Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

171–180 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#171

Post by whstl »

fauigerzigerk wrote: post #151
ehnto wrote: post #144

Earlier quoted context omitted.

I am fascinated by the idea of being 50 years from now, and doing digital archaeology more or less. So much of our actual output is now digital and stored digitally. Given how I have experienced technology up until this point, my assumption is that everything I will create for work or for pleasure, is more or less ephemeral. It has certainly proven true for work.

I think we (or our descendants) will be surprised by the longevity of some of the file formats in use today. I would wager that it will be possible and not too unusual for regular users to open files in formats like PDF, zip or jpeg 100 years after their inception.

I've recently had to open some installer files from the mid-90s that were in a proprietary format (I forgot the name... Inno? InstallShield?) and was surprised to see that the current go-to solution is open source.

As long as an open source (or at least open specification) exist, these files will remain being openable. ...or at least until curious minds are able to crack them!

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#172

Post by commandersaki »

namaria wrote: post #168
commandersaki wrote: post #166

Earlier quoted context omitted.

If you do e2ee correctly this is a non-issue. See 1Password for one way to do to it right.

https://www.bleepingcomputer.com/news/security/1password-dis... https://www.forbes.com/sites/daveywinder/2023/12/11/android-... https://www.zdnet.com/article/hackers-stole-this-engineers-1...

How is any of this a threat to 1Password E2EE?

The point is if they even have access to my encrypted data, they wouldn't be able to access the plaintext without the key (and yes the passphrase is not sufficient).

This is just lazy scaremongering.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#173

Post by iav »

alwayslikethis wrote: post #159
FiloSottile wrote: post #13

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

Wouldn't it also make you lose everything in a recovery scenario? If all your computers are lost in a fire or flood, you would lose the recovery key, and having your password would not be enough to recover your database. I use keepassxc with a somewhat long password with a high PBKDF iterations count, which would not require having any devices in the event of a loss.

Except for crypto, losing your passwords is annoying but not irreversible

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#174

Post by juped »

MartijnHols wrote: post #148
shaky-carrousel wrote: post #137

Earlier quoted context omitted.

How can I self host proton pass? I'm searching for the server source code and I can't find it. Should be available if it's completely open source.

Don't think you can self-host it, but that would also pretty much defeat the user-friendly aspect. You don't need the server source if the vault is client-side encrypted, besides you would get zero guarantees that what they show and what they're actually running are the same thing.

Well, Bitwarden is actually completely open source. So I can use the server code. It's pretty great!

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#175

Post by mock-possum »

taikahessu wrote: post #161

Lastpass downplayed the breach and turned out they had not properly encrypted the data like notes section. They should have been sued to oblivion, but they were able weasel out of responsibility, so far. Lastpass had one job and failed it. Unforgivable that they knew their users' master passwords are not secure enough, but chose not to be vocal or proactive about it. If you're using Lastpass right now, move to more t…

I swapped to BitWarden a few years back and there was almost no friction - export from LastPass, import to BitWarden, get used to the inevitable handful of UI quirks, and you’re good to go.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#176

Post by aryonoco »

tmpfs wrote: post #158
TheDong wrote: post #90

Earlier quoted context omitted.

Can you walk me through how to do this? I have installed the "1password-cli" package on my airgapped linux machine with no network access ('op --version' gives me 2.30.3). If I run 'op vault list', it tells me I have to add an account. When I run 'op account add' it tries to connect to 1password's servers and won't let me proceed without internet. I don't see how this "local client" is helping if all the auth infrast…

Please try our solution[1] It's truly local first and will work fine in an airgapped situation. It's also designed to be self-hostable[2], is open source [3] and the API is well documented[4]. [1] https://saveoursecrets.com/ [2] https://saveoursecrets.com/docs/cli/self-hosting/ [3] https://github.com/saveoursecrets/sdk [4] https://docs.rs/sos-sdk/latest/sos_sdk/

The likelihood that someone would be able to do this in 50 years time, without your company still around? Close to zero.

Passwords, even ssh keys and passkeys, are little pieces of plain text. If you think needing a specialised sdk or cli to retrieve plain text is a good software architecture, I think we see the world quite differently.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#177

Post by panick21_ »

MyOutfitIsVague wrote: post #85
panick21_ wrote: post #74

Earlier quoted context omitted.

My understanding is some of the key strength was to low. If 2FA increases the key strength, that should have an impact no?

2FA does not increase the key strength. The key is solely derived from the password. 2FA limits access to somebody who already has the password to get in. The LastPass leak was of a backup, though, for which 2FA does nothing.

I see, that's unfortunate.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#178

Post by TeMPOraL »

TheDong wrote: post #94
makeitdouble wrote: post #54

Earlier quoted context omitted.

This is the kind of control that is really becoming a luxury. And I don't know how we get back to a simple state; Let's say you're a family of three with shared services and accounts: Keeping everything under Keepass means handling the file sync between all the devices and OSes, with potentially your credentials flying through third party sync services, thus negating most of the advantages of Keepass. Moving to somet…

It shouldn't be a luxury, but it unfortunately is due to various big players refusing to play nice together. If everyone has only apple devices (iphones + macbooks), then you can use a shared iCloud sync'd folder. Except that doesn't actually work because the majority of iOS apps are incapable of using a shared iCloud folder correctly (including apple's notes app, most of apple's apps) because apple tries to hide the…

FWIW, Apple has had at least two partners in crime here - both Google and Microsoft had, and still are, trying to kill the filesystem in this way, too.

The trio mostly succeeded, which is a big part of why modern computing sucks so badly, and is more confusing for non-tech people than what came before, rather than less.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#179

Post by TeMPOraL »

soraminazuki wrote: post #146
HeatrayEnjoyer wrote: post #115

Earlier quoted context omitted.

What if you're in a foreign location and your devices are all stolen or lost?

Then you have a much bigger and immediate problem at hand.

Not really. The biggest, most immediate and most threatening problem in this scenario, is inability to access your passwords, and therefore inability to use banking and means of electronics communication.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#180

Post by aryonoco »

JumpCrisscross wrote: post #75
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

> Bitwarden truly doesn’t get enough credit for being completely open source It’s their No. 1 selling point. > In 50 years time, who knows if any of these companies will be around 1Password has local clients. If you have the password, you should be able to unlock the vault locally.

Since I’m talking about reliable long term archival of critical encrypted data here, let me again ask: in your opinion, what is the likelihood that in 50 years time, with 1Password long gone, my grand children would be able to run that local 1Password client and successfully decrypt the data?

Because I feel pretty confident that gpg will still be around (though hopefully long deprecated), that gzipped files would still be able to be opened, and everyone would still be able to open a csv file. Without any specialised software, sdk or whatnot.

If this scenario doesn’t concern you, that’s fine, 20 years ago it wouldn’t have been my concern either. But the older I’ve become, the more I think about this stuff.

Post reply on HN