Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

191–200 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#191

Post by infinitezest »

nicolas_t wrote: post #36
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

It's such a pity that bitwarden's client doesn't work offline for modifying vaults (need to be online to be able to access the server implementation). I would switch from my old local vault 1password in an instant.

This is literally the only thing that's holding me back from switching as well.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#192

Post by serkanh »

taikahessu wrote: post #161

Lastpass downplayed the breach and turned out they had not properly encrypted the data like notes section. They should have been sued to oblivion, but they were able weasel out of responsibility, so far. Lastpass had one job and failed it. Unforgivable that they knew their users' master passwords are not secure enough, but chose not to be vocal or proactive about it. If you're using Lastpass right now, move to more t…

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#193

Post by klabb3 »

ehnto wrote: post #144
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

I am fascinated by the idea of being 50 years from now, and doing digital archaeology more or less. So much of our actual output is now digital and stored digitally. Given how I have experienced technology up until this point, my assumption is that everything I will create for work or for pleasure, is more or less ephemeral. It has certainly proven true for work.

I suspect you won’t be allowed to do archeology, because the company that bought the rights to it won’t let you. If we continue the path we’re on basically nothing will be owned by us or kept safe by us. Just look at the difference from the PC era to the smartphone era. It’s all cloud based now.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#194

Post by aryonoco »

TeMPOraL wrote: post #164
matwood wrote: post #112

Earlier quoted context omitted.

1P family sharing and 1P cli also work well. I check BW every so often but it always feels less polished UI wise. For all the complaints people had about 1P moving to electron, it’s UX is still the best out there.

> family sharing Why would someone make a feature like this? I'm confused why some companies (including Amazon and Steam) insist on family features. The mental model behind this is more prescriptive than descriptive - it doesn't match to how users and their families function; rather, it insists on some activities to a) exist in family, and b) be not allowed outside of family. Or simply: how many people have actual fa…

I don’t have amazon or steam so don’t know how any of that works. But for a password manager, family sharing is extremely useful.

Bitwarden doesn’t have families per se, it’s got “organisations”. You can setup unlimited number of organisations and users can get invited and join them. Which is very handy for example my wife and I can login and order our groceries from the supermarket using the same account. Or that we can both login and use our electricity company’s web portal which only allows one account per household. All without needing to send each other passwords and updated passwords back and forth.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#195

Post by commandersaki »

namaria wrote: post #189
commandersaki wrote: post #172

Earlier quoted context omitted.

How is any of this a threat to 1Password E2EE? The point is if they even have access to my encrypted data, they wouldn't be able to access the plaintext without the key (and yes the passphrase is not sufficient). This is just lazy scaremongering.

The point you're trying to make is a trivial one: in the absence of errors, there are no problems. LastPass e2ee was never the problem in the original story either.

You are wrong, the article posted said the heists happened because of both a breach and cracking master passwords. LastPass E2EE relied on keys from the master password using a password hash that had a low iteration count. Therefore low entropy passphrases could easily be cracked. Furthermore not all data was encrypted. This is all a weakness of their E2EE. 1Password uses both PAKE for remote authentication and a high entropy key (128-bit) and therefore doesn't solely rely on a master password. There is an actual difference.

Of those links you posted, two of them could've equally affected a password manager that was local. All password managers can be subverted by external threats whether using cloud storage or not.

My point is, properly implemented E2EE (hopefully vetted by cryptographers) is marginally different to a password manager using local storage. Sure having it cloud hosted can affect more than one user, but attacking the ciphertext data would be infeasible.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#196

Post by fc417fc802 »

darkwater wrote: post #141
OJFord wrote: post #105

Earlier quoted context omitted.

To how many non-SWE members of your family could you say 'here is the Netflix password, you can decrypt it with gpg', and have them be like 'ah yes, let me just `man gpg` this will be no problem'?

They can just ask the super AGI that will exist to tell them how to do. Heck, even current LLMs can tell you how to do it step by step.

Cynically, it's far more likely they will upload the gpg blob to said agent, provide it with the password via the conversation box, and ask it to directly provide the specific information that they're after.

The AI model will be of certified provenance and run on attested hardware [0] so this won't be as much of a security issue as you might expect. Naturally the various three letter agencies will have full hardware access including query history.

Periodically, hardware zero days will drop and all hell will break loose.

Alright that's enough speculative dystopian fiction for me for today.

[0] https://news.ycombinator.com/item?id=42454139

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#197

Post by choo-t »

alwayslikethis wrote: post #159
FiloSottile wrote: post #13

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

Wouldn't it also make you lose everything in a recovery scenario? If all your computers are lost in a fire or flood, you would lose the recovery key, and having your password would not be enough to recover your database. I use keepassxc with a somewhat long password with a high PBKDF iterations count, which would not require having any devices in the event of a loss.

Having one of your backups out of site will prevent its loss during a fire/flood scenario.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#198

Post by bognition »

serkanh wrote: post #192
taikahessu wrote: post #161

Lastpass downplayed the breach and turned out they had not properly encrypted the data like notes section. They should have been sued to oblivion, but they were able weasel out of responsibility, so far. Lastpass had one job and failed it. Unforgivable that they knew their users' master passwords are not secure enough, but chose not to be vocal or proactive about it. If you're using Lastpass right now, move to more t…

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

Yes it’s annoying but it also means increased revenue which enables them to invest more in the product.

The new features released since I bought version 6 has me more than satisfied.

Also using a password manager is one of the most effective things you can do to protect yourself and paying a few bucks a month seems like a steal.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#199

Post by rmellow »

serkanh wrote: post #192
taikahessu wrote: post #161

Lastpass downplayed the breach and turned out they had not properly encrypted the data like notes section. They should have been sued to oblivion, but they were able weasel out of responsibility, so far. Lastpass had one job and failed it. Unforgivable that they knew their users' master passwords are not secure enough, but chose not to be vocal or proactive about it. If you're using Lastpass right now, move to more t…

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

Yes, they felt very pushy with this & other tactics to get me to use new features.

That creates distrust in me, so I swapped to BitWarden and haven't looked back.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#200

Post by jorvi »

serkanh wrote: post #192
taikahessu wrote: post #161

Lastpass downplayed the breach and turned out they had not properly encrypted the data like notes section. They should have been sued to oblivion, but they were able weasel out of responsibility, so far. Lastpass had one job and failed it. Unforgivable that they knew their users' master passwords are not secure enough, but chose not to be vocal or proactive about it. If you're using Lastpass right now, move to more t…

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

With the way the Apple is going in the UK, I'd rather give 1Password the keys to the kingdom.

Their whole raison d'etre is protecting your passwords. If they start selling people out, their business implodes.

They also keep adding thoughtful tweaks and new features. A couple years back I thought I'd give it a few years and then hop from 1Password to Bitwarden. But Bitwarden's UI and UX is still subpar (doesn't even support drag 'n drop..)*. All Bitwarden does is invest in enterprise features, which mean jack for the average user.

*dragging items from one vault to another, not a hugely important feature but Bitwarden has a thousand of these kind of paper cuts compared to 1Password

Post reply on HN