company. This made it more difficult for LastPass to detect the suspicious activity. How does A => B? >> The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and ga…
I think the idea here is that we want the cryptography operations to happen entirely locally, so that LastPass doesn't have any access to them. However, if you do that, someone with root on that system and the Master Password can replicate the operations the local system does on the vault. I'm not aware of any symmetric-encryption algorithm that includes a time-based un-replayable TOTP or HOTP in the key-generation process.