Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#81

Post by tharkun__ »

jwr wrote: post #76
serf wrote: post #30

Earlier quoted context omitted.

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

> I am pretty sure 99% of people would halt at 'gpg' Please do not mock gpg. I have been using gpg for 25 years now (and PGP before that). It works. It encrypts. It decrypts. It is in vogue to mock gpg on HN and recommend more modern solutions. As an experiment, I tried adding one of those modern tools (rage) to my ansible configurations, just so that they get regularly installed and maintained on my servers (without…

Not their point tho. Me too, gpg, no problem. Heck I had the "'smuggled' out of the country as a book" pgp back when.

My kids? I really am not so sure at all. Still too early to tell for sure but so far I don't think any will be as technically savvy as I am. I really doubt they'd know what GPG (or PGP) are and how to use it.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#82

Post by harikb »

JumpCrisscross wrote: post #75
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

> Bitwarden truly doesn’t get enough credit for being completely open source It’s their No. 1 selling point. > In 50 years time, who knows if any of these companies will be around 1Password has local clients. If you have the password, you should be able to unlock the vault locally.

“1Password anywhere” (single html file password manager) stopped working a while ago. May be 6 years back. Sure you can install a new client and use a stored folder - but compatibility lasting to your grandchildren’s time / 50 year etc - highly unlikely

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#83

Post by ptk »

noduerme wrote: post #61
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

I still rely on a gpg encrypted text file for storing my passwords, too. 25 years of that and it's second nature. No other solution has ever appealed to me.

I’m autofilling usernames and passwords from 1Password’s browser extension probably 100+ times per workday. Are you manually copying and pasting anywhere near that amount? I think I would be miserable with that setup for anything beyond very light use.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#84

Post by harikb »

serf wrote: post #30
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

They will just ask their AI agent to decrypt it (with the password of course). No need of ability to run gpg.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#85

Post by MyOutfitIsVague »

panick21_ wrote: post #74
TingPing wrote: post #65

Earlier quoted context omitted.

2FA has nothing to do with the encryption, if that data is leaked.

My understanding is some of the key strength was to low. If 2FA increases the key strength, that should have an impact no?

2FA does not increase the key strength. The key is solely derived from the password. 2FA limits access to somebody who already has the password to get in. The LastPass leak was of a backup, though, for which 2FA does nothing.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#86

Post by 3np »

FiloSottile wrote: post #13

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

That's table stakes today. LastPass was not up to standards.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#87

Post by wraptile »

serf wrote: post #30
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

"Hey llm how do I open this file?"

It's kinda ludicrous to think we'll lose the ability for something so simple.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#88

Post by JackMorgan »

mmwelt wrote: post #45
blackeyeblitzar wrote: post #28

Earlier quoted context omitted.

How do you sync it between devices like your phone? What about family sharing or access for emergencies or other such features?

SyncThing[1] works very well for syncing with Android devices, but IIRC doesn't work with iOS. [1] https://syncthing.net/

I managed to get syncthing working on iOS. It's definitely possible

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#89

Post by nonoesp »

Sharing a short post I posted a year ago with some thoughts on password managers.

## The password-management promise

> I don't buy the promise behind 1Password or LastPass.

> You only need to remember one password. The last password you'd need to remember.

> They don't tell you that you're also building a one-stop shop for hackers to steal it all at once.

> The solution?

> Store hints, not passwords.

> Don't reuse passwords. Use algorithmic passwords instead.

> Use passkeys and security keys.

https://sketch.nono.ma/the-password-management-promise

---

I've always preferred 1Password and Bitwarden to LastPass.

I still prefer to encrypt sensitive data and "secure notes" with custom workflows (GPG keys, for instance) instead of relying on third parties, and even more when the data would be store in the cloud, in a centralized location.

I can't imagine the nightmare of having all your secrets exposed, not just for the risk of it but for having to reset all your exposed accounts.

(+1 to GPG encryption.)

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#90

Post by TheDong »

JumpCrisscross wrote: post #75
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

> Bitwarden truly doesn’t get enough credit for being completely open source It’s their No. 1 selling point. > In 50 years time, who knows if any of these companies will be around 1Password has local clients. If you have the password, you should be able to unlock the vault locally.

Can you walk me through how to do this?

I have installed the "1password-cli" package on my airgapped linux machine with no network access ('op --version' gives me 2.30.3).

If I run 'op vault list', it tells me I have to add an account. When I run 'op account add' it tries to connect to 1password's servers and won't let me proceed without internet.

I don't see how this "local client" is helping if all the auth infrastructure goes through their servers.

Post reply on HN