Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

141–150 of 311 posts

Re: LastPass Security Notice

#141

Post by harshreality »

sjwright wrote: post #127
AdmiralAsshat wrote: post #111

Earlier quoted context omitted.

The KeePass database itself is encrypted with a Master Password/Password Phrase. You can take a look at the encryption they use for it here: http://keepass.info/help/base/security.html#secencrypt Hence, I am reasonably confident that even if Google were to turn over my Drive account to the NSA, they wouldn't be able to crack open the database. See also: discussion on feasibility of brute forcing a KeePass database: h…

That's no different to how LastPass stores your vault on its servers, isn't it? They're just using their own cloud instead of Google's.

There actually might be a difference in favor of LP. LastPass knows, semantically, what encrypted password archives are, and can monitor for statistically unusual traffic related to an attacker downloading them.

Google has no no way to know, if 10k people are storing their encrypted keepassx archives in gdrive, and if those 10k archives are accessed in rapid succession, that it's an attack. It's lost in the noise of gdrive traffic.

Re: LastPass Security Notice

#142

Post by cheetos »

Slightly off-topic: am I naive to believe that my personal system of password management is just about as good something like 1Password or LastPass? Hear me out. My passwords are generated as follows:

[Low|Med|Hi] + [Key] + [Initials] + [Number]

Low|Med|High = One of three keys based on how sensitive the site is. High: banking / work / email, Low: I don't trust the site, Med: other.

Key = Random string that only I know, with the most important accounts having a unique string

Initials = Initials of site name based on domain name + TLD, with the initials moved up x letters (for example, capitalone.com -> COC -> DPD)

Number = One of three random sets of numbers I use. Sometimes I forget which number I use for each site, but I can figure it out after a few incorrect attempts.

This means a unique password for every site generated by a system that only I know with no central storage except my brain.

What is wrong with this? What would be the advantage to using 1Password / LastPass over this?

Re: LastPass Security Notice

#143

Post by ja27 »

redwards510 wrote: post #35

If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about keyloggers grabbing your password. BeEF can pop up a LastPass phishing prompt if you just happen to load the wrong javascript file. Using just one string of characters to protect ALL of your passwords is insane.

> If you are using LastPass without 2FA

There is no 2FA with LastPass.

Don't believe me? Set up a LastPass account and turn on 2FA. Go log in on an untrusted browser. Enter your password. At the 2FA prompt screen, there is a giant red "If you lost your Google Authenticator device, click here to disable Google Authenticator authentication" link.

That's right. They give the attacker the option to disable 2FA for your account.

Re: LastPass Security Notice

#144

Post by matwood »

DoubleMalt wrote: post #138
matwood wrote: post #129

Earlier quoted context omitted.

When thinking about security who has more resources and expertise? LastPass or Google?

It depends on your threat model. If you are more afraid of the government than of a random script kiddie, the vastly bigger resources of Google do not matter as your (encrypted) database is just a NSL away. And then the NSA is trying to crack it

Well if I put on my tinfoil hat, then there is no protection from the NSA. So, now I'm only trying to protect my password/identity from criminal elements, I tend to side with Google as knowing what they are doing. It doesn't mean they will also be mistake free, but it is something they deal with and have been dealing with before LastPass was even an idea.

Re: LastPass Security Notice

#145

Post by mildweed »

cheetos wrote: post #142

Slightly off-topic: am I naive to believe that my personal system of password management is just about as good something like 1Password or LastPass? Hear me out. My passwords are generated as follows: [Low|Med|Hi] + [Key] + [Initials] + [Number] Low|Med|High = One of three keys based on how sensitive the site is. High: banking / work / email, Low: I don't trust the site, Med: other. Key = Random string that only I kn…

The passwords themselves are rather secure.

But if somebody got their hands on one or two of your passwords, they could probably figure out the rest.

Re: LastPass Security Notice

#146

Post by EugeneOZ »

cheetos wrote: post #142

Slightly off-topic: am I naive to believe that my personal system of password management is just about as good something like 1Password or LastPass? Hear me out. My passwords are generated as follows: [Low|Med|Hi] + [Key] + [Initials] + [Number] Low|Med|High = One of three keys based on how sensitive the site is. High: banking / work / email, Low: I don't trust the site, Med: other. Key = Random string that only I kn…

1) Your scheme is open for all sites where you use it. So they can analyze it and get all of your passwords to other sites by this scheme.

2) You can forget "Key", especially unique keys for important sites. I have few hundreds records in KeePass, I can't imagine how to remember all of them or "keys" to them.

3) TLD can be changed and some secrets doesn't have TLD (databases, for example).

4) You can't remember all digits of all your credit cards. If you can - or you don't have credit cards or you kidding.

5) Sometimes you need to store very long license keys. No, license.txt is not the most safe way :)

Re: LastPass Security Notice

#147

Post by JadeNB »

groby_b wrote: post #63
JadeNB wrote: post #57

Earlier quoted context omitted.

> (Though if you've found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?) I don't know if it meets but your needs, but I love PasswordMaker ( http://passwordmaker.org ). There is no need for sync'ing, because the password is generated from a master pa…

That means one compromised password - your master password - compromises all your sites. That's the kind of risk I can't stomach. LastPass is a huge target, yes - but (if we trust them) the data is only decrypted client side, so they have no access to it. Which means the only viable exploit is in the lastpass browser extension.

> That means one compromised password - your master password - compromises all your sites.

I agree, but it's hard to see how it could be compromised, since it is never entered anywhere public-facing. You can, but need not, have the Firefox extension store it, but only in memory. It is also possible to use the PasswordMaker website (once loaded) without an Internet connection, in case you are worried about it leaking data.

Re: LastPass Security Notice

#148

Post by JadeNB »

eco wrote: post #66
JadeNB wrote: post #57

Earlier quoted context omitted.

> (Though if you've found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?) I don't know if it meets but your needs, but I love PasswordMaker ( http://passwordmaker.org ). There is no need for sync'ing, because the password is generated from a master pa…

I tried to use something similar a long time ago (SuperGenPass). The problem I had with it was that often times the password would not meet the password requirements of the site. Sometimes it's too long, sometimes there weren't enough numbers or symbols. I couldn't use it if I'd have to remember that it didn't work for particular sites (after all, the whole point is not having to remember information for each site).…

PasswordMaker allows you to tune the length and character set. You have to remember your site's password requirements, which is not so easy to do (usually they are only made available when you try, and fail, to change your password; in particular, only when you are logged in); but, in practice, I've found that using the default settings, and then using restricted settings (shorter length and A-Za-z0-9 character set) if that fails, works on every site I've ever used. This means that, if you are willing to endure the occasional inconvenience of having to re-enter a password, you don't have to remember anything per-site.

Re: LastPass Security Notice

#149

Post by JadeNB »

joshstrange wrote: post #69
JadeNB wrote: post #57

Earlier quoted context omitted.

> (Though if you've found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?) I don't know if it meets but your needs, but I love PasswordMaker ( http://passwordmaker.org ). There is no need for sync'ing, because the password is generated from a master pa…

Not only do I see this issue groby_b rasies as a huge one but I'm not sure how this is supposed to work for sites that have various password requirements. Most of them don't display the requirements on the login page (or even on the signup page sometimes) so now I need to remember that on a per-site basis which is just as bad as having to remember different passwords IMHO.

> Not only do I see this issue groby_b rasies as a huge one

I think that it is not actually an issue, since the master password never goes out into the wild (see https://news.ycombinator.com/item?id=9722272).

> Most of them don't display the requirements on the login page (or even on the signup page sometimes) so now I need to remember that on a per-site basis which is just as bad as having to remember different passwords IMHO.

For me, at least, this issue is solveable in practice. See https://news.ycombinator.com/item?id=9722276 .

Re: LastPass Security Notice

#150

Post by harshreality »

tptacek wrote: post #43
Someone1234 wrote: post #39

Earlier quoted context omitted.

Actually that's how LastPass works (they move around an AES-256 encrypted database, and decrypt it on the client/browser). The problem LastPass has, is that they re-use the same master password for two distinct things: - Authenticating to login to your account. - Encrypt your password database. So in situations like this the loss of the authentication hash is relevant. I'd prefer to have a different password for the…

I find this design kind of baffling. Why go through the trouble of storing data encrypted only to snatch defeat from the jaws of victory by demanding that the client provide a secret derived from the encryption key just to log in?

I suppose they need to ensure that the person logging into the site, or interacting with the site via the browser extension, actually created the encrypted archive. Without a passphrase-derived authentication token (which they say is something like pbkdf2(encryption_key + passphrase), where encryption_key itself is pbkdf2(email + passphrase)), how could they ensure that?

Without that connection, if they had a totally separate secret S for web logins, anyone with S (and your 2-factor token if you have it enabled) could change your server-stored archive with no knowledge of how to decrypt it. Wouldn't that be a denial of service attack, if the next time you login to lastpass your local encrypted password archive is overwritten? You'd then have to rely on whatever other backup solution you (hopefully) use, to get an old local copy of the encrypted password archive.

Post reply on HN