There really should be a disclaimer that this tool is useless when checking certificates re-keyed with the same starting and end dates. It could create a reputational risk for sites that are otherwise safe or patched.
LastPass Now Checks If Your Sites Are Affected by Heartbleed
71–80 of 94 posts
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#72Wait. When I click "Security Check" in my LastPass Tools... menu (this is in Chrome), I get taken to an internet-hosted web page where I'm prompted to enter my master password. [1] I am not taken to a chrome:// page or some other client-side tool. I take this to mean that I'm giving LastPass's web server my actual master password, and that they will do server-side decryption of my Vault and have server-side access to…
LastPass is proprietary closed source software. For all you know they've never not had access to your vault.
This comment is funny because this thread is about an OpenSSL bug that has been giving up your keys for 2 years.
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#73Earlier quoted context omitted.
NO! It's all done locally via JavaScript -- we never want to get your master password / encryption key -- we go through great pains to ensure that never happens.
But there's like, no way for a customer to verify that. It's good practise, but a customer should not rely on that as part of their security model.
It's a lastpass.com site and you are already implicitly trusting them by using LastPass. How does this make it less secure?
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#74I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.
With a question like this, you're probably going to get a lot of biased options. Not because people want you to use an inferior product, but because obviously one think that what he uses it the best. For example, as a current KeePass user, I'd suggest it. Lastpass overall is comfy, you do everything within your browser, it sync without much problems and you can use it on the go with the official applications and addo…
A tangent: Have you tried KeeFox, as opposed to PassIFox?
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#75Notably some sites are using fresh certificates that have the same (months-in-the-past) starting-validity date as their old certificates. For example, Heroku has done this. (I can think of a few process and fee reasons this approach might be picked. Perhaps a CA might offer a free new cert and revocation, if and only if the new cert has the same validity range as the one it replaces. An ops team might prefer one cons…
We haven't found a way to do this -- we're using openssl s_client to get the start date, but one of our own certificates for LastPass.eu also reissued without changing the date so we know it's a problem. We wish we had all site's certificate fingerprints from before this started so we could utilize that data -- if anyone has it, an email to securit@lastpass.com would be greatly appreciated.
you might want to try contacting netcraft, they have all the certificate information for most major sites[1]
[1] - news.netcraft.com/archives/2014/04/08/half-a-million-widely-trusted-websites-vulnerable-to-heartbleed-bug.html
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#76Note: this is illegal in the UK.
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#77Note: this is illegal in the UK.
[Citation needed]
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#78I've been meaning to switch to a password organizer rather than rely on my browser's built-in one (I know)... I've seen a few discussions on here but I haven't seen a clear victor. In your opinion, is LastPass the one I should go with? Or Keepass or OnePass or one of the others? Edit just to say I think this is a very nice feature by LastPass and thanks for posting.
Lots of recommendations already, but I'll throw in a vote for Pass[0]. It's simple, cross-platform, and doesn't require trust in any service--although you do need to trust yourself not to lose your gnupg private key. [0] http://www.zx2c4.com/projects/password-store/
I've been using this too, highly recommended. Very simple and usable command-line interface, integrates with Git to share all encrypted passwords across machines.
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#79Earlier quoted context omitted.
It's a bad idea to trust your secrets with a proprietary web service. Free software is a prerequisite for digital security. Best to use a free software password manager that you can run on your own computer.
And what do I do when I have 3 or 4 devices? Home desktop, work desktop, laptop, tablet, etc?
I've been using http://www.zx2c4.com/projects/password-store/ which handles that by integrating with Git, encrypted passwords are stored in a Git repo and all changes are recorded as Git commits. It's no more difficult than using a centralized third-party service, provided you have somewhere to host a Git server for it.
Re: LastPass Now Checks If Your Sites Are Affected by Heartbleed
#80Earlier quoted context omitted.
With a question like this, you're probably going to get a lot of biased options. Not because people want you to use an inferior product, but because obviously one think that what he uses it the best. For example, as a current KeePass user, I'd suggest it. Lastpass overall is comfy, you do everything within your browser, it sync without much problems and you can use it on the go with the official applications and addo…
A tangent: Have you tried KeeFox, as opposed to PassIFox?
I have. KeeFox is good, and it's more akin to LastPass (feature-wise). I went with PassIFox because all I want is a simple "fill username & password" in the right-click menu, I'm fine with managing my passwords directly within KeePass.