Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

151–160 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#151
post #144

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

I am fascinated by the idea of being 50 years from now, and doing digital archaeology more or less. So much of our actual output is now digital and stored digitally. Given how I have experienced technology up until this point, my assumption is that everything I will create for work or for pleasure, is more or less ephemeral. It has certainly proven true for work.

I think we (or our descendants) will be surprised by the longevity of some of the file formats in use today. I would wager that it will be possible and not too unusual for regular users to open files in formats like PDF, zip or jpeg 100 years after their inception.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#152
post #39

Earlier quoted context omitted.

It's such a pity that bitwarden's client doesn't work offline for modifying vaults (need to be online to be able to access the server implementation). I would switch from my old local vault 1password in an instant.

I just have KeePass in a syncthing folder with a trigger to sync on open. Technically I think I could drop the trigger if the desktop app would open by making a temporary file copy and syncing back (ironically Keepass2Android is very good at this).

Or KeePassDX for Android.

https://www.keepassdx.com/

https://www.f-droid.org/packages/com.kunzisoft.keepass.libre...

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#153

Earlier quoted context omitted.

Is bitwarden’s only differentiator being open source and self hostable? Im looking at other services and thus far see no reason to leave 1Password.

is that not enough? It's also inexpensive and works very well on all platforms.

Why would I have asked if it were enough?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#155
post #144

Earlier quoted context omitted.

I am fascinated by the idea of being 50 years from now, and doing digital archaeology more or less. So much of our actual output is now digital and stored digitally. Given how I have experienced technology up until this point, my assumption is that everything I will create for work or for pleasure, is more or less ephemeral. It has certainly proven true for work.

I think we (or our descendants) will be surprised by the longevity of some of the file formats in use today. I would wager that it will be possible and not too unusual for regular users to open files in formats like PDF, zip or jpeg 100 years after their inception.

You think we will still have files? I wager in the long term we're going more towards a people focused than paper focused system.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#156
post #127

Earlier quoted context omitted.

What does "You will get your vaults locally" mean? Is it possible to export as a file, take that with you on whatever medium (eg. USB key, CD-ROM, future isolinear chip), put it on a brand new PC you built from scratch and never connected to the internet, and open it in some kind of standalone viewer?

That’s how 1Password used to work. Not sure how much of that is still left in the system these days. Originally it was an app with no remote component. The vault was yours to look after. Most people kept it in Dropbox to make it accessible anywhere. The vault itself actually had an html file in it that you could open in a pinch that was able to decrypt secrets (only for reading, from memory). 1Password as a service c…

Know of any archived copies of this offline-first experience or has it been fully eaten by enshittification?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#157
post #105

Earlier quoted context omitted.

To how many non-SWE members of your family could you say 'here is the Netflix password, you can decrypt it with gpg', and have them be like 'ah yes, let me just `man gpg` this will be no problem'?

i would imagine if a lot of money, like millions, was on the line, people get really resourceful all of a sudden. of course, we're not talking Netflix passwords but usernames and passwords to brokerages, bank accounts, etc.

Often curiosity is motivation enough. Some people go to great lengths just to learn something about their distant ancestors.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#158
post #90

Earlier quoted context omitted.

> Bitwarden truly doesn’t get enough credit for being completely open source It’s their No. 1 selling point. > In 50 years time, who knows if any of these companies will be around 1Password has local clients. If you have the password, you should be able to unlock the vault locally.

Can you walk me through how to do this? I have installed the "1password-cli" package on my airgapped linux machine with no network access ('op --version' gives me 2.30.3). If I run 'op vault list', it tells me I have to add an account. When I run 'op account add' it tries to connect to 1password's servers and won't let me proceed without internet. I don't see how this "local client" is helping if all the auth infrast…

Please try our solution[1]

It's truly local first and will work fine in an airgapped situation.

It's also designed to be self-hostable[2], is open source [3] and the API is well documented[4].

[1] https://saveoursecrets.com/ [2] https://saveoursecrets.com/docs/cli/self-hosting/ [3] https://github.com/saveoursecrets/sdk [4] https://docs.rs/sos-sdk/latest/sos_sdk/

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#159

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

Wouldn't it also make you lose everything in a recovery scenario? If all your computers are lost in a fire or flood, you would lose the recovery key, and having your password would not be enough to recover your database. I use keepassxc with a somewhat long password with a high PBKDF iterations count, which would not require having any devices in the event of a loss.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#160
post #100

Earlier quoted context omitted.

"Hey llm how do I open this file?" It's kinda ludicrous to think we'll lose the ability for something so simple.

Truly, I will miss the days of goggling for tar commands when I can instead ask an llm.

Why use kilobytes of text and a handful of clock cycles when I can use terabytes of weights and thousands of teraflop-days of GPU farms to achieve the same result?
Post reply on HN