Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

221–230 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#221

Post by pier25 »

serkanh wrote: post #192
taikahessu wrote: post #161

Lastpass downplayed the breach and turned out they had not properly encrypted the data like notes section. They should have been sued to oblivion, but they were able weasel out of responsibility, so far. Lastpass had one job and failed it. Unforgivable that they knew their users' master passwords are not secure enough, but chose not to be vocal or proactive about it. If you're using Lastpass right now, move to more t…

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

> except for the fact that they basically forced users to use their cloud offering

Yeah that's when I left 1P after having bought hundreds of dollars of licenses for myself and my family (for multiple OS).

The other big thing was self hosting the vault. You used to be able to sync the vault with Dropbox and access it from a browser but at some point Dropbox killed public folders. It would have cost 1P pennies to store the vaults of paying customers in S3 buckets. Instead they decided to use that as leverage to force people into subscriptions.

Very happy with Bitwarden now.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#222

Post by quesera »

TeMPOraL wrote: post #164
matwood wrote: post #112

Earlier quoted context omitted.

1P family sharing and 1P cli also work well. I check BW every so often but it always feels less polished UI wise. For all the complaints people had about 1P moving to electron, it’s UX is still the best out there.

> family sharing Why would someone make a feature like this? I'm confused why some companies (including Amazon and Steam) insist on family features. The mental model behind this is more prescriptive than descriptive - it doesn't match to how users and their families function; rather, it insists on some activities to a) exist in family, and b) be not allowed outside of family. Or simply: how many people have actual fa…

I think "family" is just the humane, user-friendly, non-corporate word for "group" in this context.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#223

Post by dahart »

TeMPOraL wrote: post #164
matwood wrote: post #112

Earlier quoted context omitted.

1P family sharing and 1P cli also work well. I check BW every so often but it always feels less polished UI wise. For all the complaints people had about 1P moving to electron, it’s UX is still the best out there.

> family sharing Why would someone make a feature like this? I'm confused why some companies (including Amazon and Steam) insist on family features. The mental model behind this is more prescriptive than descriptive - it doesn't match to how users and their families function; rather, it insists on some activities to a) exist in family, and b) be not allowed outside of family. Or simply: how many people have actual fa…

What do you mean about prescribing and insisting? I’m not sure I understand your questions about family sharing and the mental model.

I use family sharing with actual family for my Steam account and all video streaming services. Am I weird? The reason is because streaming services allow sharing under a single paid account, and my wife & kids don’t want to pay for separate accounts, and don’t want to have to authenticate separately on shared devices (TVs, game consoles, iPads, etc). Steam family sharing works across different Steam accounts, and sharing a single account doesn’t work, so Steam isn’t particularly relevant to the discussion of family sharing of passwords. Steaming accounts, on the other hand, all assume they’re being used by a whole family, and the main reason is because of shared devices; the family TV itself logged in. So, they all offer profiles under a single account. Netflix clarifies that family sharing means the people in a single household, maybe others are similar.

We use password family sharing as well. My wife and I share bank and credit card accounts. My wife needs my accounts sometimes to do certain things — you might be surprised how many banks do not offer joint accounts and still treat wives as second class citizens. We share the Netflix & Amazon accounts with the kids so they can use them. I pay for a 1Password family account and share it with my aging father who’s been losing passwords. These things are all pretty useful for me.

I guess you’re making me wonder why someone wouldn’t make a family sharing feature, when it solves real problems and users are asking for it?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#224

Post by makeitdouble »

noAnswer wrote: post #210
makeitdouble wrote: post #54

Earlier quoted context omitted.

This is the kind of control that is really becoming a luxury. And I don't know how we get back to a simple state; Let's say you're a family of three with shared services and accounts: Keeping everything under Keepass means handling the file sync between all the devices and OSes, with potentially your credentials flying through third party sync services, thus negating most of the advantages of Keepass. Moving to somet…

I would argue that there is no need to sync all accounts between all devices all the time.

We're holding it wrong ?

The whole point of a password manager is to be reliable when shit hits the fan. If my phone dies I want every changes to be available to the other synced devices, especially when it has been away from home for a while (losing newly created accounts or passwords during a trip is just miserable)

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#225

Post by myself248 »

alwayslikethis wrote: post #162
makeitdouble wrote: post #54

Earlier quoted context omitted.

This is the kind of control that is really becoming a luxury. And I don't know how we get back to a simple state; Let's say you're a family of three with shared services and accounts: Keeping everything under Keepass means handling the file sync between all the devices and OSes, with potentially your credentials flying through third party sync services, thus negating most of the advantages of Keepass. Moving to somet…

Syncthing works great for this if you have an always on computer. If you don't you can use a server and add it as an untrusted recipient if you have to, though I would not bother since the database is encrypted with your password anyways, and is not vulnerable if you never reuse your db password and there is enough entropy.

And you can use keyfiles that you sneakernet between devices at setup time, so those are never exposed to the syncthing shared folder. I don't think this adds much security since presumably if someone can compromise your syncthing secrets, they could probably grab your keyfile too, but in the event of a syncthing vuln that doesn't lead to other filesystem access, it might help.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#226

Post by myself248 »

sedatk wrote: post #43
rcMgD2BwE72F wrote: post #8

Earlier quoted context omitted.

How do you make sure that file does not end up corrupt?

More importantly, how do cloud providers make sure of that?

Why does my USB stick in a fire safe care what cloud providers think?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#227

Post by UltraSane »

I like Bitwarden and selfhost a vaultwarden server on the cheapest instance AWS has. The server only needs to be running when I change the local database. I created a API key with only the ability to start and stop this one instance. The server is only accessible over a Tailscale tunnel so it is extremely secure. It is neat making servers available over a Tailscale tunnel because you don't have to have any open ports at all. I snapshot the instance disk to S3 when it changes. This way i can securely store my passwords on the world's most reliable storage and on my local PC.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#228

Post by TeMPOraL »

quesera wrote: post #222
TeMPOraL wrote: post #164

Earlier quoted context omitted.

> family sharing Why would someone make a feature like this? I'm confused why some companies (including Amazon and Steam) insist on family features. The mental model behind this is more prescriptive than descriptive - it doesn't match to how users and their families function; rather, it insists on some activities to a) exist in family, and b) be not allowed outside of family. Or simply: how many people have actual fa…

I think "family" is just the humane, user-friendly, non-corporate word for "group" in this context.

Yeah, but "group" is also a humane, user-friendly, non-corporate word for "group" and happens to not carry any confusing connotations.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#229

Post by savolai »

pier25 wrote: post #221
serkanh wrote: post #192

Earlier quoted context omitted.

I have been using 1Password for the last several years and am quite happy with them, except for the fact that they basically forced users to use their cloud offering with subscription as opposed to free iCloud storage after 1Password version 7.

> except for the fact that they basically forced users to use their cloud offering Yeah that's when I left 1P after having bought hundreds of dollars of licenses for myself and my family (for multiple OS). The other big thing was self hosting the vault. You used to be able to sync the vault with Dropbox and access it from a browser but at some point Dropbox killed public folders. It would have cost 1P pennies to stor…

Does bitwarden when importing support all data types of 1p ie file attachments and various fields of various entry types?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#230

Post by noAnswer »

makeitdouble wrote: post #224
noAnswer wrote: post #210

Earlier quoted context omitted.

I would argue that there is no need to sync all accounts between all devices all the time.

We're holding it wrong ? The whole point of a password manager is to be reliable when shit hits the fan. If my phone dies I want every changes to be available to the other synced devices, especially when it has been away from home for a while (losing newly created accounts or passwords during a trip is just miserable)

We're holding it differently.

My phone doesn't have my main password safe. I don't trust that thing. If a stupid app decides to log me out, I can't login until I'm back home. I never created an account "on the go", but I had to do a password reset once. I will use a standard password until I'm back and change it to a randomly created one. I can't even login to my bank without a special token device. I don't have that with me either.

A different life is possible. That's all I'm saying.

Post reply on HN