Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Now Checks If Your Sites Are Affected by Heartbleed

blog.lastpass.com

Post reply on HN
Print view View original

31–40 of 94 posts

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#31

Post by grrowl »

willtheperson wrote: post #29

I wish there was (or maybe there is) a protocol for updating your password. Then managers like lastpass and 1Password could more easily update your password. Maybe, behind the scenes they could rotate your password every x days automatically. Having a protocol in place would also make breach notices an easy "update all passwords" click away. There's probably a reason this is a bad idea. Let's hear it! :)

It discourages two-factor auth for password change requests (such as site username and access to your email account), it adds an additional point of failure, and it would make it easier for attackers to lock you out of your account once they gain entry.

Plus, if any changes are to be made to the authentication process it should be migrating to two-factor auth across all services.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#33

Post by colonelxc »

pwman wrote: post #10
gojomo wrote: post #4

Notably some sites are using fresh certificates that have the same (months-in-the-past) starting-validity date as their old certificates. For example, Heroku has done this. (I can think of a few process and fee reasons this approach might be picked. Perhaps a CA might offer a free new cert and revocation, if and only if the new cert has the same validity range as the one it replaces. An ops team might prefer one cons…

We haven't found a way to do this -- we're using openssl s_client to get the start date, but one of our own certificates for LastPass.eu also reissued without changing the date so we know it's a problem. We wish we had all site's certificate fingerprints from before this started so we could utilize that data -- if anyone has it, an email to securit@lastpass.com would be greatly appreciated.

Take a look a scans.io. They have internet wide https scans every couple weeks.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#34

Post by sgeisenh »

grrowl wrote: post #31
willtheperson wrote: post #29

I wish there was (or maybe there is) a protocol for updating your password. Then managers like lastpass and 1Password could more easily update your password. Maybe, behind the scenes they could rotate your password every x days automatically. Having a protocol in place would also make breach notices an easy "update all passwords" click away. There's probably a reason this is a bad idea. Let's hear it! :)

It discourages two-factor auth for password change requests (such as site username and access to your email account), it adds an additional point of failure, and it would make it easier for attackers to lock you out of your account once they gain entry. Plus, if any changes are to be made to the authentication process it should be migrating to two-factor auth across all services.

Authenticator tokens are pretty robust systems. I'd like to see more services start to make use of them.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#35

Post by thefreeman »

IgorPartola wrote: post #28
pwman wrote: post #10

Earlier quoted context omitted.

We haven't found a way to do this -- we're using openssl s_client to get the start date, but one of our own certificates for LastPass.eu also reissued without changing the date so we know it's a problem. We wish we had all site's certificate fingerprints from before this started so we could utilize that data -- if anyone has it, an email to securit@lastpass.com would be greatly appreciated.

I believe if you use a new private key but sign the same CSR the dates will not change. Ideally the old certs should be revoked which should provide some info on this. I saw this explanation on the discussion of the herokuapp.com's cert's dates not changing.

From what I had to go through, you can't really "sign the same CSR". What you do is generate a new CSR with a new private key, using the same details as the previous certificate. Then you ask your provider for a re-key. You provide the CSR, they provide you with a new certificate, and revoke the old certificate within 72 hours (in Go-Daddy's case).

I am far from an expert in this so perhaps I

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#36

Post by readlet »

pwman wrote: post #10
gojomo wrote: post #4

Notably some sites are using fresh certificates that have the same (months-in-the-past) starting-validity date as their old certificates. For example, Heroku has done this. (I can think of a few process and fee reasons this approach might be picked. Perhaps a CA might offer a free new cert and revocation, if and only if the new cert has the same validity range as the one it replaces. An ops team might prefer one cons…

We haven't found a way to do this -- we're using openssl s_client to get the start date, but one of our own certificates for LastPass.eu also reissued without changing the date so we know it's a problem. We wish we had all site's certificate fingerprints from before this started so we could utilize that data -- if anyone has it, an email to securit@lastpass.com would be greatly appreciated.

Maybe you could use look for a cert with the same date on a revocation list. A site isn't really secure until the old cert is revoked anyhow.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#38

Post by platz »

27182818284 wrote: post #21
devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

My biggest problem with LastPass, and this is a small problem, is that it fucks up on a fair amount of input fields. So for example, it still works, but its icon is too huge for site example.com so it is awkaward or it thinks it is a username and password form but it is actually a signup form with username password1 password2. I'd still recommend it, despite those problems.

Not a huge problem since you always have access to your credentials in about two clicks from the right-mouse context menu.
Post reply on HN