Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

121–130 of 311 posts

Re: LastPass Security Notice

#121

Post by sjwright »

Zombieball wrote: post #101
itaysk wrote: post #68

Password reset page is down: "Oops! Our servers are a bit overloaded right now. Please try your password change again shortly, we will catch up soon."

I am sure they are just overloaded with legitimate requests. But it that would be pretty interesting if the attackers first stole data from their servers and promptly followed this attack with a DDOS attack to their password reset endpoints!

Imagine if the blog post was malicious and the password reset endpoint was actually a honeypot to collect your master password?

No thank you, I'll trust the encryption to do its job. Don't see how changing the master password is going to help any.

Re: LastPass Security Notice

#122

Post by Someone1234 »

Zombieball wrote: post #108
driverdan wrote: post #62

Earlier quoted context omitted.

How will that invalidate the info they have?

I presume he is under the assumption that the secret seed to the OTP algorithm was compromised. By disabling / deleting your OTP token and re-adding it, you are essentially re-generating this seed. I am not sure I understood the comment "altered the number of iterations from 10,000 to 10,001 (causing it to re-encrypt the database)", care to elaborate @Someone1234?

LastPass double-hashes (ignoring iterations) master passwords. It has a client component based on PBKDF2 and a server component (per this article) also PBKDF2 based.

If the bad guys stole the hashes after they were hashed by LastPass's servers then changing the client iterations wouldn't do a damn thing. However because LastPass have an unknown network compromise one could worry that the bad guys intercepted LastPass client-hashed passwords between the client and server.

IF they modified the LastPass client, they could have it send LastPass's servers the already client-hashed password and therefore login even without knowing someone's plain text master password.

By altering your account iterations even by 1, you've now effectively forced them to decrypt the client hash (to plain text) before they could use it to login to LastPass's servers.

Again this only helps if they intercepted network traffic on LastPass's internal network.

PS - The OTP thing is as you said. PPS - A better idea is just to change your master password.

Re: LastPass Security Notice

#123

Post by rtz12 »

I have a German system from a German IP and some of the words in the article are German. Weird. Do they have some kind of auto translation that kicks in even though they didn't translate the whole article?

Re: LastPass Security Notice

#124

Post by Someone1234 »

eric_the_read wrote: post #116
tptacek wrote: post #43

Earlier quoted context omitted.

I find this design kind of baffling. Why go through the trouble of storing data encrypted only to snatch defeat from the jaws of victory by demanding that the client provide a secret derived from the encryption key just to log in?

I finally managed to convince my mother to start using LastPass recently; if I'd had to convince her to use two "master" passwords-- one for the encryption key, one for the service-- I'm fairly sure she'd still be using Google Contacts to store her secrets. :-\

Exactly. Why is why I entirely understand LastPass's reasoning for not doing that by default. But it would be a nice "advanced user" option (like 2F and all the other toys hidden in the account settings advanced tab).

Re: LastPass Security Notice

#125

Post by moepstar »

I commend them for their honesty, so thanks for the heads up :)

One thing i noticed: They used quite a few german words ("dennoch", "jedoch", "dann") which i haven't seen used elsewhere up to now.

Is that common? I know that quite a few words are used commonly in English like "kindergarten" for instance, but this is the first time i've seen those in an english blog...

Re: LastPass Security Notice

#126

Post by binaryanomaly »

gherkin0 wrote: post #73
jjarmoc wrote: post #30

Earlier quoted context omitted.

> Maybe there are people out there who will accept much more inconvenience in exchange for avoiding the risk associated with a cloud-based service. But, for me, the inconvenience is simply too much. Sure, it's a balance everyone has to find for themselves. As you note earlier, a cloud password manager is better than shared passwords. I'm certainly happy to accept a bit more inconvenience than most. I only do banking…

> For web services (like HN) I simply don't need to log in and comment that badly if I'm on an unusual device. You also don't need to use one solution for every use-case. I use an online password manager (LastPass + 2FA) for relatively high-use, low-value credentials (things like web forums and online shopping sites). For higher-value credentials (investment accounts, banking, email), I use an offline password manage…

I think 2FA is really the key here. If I have a really physically isolated 2FA device I feel pretty safe actually.

Re: LastPass Security Notice

#127

Post by sjwright »

AdmiralAsshat wrote: post #111
bgray wrote: post #106

Earlier quoted context omitted.

So you're trusting Google?

The KeePass database itself is encrypted with a Master Password/Password Phrase. You can take a look at the encryption they use for it here: http://keepass.info/help/base/security.html#secencrypt Hence, I am reasonably confident that even if Google were to turn over my Drive account to the NSA, they wouldn't be able to crack open the database. See also: discussion on feasibility of brute forcing a KeePass database: h…

That's no different to how LastPass stores your vault on its servers, isn't it? They're just using their own cloud instead of Google's.

Re: LastPass Security Notice

#128

Post by Kelly2 »

I don't understand the use case for LastPass/Dropbox/FTP storage of password, 1Password (and probably others) allow to sync through wifi, isn't that enough? Why would you need to do it over the cloud?

Re: LastPass Security Notice

#129

Post by matwood »

sjwright wrote: post #127
AdmiralAsshat wrote: post #111

Earlier quoted context omitted.

The KeePass database itself is encrypted with a Master Password/Password Phrase. You can take a look at the encryption they use for it here: http://keepass.info/help/base/security.html#secencrypt Hence, I am reasonably confident that even if Google were to turn over my Drive account to the NSA, they wouldn't be able to crack open the database. See also: discussion on feasibility of brute forcing a KeePass database: h…

That's no different to how LastPass stores your vault on its servers, isn't it? They're just using their own cloud instead of Google's.

When thinking about security who has more resources and expertise? LastPass or Google?

Re: LastPass Security Notice

#130

Post by jjarmoc »

tptacek wrote: post #80
jjarmoc wrote: post #74

Earlier quoted context omitted.

"Answer unclear, ask again later"

I get why they can't provide details. But a close read of that incident report doesn't answer whether they even know how it happened. Did I miss something?

No, I don't think you did. I certainly haven't seen anything about the root cause. Let's hope it comes in time.
Post reply on HN