Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Now Checks If Your Sites Are Affected by Heartbleed

blog.lastpass.com

Post reply on HN
Print view View original

61–70 of 94 posts

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#61

Post by MichaelGG »

pwman wrote: post #57
davidp wrote: post #52

Wait. When I click "Security Check" in my LastPass Tools... menu (this is in Chrome), I get taken to an internet-hosted web page where I'm prompted to enter my master password. [1] I am not taken to a chrome:// page or some other client-side tool. I take this to mean that I'm giving LastPass's web server my actual master password, and that they will do server-side decryption of my Vault and have server-side access to…

NO! It's all done locally via JavaScript -- we never want to get your master password / encryption key -- we go through great pains to ensure that never happens.

But there's like, no way for a customer to verify that. It's good practise, but a customer should not rely on that as part of their security model.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#62

Post by frewsxcv »

pwman wrote: post #58
frewsxcv wrote: post #17

Earlier quoted context omitted.

"it's been the only viable way to fill passwords in for years" Call me old fashioned, but I'd rather copy/paste than rely on the web browser within the app. The lack of attention for the desktop Firefox extension is what drove me to alternatives. After switching away, I realized I was paying for a payed proprietary system with no real benefits from an open source solution.

Regarding firefox -- Are you speaking of the fact that Mozilla refused our Firefox updates for over a year? We're happy you found a tool that works for you -- that's what we want everyone to do -- it doesn't need to be LastPass but people need to use something -- reusing passwords constantly is just painful.

Out of curiosity, what were their reasons for refusing the updates? I have my own gripes with the AMO team, but I've never had an extension update refused

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#63

Post by MichaelGG »

devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

I recently went over this and went with KeePass. It's open source, although apparently not with a public repo (just source zips). I'm in the process of verifying it and building it for myself. I used to use PasswordSafe, but I think I have a higher chance of missing a backdoor in C than in C#. (I removed all the native stuff from my copy of KeePass.)

For critical stuff, I want to minimize the amount of proprietary stuff. I already have Windows (as a VM host), Lenovo and VMware to trust - but at least that's not directly connected to the Internet[1]. Why add a third party that could suffer a remote compromise or worse?

1: Host runs VMs, has no protocols bound to NIC but passes it through to a gateway VM which acts as a router for the other VMs. KeePass can run on the host, so a VM compromise is somewhat limited.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#64

Post by tempestn »

davexunit wrote: post #26
devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

It's a bad idea to trust your secrets with a proprietary web service. Free software is a prerequisite for digital security. Best to use a free software password manager that you can run on your own computer.

As recent events have clearly demonstrated, FOSS is by no means immune to security holes. Is paid, closed-source software less secure? On one hand, it does lack community oversight of the code base. (Although clearly with a sufficiently complex code base, backdoors can exist for years without anyone noticing anyway, and it could be argued that intentional back doors would be more easily installed in open source projects.) On the other hand though, paid software is operated by a team whose job it is to keep the service secure.

All that aside though, I certainly can't see any logical argument for the statement "Free software is a prerequisite for digital security." It could be argued that open source software is such a prerequisite (although I wouldn't necessarily agree), but if anything I expect that paying for software would ultimately tend to make it more secure.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#65

Post by tempestn »

nly wrote: post #56
davidp wrote: post #52

Wait. When I click "Security Check" in my LastPass Tools... menu (this is in Chrome), I get taken to an internet-hosted web page where I'm prompted to enter my master password. [1] I am not taken to a chrome:// page or some other client-side tool. I take this to mean that I'm giving LastPass's web server my actual master password, and that they will do server-side decryption of my Vault and have server-side access to…

LastPass is proprietary closed source software. For all you know they've never not had access to your vault.

If you wanted to, it's not too tough to extract the source code of their browser add-ons to verify for yourself that your vault is encrypted before being sent to their servers, and that your master password is not sent. (And of course with this tool it's relatively trivial to look through the javascript to verify the same.)

So while you can't look at the code running on their servers, it seems to me that you certainly can know they don't have access to your vault.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#66

Post by biffa »

IgorPartola wrote: post #28
pwman wrote: post #10

Earlier quoted context omitted.

We haven't found a way to do this -- we're using openssl s_client to get the start date, but one of our own certificates for LastPass.eu also reissued without changing the date so we know it's a problem. We wish we had all site's certificate fingerprints from before this started so we could utilize that data -- if anyone has it, an email to securit@lastpass.com would be greatly appreciated.

I believe if you use a new private key but sign the same CSR the dates will not change. Ideally the old certs should be revoked which should provide some info on this. I saw this explanation on the discussion of the herokuapp.com's cert's dates not changing.

The public key in the CSR should match the private key it's associated with so this wouldn't work. Also the notBefore date in the certificate is set by the CA; it's not in the CSR.

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#67

Post by MaKleSoft »

devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

If you're looking for an open source alternative that is easy to use and not as clunky as KeePass, 1Password or LastPass, you should take a look at Padlock: http://padlock.io/

It's still in alpha but will be released on all major platforms once its ready.

Disclaimer: I'm the developer

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#68

Post by ClashTheBunny »

swlkr wrote: post #8
devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

I use pass http://www.zx2c4.com/projects/password-store/ You could store your passwords in a git repo to get a sort cross-platform thing going on.

This is what I'm going with. Something simple enough that I can understand what's going on and get to my passwords and create new passwords without the program.

It works on EVERY platform because gpg is available for EVERY platform and it's just a bunch of files in a hierarchy, so however your sync files, you sync these.

It has as strong a master encryption as your gpg key and git is a great way of versioning your passwords: "wait, I used to have the same password for gmail and yahoo mail, but then I stopped using yahoo mail and changed my gmail password to something really secure, but now I need to get into yahoo for some reason (yes, literati, I still love you). git log --grep accounts.google.com".

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#69

Post by enoch_r »

devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

Lots of recommendations already, but I'll throw in a vote for Pass[0]. It's simple, cross-platform, and doesn't require trust in any service--although you do need to trust yourself not to lose your gnupg private key.

[0] http://www.zx2c4.com/projects/password-store/

Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed

#70

Post by slowmotiony »

devindotcom wrote: post #2

I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.

I use LastPass for years now and I definitely recommend it. I tried to set up KeePass and god what a nightmare that was. You need a PhD in setting up the thing before you can use it comfortably.
Post reply on HN