Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#71

Post by haswell »

behringer wrote: post #68
notesinthefield wrote: post #63

Earlier quoted context omitted.

Is bitwarden’s only differentiator being open source and self hostable? Im looking at other services and thus far see no reason to leave 1Password.

is that not enough? It's also inexpensive and works very well on all platforms.

Not OP, but UX also matters a lot.

I’d strongly prefer an open source and selfhostable option, but each time I’ve evaluated Bitwarden in the past, it was a big enough downgrade from 1Password that I didn’t think switching was a good option.

If the experience ever becomes as seamless, I’ll be switching.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#72

Post by n8m8 »

behringer wrote: post #68
notesinthefield wrote: post #63

Earlier quoted context omitted.

Is bitwarden’s only differentiator being open source and self hostable? Im looking at other services and thus far see no reason to leave 1Password.

is that not enough? It's also inexpensive and works very well on all platforms.

Their comment made me laugh, agreed, open source is really is that big of a perk. IMO especially for something security-related (though 0day is always possible)

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#73

Post by MyOutfitIsVague »

notesinthefield wrote: post #63
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

Is bitwarden’s only differentiator being open source and self hostable? Im looking at other services and thus far see no reason to leave 1Password.

That, and it's better in most functional and polish regards than LastPass. I haven't used 1Password, so I can't compare those two directly, but I'd strongly recommend BitWarden over LastPass as far as those two are considered.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#74

Post by panick21_ »

TingPing wrote: post #65
panick21_ wrote: post #52

Earlier quoted context omitted.

What if in lastpass you have 2FA?

2FA has nothing to do with the encryption, if that data is leaked.

My understanding is some of the key strength was to low. If 2FA increases the key strength, that should have an impact no?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#75

Post by JumpCrisscross »

aryonoco wrote: post #26
FiloSottile wrote: post #13

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

> Bitwarden truly doesn’t get enough credit for being completely open source

It’s their No. 1 selling point.

> In 50 years time, who knows if any of these companies will be around

1Password has local clients. If you have the password, you should be able to unlock the vault locally.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#76

Post by jwr »

serf wrote: post #30
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

> I am pretty sure 99% of people would halt at 'gpg'

Please do not mock gpg.

I have been using gpg for 25 years now (and PGP before that). It works. It encrypts. It decrypts.

It is in vogue to mock gpg on HN and recommend more modern solutions. As an experiment, I tried adding one of those modern tools (rage) to my ansible configurations, just so that they get regularly installed and maintained on my servers (without actually being used). The setup broke within less a year.

Are the modern tools more cryptographically secure? Undoubtedly. Does it matter in practice for me? Not at all.

Longevity is a big deal and is under-appreciated.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#77

Post by n8m8 »

sciens3_ wrote: post #69

Centralizing everyone’s credentials after all these years still seems like the most risky idea ever. The only thing possibly more attractive to a hacker would be free sex and drugs, but only for a little while, and then they’d go back to trying to steal everyone’s credentials. Some other targets: everyone’s PII, info on friends, family, pets, answers to security questions, mobile IDs, PIN numbers, account numbers, si…

I have similar gripes, but I still feel like on balance, randomizing passwords across accounts is more important. Selfhost vaultwarden ftw (or not — don’t f*ck it up)

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#78

Post by sciens3_ »

n8m8 wrote: post #77
sciens3_ wrote: post #69

Centralizing everyone’s credentials after all these years still seems like the most risky idea ever. The only thing possibly more attractive to a hacker would be free sex and drugs, but only for a little while, and then they’d go back to trying to steal everyone’s credentials. Some other targets: everyone’s PII, info on friends, family, pets, answers to security questions, mobile IDs, PIN numbers, account numbers, si…

I have similar gripes, but I still feel like on balance, randomizing passwords across accounts is more important. Selfhost vaultwarden ftw (or not — don’t f*ck it up)

> Selfhost vaultwarden ftw (or not — don’t f*ck it up)

Right. Randomizing passwords doesn’t require centralization.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#79

Post by n8m8 »

joshstrange wrote: post #59
725686 wrote: post #49

Earlier quoted context omitted.

I use a simple algorithm. So you don't actually remember the password, put the algorithm to produce the password for the site or service. Not perfect, but each passwords turns out to be unique (mostly). I don't know what experts think about that, but it has worked fine for me.

The problems with this method are numerous: * If 1 to N password(s) leak the pattern may be obvious leading to your other accounts being compromised * Not all sites have the same password “rules” so there is no algorithm that works for all passwords without you being aware of the rules of the given site. Rules that only you only (may) have access to at signup time. * Typing passwords out manually sucks (slow and erro…

I agree that especially with modern LLMs, I would avoid following patterns like this.

Dedicated 2FA on a hardware device seems pretty resilient, I hope more banks incorporate it instead of SMS 2FA. Hosting vaultwarden also seems pretty good because it’s unlikely for you to be targeted, but requires selfhost maintenance.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#80

Post by nixgeek »

jwr wrote: post #76
serf wrote: post #30

Earlier quoted context omitted.

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

> I am pretty sure 99% of people would halt at 'gpg' Please do not mock gpg. I have been using gpg for 25 years now (and PGP before that). It works. It encrypts. It decrypts. It is in vogue to mock gpg on HN and recommend more modern solutions. As an experiment, I tried adding one of those modern tools (rage) to my ansible configurations, just so that they get regularly installed and maintained on my servers (without…

It’s not mockery though? It’s certainly true 99% of even the technically literate don’t use GnuPG (many because, like me, they cannot stand the GnuPG user experience).

Filippo nailed it with this piece: https://words.filippo.io/giving-up-on-long-term-pgp/

Post reply on HN