LastPass Security Notice • Hacker News Board

Re: LastPass Security Notice

#81

Post by tptacek » Mon, Jun 15, 2015, 8:35 PM UTC

groby_b wrote: post #63

JadeNB wrote: post #57

Earlier quoted context omitted.

> (Though if you've found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?) I don't know if it meets but your needs, but I love PasswordMaker ( http://passwordmaker.org ). There is no need for sync'ing, because the password is generated from a master pa…

That means one compromised password - your master password - compromises all your sites. That's the kind of risk I can't stomach. LastPass is a huge target, yes - but (if we trust them) the data is only decrypted client side, so they have no access to it. Which means the only viable exploit is in the lastpass browser extension.

But isn't it encrypted with a secret that is also used to log into their web site, or to log into their API to recover the vault?

Re: LastPass Security Notice

#82

Post by joshstrange » Mon, Jun 15, 2015, 8:35 PM UTC

Perhaps this isn't the thread to discuss this but I feel like the state of access in 2015 is dismal at best...

Every option out there either sucks ass on mobile or only integrates with a TINY percentage of apps and on desktop they aren't much better. How does Chrome (on iOS and OS X) blow every other PW manager out of the water? It "Just Works (tm)" while every other PW manager makes me just through a shit ton of hoops... I want to be safe but I can't be the only one who feels "chore" doesn't even begin to describe what maintaining and using a PW is like. My "Master" PW is secure but I'm not typing that thing every 5 minutes, 1Pass got better with Touch ID but it still makes me want to smash my phone every time I have to use it (Also, 1Browser, yeah how about FUCK NO).

Re: LastPass Security Notice

#83

Post by vitd » Mon, Jun 15, 2015, 8:36 PM UTC

Zaheer wrote: post #10

Thoughts on LastPass vs 1Password?

I've not used LastPass, but I chose 1Password because it has the ability to sync with my iOS device over wi-fi. So I don't need to store anything in the cloud, but still get syncing between devices.

It also has options for using DropBox or iCloud, so if you do sync in the cloud, it's still your own account on a different service. So there's not a single point-of-attack like there apparently is with LastPass.

Re: LastPass Security Notice

#84

Post by gherkin0 » Mon, Jun 15, 2015, 8:36 PM UTC

shabble wrote: post #72

pdabbadabba wrote: post #53

Earlier quoted context omitted.

> I simply don't want a single place where all my passwords are available that isn't hardware physically under my control. That makes sense. What would be really nice -- and what I had in mind -- would be some sort of device where the passwords were stored to which my other devices could easily connect to to access the passwords, sort of like a wireless dongle. (Though, really, even the wireless part is negotiable. I…

http://finalkey.net/ looks like a step in teh right direction, although I'd prefer to see something a bit more compact, and ideally with an independent user interface. Something like a smartcard, with an eInk display and membrane keypad, that lets you select a credential and then provide it to the application via keyboard injection, or where possible over using challenge-response over the existing smartcard interface…

> Something like a smartcard, with an eInk display and membrane keypad, that lets you select a credential and then provide it to the application via keyboard injection, or where possible over using challenge-response over the existing smartcard interface so the secret never leaves the card.

Re: LastPass Security Notice

#85

Post by chrislaco » Mon, Jun 15, 2015, 8:36 PM UTC

davis_m wrote: post #52

h43k3r wrote: post #25

One another incident that reminds me, why 2 factor authentication is absolutely necessary for important information.

If the authentication database is being breached, presumably the 2FA shared secret is going to be in the same database. Constructing the 2FA code would be trivial. After all, the server needs a way to check that a given 2FA code is correct for an authenticating user, so there has to be some way to generate those as well. It would help protect against any other sites that you use the same password on, with a different…

If you use Google Authenticator. I would assume this is not the case w/ Yubi.

Re: LastPass Security Notice

#86

Post by chrislaco » Mon, Jun 15, 2015, 8:36 PM UTC

davis_m wrote: post #52

h43k3r wrote: post #25

One another incident that reminds me, why 2 factor authentication is absolutely necessary for important information.

If the authentication database is being breached, presumably the 2FA shared secret is going to be in the same database. Constructing the 2FA code would be trivial. After all, the server needs a way to check that a given 2FA code is correct for an authenticating user, so there has to be some way to generate those as well. It would help protect against any other sites that you use the same password on, with a different…

If you use Google Authenticator. I would assume this is not the case w/ Yubi.

Re: LastPass Security Notice

#87

Post by cmdrfred » Mon, Jun 15, 2015, 8:39 PM UTC

AdmiralAsshat wrote: post #76

See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS. It also has a way better Firefox add-on than any of the others I've seen (which is my main browser), and the Android apps, if unofficial, aren't bad either [0]. Importantly, they feature the ability to either pull from a local Keepass DB or to get it from a connected Google Drive account. I've take…

I have a sftp account on my server for my keepass data, I can sync it from anywhere and I don't have to worry about google drive having access to my (encrypted) data. I like it.

Re: LastPass Security Notice

#88

Post by shabble » Mon, Jun 15, 2015, 8:40 PM UTC

stouset wrote: post #67

pdabbadabba wrote: post #53

Earlier quoted context omitted.

> I simply don't want a single place where all my passwords are available that isn't hardware physically under my control. That makes sense. What would be really nice -- and what I had in mind -- would be some sort of device where the passwords were stored to which my other devices could easily connect to to access the passwords, sort of like a wireless dongle. (Though, really, even the wireless part is negotiable. I…

And when the device dies? If you're using a reasonably trustworthy password manager with a strong master password, your biggest risk is data loss, not mass password compromise. Syncing to multiple devices and cloud backups dramatically reduce that risk while only marginally increasing that of compromise.

I'd make it so that under some very specific and hard to attack circumstances, it would be possible to make a backup of the keyring stored on a device.

Possibly only directly to another device, or maybe dump an encrypted blob to file or straight to paper (bitcoin printable wallet style).

That creates the risk of someone duplicating your thing, but you could have a 'number of times/date of most recent backup' entry obvious in your token UI, and hope people notice abnormal ones.

Protecting from a Chris Tarnovsky[1] level attacker who is probing your silicon is probably beyond the scope of a cheap consumer unit.

The best way I (IANACryptographer) can immediately think of is that your hardware dongle generates an very large internal (never leaves the device) pgp keypair. It can be allowed to back up your internal password database only when encrypted by that key, so it is literally useless except on that single physical device. You could then enroll the pubkeys of your other devices as backups onto it, and the backups would then be multisigned where any one of the associated keys has the ability to decrypt.

The password blob can then be stored jsut about anywhere, but is only decryptable and useable when embedded into the hardware device.

[1] https://en.wikipedia.org/wiki/Christopher_Tarnovsky

Re: LastPass Security Notice

#89

Post by Animats » Mon, Jun 15, 2015, 8:40 PM UTC

"LastPass simplifies your online life by remembering your passwords for you."

You had one job. And you blew it.

Re: LastPass Security Notice

#90

Post by crusso » Mon, Jun 15, 2015, 8:40 PM UTC

Does LastPass keep the encrypted copy of the password file for non-premium accounts? For accounts that don't sync and just use it from a single browser?