Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 77 posts

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#31

Post by [deleted] »

araes wrote: post #21
codetrotter wrote: post #8

Earlier quoted context omitted.

The more early someone was in mining or buying Bitcoin, the greater the possibility that they believe in Bitcoin in and of itself. I.e. to someone who was early into Bitcoin, they might wish to never sell off all of their BTC. And besides, even if you wanted to sell off your Bitcoins, there are a number of things to consider: - Taxes. Why sell millions of USD worth of Bitcoin now, and pay taxes on all of it today? Po…

This is a classic issue with money. What do you do if you're Taylor Swift? You're a 750 millionaire, with the next couple 100 on the way from this tour. Whelp, spent the first 50 on a house all humans will drool over. Got the compulsory car. Got the compulsory jet. Got the compulsory yacht (not quite as large as Bezos' (ehmm, banana?) that could not leave its construction port). [1] And with the other 600 million? Pr…

[deleted]

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#32

Post by daydream »

peter422 wrote: post #23

As somebody that has been using lastpass for many years and continues to do so… I just do not understand how people who pick weak master passwords complain about this. The lastpass documentation makes clear over and over that your entire DB can be compromised but as long as they don’t have the master password, you are safe. How people do not think one step past this and realize they need a very secure master password…

Why do you still use lastpass?

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#33

Post by kstrauser »

peter422 wrote: post #23

As somebody that has been using lastpass for many years and continues to do so… I just do not understand how people who pick weak master passwords complain about this. The lastpass documentation makes clear over and over that your entire DB can be compromised but as long as they don’t have the master password, you are safe. How people do not think one step past this and realize they need a very secure master password…

You’re right to a point, but there’s a world of difference in ways you can store a password. If their algorithm were a single round of MD5, it’s going to be a lot easier for an attacker to guess a password than if they were using Argon2.

I don’t think LastPass is using MD5, but my point is that their job is to make any master password harder to guess. They’re not doing it.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#35

Post by XorNot »

username135 wrote: post #34

Imo, Keepass > all

Agreed: combined with Syncthing for making it accessible on my devices (which plays nicely with Keepass2Android Offline edition).

Then handle backups with a cloud provider of your choice + additional encryption (basic rule I've been happy to see validated: never upload personal files to the cloud without encryption, after the whole Google content scanning debacle).

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#36

Post by MavropaliasG »

handsclean wrote: post #5

The first paragraph very nearly lost me – irrational, rage bait, directly contradicts later stated facts – but there’s some good content later. The chief complaint seems to be that LastPass is not forcing this upgrade, they are just blast emailing unaffected people that they “forced” it while not actually doing so. And they’ve pulled similar stunts in the past, and in current communication seem to clearly be blaming…

Can someone explain to me what is the advantage of using something like LastPass over simply the in-built password manager that Firefox or other browsers have? I know that LastPass can be used for desktop applications too, but if you are only using a password for the web, is LastPass offering anything more than the in-built browser password manager?

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#37

Post by anon_cow1111 »

Is there any reason NOT to set the number of iterations/hashes as high as reasonable by default? From an end-user standpoint, it might take an extra second or two vs 0.1 seconds, but then you've increased the brute force time needed by ten.

The most efficient way to brute force "Horse Gone Barn Bolted" would be with a minimal dictionary attack, say the most common 2000 words, plus s ed *ing variants. you're still looking at 1+ quadrillion combinations for that password, not including spaces.

That can't be that fast assuming a slower hashing algorithm, right? -non crypto person's wild guess

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#38

Post by Izkata »

userbinator wrote: post #28
codetrotter wrote: post #8

Earlier quoted context omitted.

The more early someone was in mining or buying Bitcoin, the greater the possibility that they believe in Bitcoin in and of itself. I.e. to someone who was early into Bitcoin, they might wish to never sell off all of their BTC. And besides, even if you wanted to sell off your Bitcoins, there are a number of things to consider: - Taxes. Why sell millions of USD worth of Bitcoin now, and pay taxes on all of it today? Po…

I wonder how many people heard of Bitcoin very early in its creation, mined a few "just for fun", and then forgot about them or even deleted them when they thought it wouldn't amount to anything.

2009-ish I remember finding an online wallet that would just give you half a bitcoin for making an account. Intended to look into bitcoin some more but just forgot about it until years later when it had gone up like 1000x or more and was just like "aaaghhhh dammit"...

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#39

Post by hn_throwaway_99 »

The whole approach that LastPass uses of only encrypting the vault with the master password is just bad security - it really doesn't matter how many rounds of a key derivation algorithm they use.

The 1Password approach provides much better security. The vault is protected with the master password together with a long randomly generated string. That random string is saved on device on first login, so subsequent decryptions just require the master password. Logging in on new devices require this "account key", but the added security of having a completely uncrackable encrypted vault, regardless of the entropy in the master password, is very much worth it.

Re: LastPass: ‘Horse Gone Barn Bolted’ Is Strong Password

#40

Post by Barrin92 »

MavropaliasG wrote: post #36
handsclean wrote: post #5

The first paragraph very nearly lost me – irrational, rage bait, directly contradicts later stated facts – but there’s some good content later. The chief complaint seems to be that LastPass is not forcing this upgrade, they are just blast emailing unaffected people that they “forced” it while not actually doing so. And they’ve pulled similar stunts in the past, and in current communication seem to clearly be blaming…

Can someone explain to me what is the advantage of using something like LastPass over simply the in-built password manager that Firefox or other browsers have? I know that LastPass can be used for desktop applications too, but if you are only using a password for the web, is LastPass offering anything more than the in-built browser password manager?

credentials/certificates/keys/data storage, secure sharing etc. Pretty much anything that's more complex than single user username + password doesn't seem to be served by the current built-in managers.
Post reply on HN