Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#121

Post by gblargg »

jongjong wrote: post #107

I've repeated over and over that password manager services are a horrible idea. Trusting a single service with all your passwords is worse than using the same password for all services (of the same sensitivity level) IMO. The ideal solution is to come up with a secret heuristic to come up with different passwords for different services. I kept getting downvoted for this. Well, IMO, these people deserved to be hacked.…

What if you used a password service, but modified the password it puts in manually (and didn't let it update when you log in)? Would an attacker try variations, or just move on when your password manager-provided login doesn't work?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#122

Post by 9x39 »

HeatrayEnjoyer wrote: post #115
pigbearpig wrote: post #96

Earlier quoted context omitted.

You have to provide the secret key to each device on initial setup. After that, you just need your password.

What if you're in a foreign location and your devices are all stolen or lost?

You'd have to contact someone to get the secret key from your 1Pass emergency kit, wherever you stored it. That is, unless you can memorize long strings of numbers really well.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#123

Post by rkagerer »

mercurial wrote: post #106
TheDong wrote: post #90

Earlier quoted context omitted.

Can you walk me through how to do this? I have installed the "1password-cli" package on my airgapped linux machine with no network access ('op --version' gives me 2.30.3). If I run 'op vault list', it tells me I have to add an account. When I run 'op account add' it tries to connect to 1password's servers and won't let me proceed without internet. I don't see how this "local client" is helping if all the auth infrast…

You need to authenticate once. You will get your vaults locally and you will be able to access them without an internet connection

What does "You will get your vaults locally" mean?

Is it possible to export as a file, take that with you on whatever medium (eg. USB key, CD-ROM, future isolinear chip), put it on a brand new PC you built from scratch and never connected to the internet, and open it in some kind of standalone viewer?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#124

Post by npoc »

tpurves wrote: post #23
anonym29 wrote: post #16

Earlier quoted context omitted.

Bitcoin has never been hacked. The victims did not practice proper key management. The victims got hacked because of their own insecure key management, not because of any vulnerability in Bitcoin. To claim otherwise is like claiming that because people can steal improperly secured code signing or TLS certificate private keys, all code signing and TLS certificates are inherently, fundamentally, and automatically broke…

You know what every other online money transfer mechanism has? An ability to reverse transactions in the case or error or fraud. Because those things happen all of the time.

That kind of reversible payment rail can be implemented on top of a base layer like Bitcoin. Like the current banking system, with it's underlying final clearance network between banks.

Worldwide final clearance is a feature not a bug.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#125

Post by 9x39 »

725686 wrote: post #49
naet wrote: post #48

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one. It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home off…

I use a simple algorithm. So you don't actually remember the password, put the algorithm to produce the password for the site or service. Not perfect, but each passwords turns out to be unique (mostly). I don't know what experts think about that, but it has worked fine for me.

But where do you store emergency codes? Or secret metadata for things? I think these are common artifacts to accumulate.

A password manager is ideal for these when security is far more than passwords at this point.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#126

Post by 9x39 »

jongjong wrote: post #107

I've repeated over and over that password manager services are a horrible idea. Trusting a single service with all your passwords is worse than using the same password for all services (of the same sensitivity level) IMO. The ideal solution is to come up with a secret heuristic to come up with different passwords for different services. I kept getting downvoted for this. Well, IMO, these people deserved to be hacked.…

>The ideal solution is to come up with a secret heuristic to come up with different passwords for different services.

How long does it take you to enter several keys of 16+ length for a few sites you might to access? A password manager can autofill, retrieve and input keys, provide an OTP in a few seconds.

Where would you store your emergency codes and other secret-like artifacts?

It just seems impractical for a person, let alone edge cases like sharing, or usability concerns like working with secrets frequently throughout the day.

>I've never been hacked, never been locked out of any accounts.

Due to the strength of your system, general digital hygiene, or simple odds? If we're getting really contrived, how do you maintain confidence your heuristic can't be guessed from X plaintexts obtained from breached sites (highly common)? That's kind of like rolling your crypto, isn't it? -- doing it correctly is beyond almost all of us.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#127

Post by aidos »

rkagerer wrote: post #123
mercurial wrote: post #106

Earlier quoted context omitted.

You need to authenticate once. You will get your vaults locally and you will be able to access them without an internet connection

What does "You will get your vaults locally" mean? Is it possible to export as a file, take that with you on whatever medium (eg. USB key, CD-ROM, future isolinear chip), put it on a brand new PC you built from scratch and never connected to the internet, and open it in some kind of standalone viewer?

That’s how 1Password used to work. Not sure how much of that is still left in the system these days.

Originally it was an app with no remote component. The vault was yours to look after. Most people kept it in Dropbox to make it accessible anywhere. The vault itself actually had an html file in it that you could open in a pinch that was able to decrypt secrets (only for reading, from memory).

1Password as a service came later.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#128

Post by 9x39 »

rkagerer wrote: post #123
mercurial wrote: post #106

Earlier quoted context omitted.

You need to authenticate once. You will get your vaults locally and you will be able to access them without an internet connection

What does "You will get your vaults locally" mean? Is it possible to export as a file, take that with you on whatever medium (eg. USB key, CD-ROM, future isolinear chip), put it on a brand new PC you built from scratch and never connected to the internet, and open it in some kind of standalone viewer?

After auth, it downloads a copy of your vaults to your device from their servers.

Super contrived, but you could probably just copy the sqlite dbs of your vault it creates locally to another PC along with the 1Password installer and it might let you sign in with just your master key.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#130

Post by chinathrow »

blackeyeblitzar wrote: post #28
chinathrow wrote: post #2

Me, looking at my local KeepassXC, calm, sticking with it.

How do you sync it between devices like your phone? What about family sharing or access for emergencies or other such features?

Actually I don't use it on my phone, at all. Another thing to care less about.
Post reply on HN