Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#61

Post by noduerme »

aryonoco wrote: post #26
FiloSottile wrote: post #13

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

I still rely on a gpg encrypted text file for storing my passwords, too. 25 years of that and it's second nature. No other solution has ever appealed to me.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#62

Post by briHass »

naet wrote: post #48

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one. It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home off…

Passkeys tied to actual hardware, like the TPM-based solution in Windows Hello, whenever possible, Keepass where not.

Keepass DB cloud synced, but the passkey file I use in conjunction with a p/w to open it never leaves the machine(s) it's on. Also, key file needs Admin rights to read, so KP is run privileged, which also protects its process memory space from user-land snooping.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#63

Post by notesinthefield »

aryonoco wrote: post #26
FiloSottile wrote: post #13

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

Is bitwarden’s only differentiator being open source and self hostable? Im looking at other services and thus far see no reason to leave 1Password.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#64

Post by selecsosi »

aspbee555 wrote: post #19
rcMgD2BwE72F wrote: post #8

Earlier quoted context omitted.

How do you make sure that file does not end up corrupt?

copies and replication I have used Keepass since before lastpass existed and sync with multiple machines/locations via syncthing (originally synced with rsync)

This. I have enough devices under frequent use of the keyfile that the chance of each of them beings corrupt is extremely unlikely (n>=3 at any given time).

That being said, not an approach useful for all and a good mental model and sharing system with redundant copies on flash media / live systems/ mobile devices can be an effective strategy.

Use case: 10+ year keepass user, never lost a credential or had one compromised that affected more than one account due to breach. Thank you Keepass devs!

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#65

Post by TingPing »

panick21_ wrote: post #52
dathery wrote: post #29

Earlier quoted context omitted.

It would probably be more accurate to say that LastPass has the information to decrypt your vault if they can guess your password. By contrast 1Password would need to both guess your password and guess your personal secret key. The latter is effectively impossible assuming the key generation was well-implemented. The trade-off is that users must keep track of their own secret keys.

What if in lastpass you have 2FA?

2FA has nothing to do with the encryption, if that data is leaked.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#66

Post by maeil »

joshstrange wrote: post #59
725686 wrote: post #49

Earlier quoted context omitted.

I use a simple algorithm. So you don't actually remember the password, put the algorithm to produce the password for the site or service. Not perfect, but each passwords turns out to be unique (mostly). I don't know what experts think about that, but it has worked fine for me.

The problems with this method are numerous: * If 1 to N password(s) leak the pattern may be obvious leading to your other accounts being compromised * Not all sites have the same password “rules” so there is no algorithm that works for all passwords without you being aware of the rules of the given site. Rules that only you only (may) have access to at signup time. * Typing passwords out manually sucks (slow and erro…

Numerous is greatly overstated.

1) only matters if you're a very high value target who is being manually target. Doesn't apply to 99.999% of people, who only need to worry about credential stuffing and brute force.

2) Similarly, it's not hard to come up with an algorithm that satisfies 99.9% of websites.

3) To a lot of people, managing a password manager sucks.

I personally do use a password manager and automatically generated passwords, but also understand that for many people it's the better option.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#67

Post by sanswork »

anonym29 wrote: post #16
BSOhealth wrote: post #6

“Bitcoin has never been hacked” Don’t have to hack crypto to steal all the crypto.

Bitcoin has never been hacked. The victims did not practice proper key management. The victims got hacked because of their own insecure key management, not because of any vulnerability in Bitcoin. To claim otherwise is like claiming that because people can steal improperly secured code signing or TLS certificate private keys, all code signing and TLS certificates are inherently, fundamentally, and automatically broke…

Not true.

"On August 15, 2010, an anonymous hacker exploited a critical vulnerability in Bitcoin, allowing them to generate 184.467 billion Bitcoin."

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#68

Post by behringer »

notesinthefield wrote: post #63
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

Is bitwarden’s only differentiator being open source and self hostable? Im looking at other services and thus far see no reason to leave 1Password.

is that not enough? It's also inexpensive and works very well on all platforms.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#69

Post by sciens3_ »

Centralizing everyone’s credentials after all these years still seems like the most risky idea ever. The only thing possibly more attractive to a hacker would be free sex and drugs, but only for a little while, and then they’d go back to trying to steal everyone’s credentials.

Some other targets: everyone’s PII, info on friends, family, pets, answers to security questions, mobile IDs, PIN numbers, account numbers, signatures, photos, fingerprints, voice patterns, facial and retinal scans, gaits, DNA, mitochondrial RNA.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#70

Post by allset_ »

koolba wrote: post #32
CaffeineLD50 wrote: post #24

LastPass understandably finds there to be no evidence linking the two. Uhm, OK. But what's also hard to believe is that people storing millions of dollars of "collectables" would not change their passwords on at least a yearly basis. I know that password rotation for its own sake is no longer best practice, but in this case it still seems quite prudent. No?

You can’t change the seed phrase for a derived wallet. You’d have to create a new one and transfer the assets.

Which you should absolutely do when the company storing your seed phrase gets hacked.
Post reply on HN