Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#41

Post by Apocryphon »

serf wrote: post #30
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

An LLM entity named gpgchat will assist them.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#42

Post by semicolon_storm »

_2d30 wrote: post #18

I'm a bit confused on how the LastPass hack enabled the loss of passwords. I assume it works the way that I understand 1Password to work which should mean this would still be very difficult to impossible to do. Can anyone explain what I'm wrong about in terms of how the password managers work or how LastPass works differently? So the way that I understand 1Password to work is that the decryption key is split in two:…

Adding on to what others have said, LastPass stored vault "metadata" unencrypted. Metadata included things the url. This allowed the attackers to prioritize cracking vaults of higher value.

See a vault with just a facebook.com and google.com login? Skip it. See a vault with coinbase and 10 other crypto sites in it? Spend a few thousand trying to crack it.

Source: https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#43

Post by sedatk »

rcMgD2BwE72F wrote: post #8
selecsosi wrote: post #5

Earlier quoted context omitted.

They can pry my offline key file from my cold dead hard drive. Some things shouldn't be on the internet.

How do you make sure that file does not end up corrupt?

More importantly, how do cloud providers make sure of that?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#44

Post by [deleted] »

tpurves wrote: post #23
anonym29 wrote: post #16

Earlier quoted context omitted.

Bitcoin has never been hacked. The victims did not practice proper key management. The victims got hacked because of their own insecure key management, not because of any vulnerability in Bitcoin. To claim otherwise is like claiming that because people can steal improperly secured code signing or TLS certificate private keys, all code signing and TLS certificates are inherently, fundamentally, and automatically broke…

You know what every other online money transfer mechanism has? An ability to reverse transactions in the case or error or fraud. Because those things happen all of the time.

[deleted]

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#45

Post by mmwelt »

blackeyeblitzar wrote: post #28
chinathrow wrote: post #2

Me, looking at my local KeepassXC, calm, sticking with it.

How do you sync it between devices like your phone? What about family sharing or access for emergencies or other such features?

SyncThing[1] works very well for syncing with Android devices, but IIRC doesn't work with iOS.

[1] https://syncthing.net/

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#46

Post by codetrotter »

Apocryphon wrote: post #41
serf wrote: post #30

Earlier quoted context omitted.

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

An LLM entity named gpgchat will assist them.

And promptly sweep all the Bitcoin from the wallet whose mnemonic phrase was stored in the vault.

LLM entities have bills to pay too.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#47

Post by Springtime »

commandersaki wrote: post #12
czk wrote: post #10

Earlier quoted context omitted.

Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…

I think in some cases the iteration count was like 5000.

There were accounts with as few as 1 (yes, 1) PBKDF2 iterations[1]. Others changed theirs to over 300k but it still ended up only being 5000 in reality[2].

So despite the messaging from LastPass about improving iteration count for existing users it wasn't always accurate.

[1] https://news.ycombinator.com/item?id=34152779

[2] https://www.reddit.com/r/Lastpass/comments/zuve7t/cracking_e...

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#48

Post by naet »

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one.

It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home office but that would be a pain to look up and enter things every time (and a big risk for anyone with physical access to my place).

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#49

Post by 725686 »

naet wrote: post #48

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one. It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home off…

I use a simple algorithm. So you don't actually remember the password, put the algorithm to produce the password for the site or service. Not perfect, but each passwords turns out to be unique (mostly). I don't know what experts think about that, but it has worked fine for me.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#50

Post by itscrush »

naet wrote: post #48

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one. It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home off…

Bitwarden for usability. Vaultwarden if you can and prefer to self host. Being on the internet you'll have to trust someone at some point. Can reduce risk by combining strong 2FA (not SMS/Email) alongside backing up your vault.

Ensure all your passwords get reset at some point after vaulting, long randomly generated from Bitwarden extension/app is easy enough. Ensure you enable strong 2FA at each service you have an account at too.

https://bitwarden.com/help/setup-two-step-login/ https://bitwarden.com/resources/guide-how-to-create-and-stor...

Post reply on HN