Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

201–210 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#201

Post by jonpurdy »

serkanh wrote: post #192
taikahessu wrote: post #161

Lastpass downplayed the breach and turned out they had not properly encrypted the data like notes section. They should have been sued to oblivion, but they were able weasel out of responsibility, so far. Lastpass had one job and failed it. Unforgivable that they knew their users' master passwords are not secure enough, but chose not to be vocal or proactive about it. If you're using Lastpass right now, move to more t…

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

Highly recommend Strongbox. The underlying DBs are KeePass DBs and can be stored anywhere as well as opened with any KeePass client, with a UI even better than 1Password (you can have columns for every field) as well as passkey support + export/import (even before the official method came out because they believe in you owning your own data).

I love it because Strongbox also has its own cloud feature (optional) that is just a hosted KeePass DB which makes it easy to have a shared DB with my partner.

The only downside for me: there isn’t a universal search that searches all DBs for credentials. So if you are in a browser and trying to autofill, you need to select the DB you want it to populate from.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#202

Post by al_borland »

alwayslikethis wrote: post #159
FiloSottile wrote: post #13

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

Wouldn't it also make you lose everything in a recovery scenario? If all your computers are lost in a fire or flood, you would lose the recovery key, and having your password would not be enough to recover your database. I use keepassxc with a somewhat long password with a high PBKDF iterations count, which would not require having any devices in the event of a loss.

There is an option to print out recovery info. A sheet with a QR code and a space for you to write your password (or not, if you don't trust keeping those 2 things in one place). That paper can go in a safe deposit box, with a trusted family member / friend, or in some cloud service you'd still have access to. The QR code + your password allow for recovery.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#203

Post by bberrry »

commandersaki wrote: post #12
czk wrote: post #10

Earlier quoted context omitted.

Horrible, and waiting until Christmas week to disclose it while weak master passwords (no min length reqs) and a laughable PBKDF2-HMAC-SHA256 with 5,000 iterations (this was set to 100,100 for new accounts after Feb 2018) let the attackers brute-force their way in…

I think in some cases the iteration count was like 5000.

Mine had iteration count 1. I was livid when I found out. Fucking amateurs taking on the responsibility to safeguard everyone's passwords

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#204

Post by loufe »

nytesky wrote: post #190
aryonoco wrote: post #26

Earlier quoted context omitted.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

I backup some what similarly. Curious, how is Excel encryption? That may be a more approachable format than CSV GPG, and though technically the CSV GPG is more simpler, it may be less familiar to users in 100 years. Excel will still be around ;)

https://answers.microsoft.com/en-us/msoffice/forum/all/what-...

They apparently use AES-128. Not quite the level of Bitwarden, which uses hashing (argon2 or PBKDF2) and AES-CBC-256 simultaneously.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#205

Post by commandersaki »

hayst4ck wrote: post #149
moktonar wrote: post #129

SPoF again..

This is such an under-rated comment for this whole thread. This was my gut response to password vaults when they were first implemented. I still find the idea of password vaults spooky. Open source ones scare me because it seems easy to slip a compromised library. The XZ debacle can't be the only time that's been tried. All of them scare me because a bad browser extension or a more minor hack, like a trojan, could li…

In the same league of paranoia someone could do a supply chain attack of your favourite browser engine to siphon cookies, credentials, etc.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#206

Post by loufe »

briHass wrote: post #62
naet wrote: post #48

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one. It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home off…

Passkeys tied to actual hardware, like the TPM-based solution in Windows Hello, whenever possible, Keepass where not. Keepass DB cloud synced, but the passkey file I use in conjunction with a p/w to open it never leaves the machine(s) it's on. Also, key file needs Admin rights to read, so KP is run privileged, which also protects its process memory space from user-land snooping.

Even better than the TPM in Windows is a hardway FIDO2 or OTP key, I'd imagine. Those cannot be comprimised by a virus on your PC in the same way, assuming you don't leave the key in at all times and you only tap the button when explicitly logging into something that would require it.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#207

Post by gruez »

jorvi wrote: post #200
serkanh wrote: post #192

Earlier quoted context omitted.

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

With the way the Apple is going in the UK, I'd rather give 1Password the keys to the kingdom. Their whole raison d'etre is protecting your passwords. If they start selling people out, their business implodes. They also keep adding thoughtful tweaks and new features. A couple years back I thought I'd give it a few years and then hop from 1Password to Bitwarden. But Bitwarden's UI and UX is still subpar (doesn't even s…

>With the way the Apple is going in the UK, I'd rather give 1Password the keys to the kingdom.

What should Apple have done? Defy the government's order? Shut down entirely? They're already fighting it in court.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#208

Post by Spooky23 »

aryonoco wrote: post #180
JumpCrisscross wrote: post #75

Earlier quoted context omitted.

> Bitwarden truly doesn’t get enough credit for being completely open source It’s their No. 1 selling point. > In 50 years time, who knows if any of these companies will be around 1Password has local clients. If you have the password, you should be able to unlock the vault locally.

Since I’m talking about reliable long term archival of critical encrypted data here, let me again ask: in your opinion, what is the likelihood that in 50 years time, with 1Password long gone, my grand children would be able to run that local 1Password client and successfully decrypt the data? Because I feel pretty confident that gpg will still be around (though hopefully long deprecated), that gzipped files would sti…

Close to zero. Archive is a different discipline. You need to have formats that are long lived and accessible over time. Paper is best, and it goes from there. Some electronic media archivists are fans of TIFF. It’s a field with controversy.

Pick the formats your storing and handle security at the container. This might be an encrypted system that is copied and updated over decades or a physical storage safe or box.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#209

Post by rm_-rf_root »

commandersaki wrote: post #195
namaria wrote: post #189

Earlier quoted context omitted.

The point you're trying to make is a trivial one: in the absence of errors, there are no problems. LastPass e2ee was never the problem in the original story either.

You are wrong, the article posted said the heists happened because of both a breach and cracking master passwords. LastPass E2EE relied on keys from the master password using a password hash that had a low iteration count. Therefore low entropy passphrases could easily be cracked. Furthermore not all data was encrypted. This is all a weakness of their E2EE. 1Password uses both PAKE for remote authentication and a hig…

> attacking the ciphertext data would be infeasible

If insufficiently protected, any attack surface may be compromised. It’s just a matter of time, resources, and will.

“The only winning move is not to play.”

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#210

Post by noAnswer »

makeitdouble wrote: post #54
chinathrow wrote: post #2

Me, looking at my local KeepassXC, calm, sticking with it.

This is the kind of control that is really becoming a luxury. And I don't know how we get back to a simple state; Let's say you're a family of three with shared services and accounts: Keeping everything under Keepass means handling the file sync between all the devices and OSes, with potentially your credentials flying through third party sync services, thus negating most of the advantages of Keepass. Moving to somet…

I would argue that there is no need to sync all accounts between all devices all the time.
Post reply on HN