Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

151–160 of 311 posts

Re: LastPass Security Notice

#151

Post by StavrosK »

dragontamer wrote: post #134
rwhitman wrote: post #133

Earlier quoted context omitted.

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

If you wanted security, you'd use a SHA256 hash of a master-password + domain name. http://angel.net/~nic/passwdlet.html Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.

There are multiple problems with this approach. SHA is way too fast, some site is always going to have Auth requirements that won't be the same as the ones you have set (one service wants mandatory special characters, one wants mandatory alphanumeric only), and, most importantly, you can't change the passwords unless you change the master password and remember which you used where.

Re: LastPass Security Notice

#152

Post by andrewaylett »

dragontamer wrote: post #134
rwhitman wrote: post #133

Earlier quoted context omitted.

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

If you wanted security, you'd use a SHA256 hash of a master-password + domain name. http://angel.net/~nic/passwdlet.html Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.

How do you generate a different password after that one's been found to be stored in plaintext and the admin resets all of the passwords?

Or, and more to the point, having generated a different password how do you remember which sites need a V1 password and which need V2?

When sites introduce silly rules around password structure, how do you make sure your passwords conform?

And even if you could guarantee you'll never hit any of these issues, shouldn't you be using a key-derivation function, rather than a hash?

I entrust my passwords to KeePass, as I trust its authors to have more of a clue than me and it lets me store arbitrary data rather than restricting me to a specific class of generated password. That file can then be replicated to enough of my devices that it's available when I need it, without a third-party having enough access to the data to be able to issue even the kind of security alert we see here.

Re: LastPass Security Notice

#153

Post by jjarmoc »

binxbolling wrote: post #120
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

Not sure I'm with you on the "responding well" part. Why blog about it before even notifying your customers? And Joe's whole post seems fairly low-key given that this was a security breach and security is their entire business.

In the comments, they indicate that they're in the process of sending out emails to users. Sending lots of emails takes some amount of time; hopefully those are arriving in inboxes now.

It's low key given the impacts as they understand them now, but seems reasonable unless there's more to it than it currently known. We'll see how things develop in the coming days - just being forthcoming days after it was detected and providing guidance on how to respond is commendable though.

Re: LastPass Security Notice

#154

Post by dchest »

dragontamer wrote: post #134
rwhitman wrote: post #133

Earlier quoted context omitted.

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

If you wanted security, you'd use a SHA256 hash of a master-password + domain name. http://angel.net/~nic/passwdlet.html Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.

http://crypto.stackexchange.com/a/5691/291

Re: LastPass Security Notice

#155

Post by gregmac »

dragontamer wrote: post #134
rwhitman wrote: post #133

Earlier quoted context omitted.

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

If you wanted security, you'd use a SHA256 hash of a master-password + domain name. http://angel.net/~nic/passwdlet.html Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.

I use LastPass to also store the username I used, which is handy given that:

1. Some sites use email, others use username (and sometimes your usual username is taken), and a handful of sites assign you something (eg: with an old VoIP provider I used to use, I had to log in with my customer number instead of a username)

2. I use a unique email address on every site, in the form "domain-i-am-logging-into.com@something.mydomain.com", though occasionally I have "companyname@something.mydomain.com" (eg: I use "amazon@" because I my account works with both amazon.ca and amazon.com)

LastPass remembers all this crap for me, and it also lets me keep other notes, password history, etc, as well as being quite convenient.

Re: LastPass Security Notice

#156

Post by dragontamer »

andrewaylett wrote: post #152
dragontamer wrote: post #134

Earlier quoted context omitted.

If you wanted security, you'd use a SHA256 hash of a master-password + domain name. http://angel.net/~nic/passwdlet.html Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.

How do you generate a different password after that one's been found to be stored in plaintext and the admin resets all of the passwords? Or, and more to the point, having generated a different password how do you remember which sites need a V1 password and which need V2? When sites introduce silly rules around password structure, how do you make sure your passwords conform? And even if you could guarantee you'll nev…

> Or, and more to the point, having generated a different password how do you remember which sites need a V1 password and which need V2?

> When sites introduce silly rules around password structure, how do you make sure your passwords conform?

Store _THESE_ rules in a central database. Not the passwords. Those rules can be public at no cost to security to the end user.

But LastPass, KeePass, OnePass and all sorts of Password generators store the actual friggen password, instead of salts or public information (like "5th password on gmail")

Re: LastPass Security Notice

#157

Post by ecdavis »

dragontamer wrote: post #134
rwhitman wrote: post #133

Earlier quoted context omitted.

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

If you wanted security, you'd use a SHA256 hash of a master-password + domain name. http://angel.net/~nic/passwdlet.html Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.

I've considered this before. It's a nice idea, but it suffers due to the arbitrary length and complexity requirements that many sites place on passwords.

Re: LastPass Security Notice

#159

Post by lost_my_pwd »

rwhitman wrote: post #133
AdmiralAsshat wrote: post #76

See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS. It also has a way better Firefox add-on than any of the others I've seen (which is my main browser), and the Android apps, if unofficial, aren't bad either [0]. Importantly, they feature the ability to either pull from a local Keepass DB or to get it from a connected Google Drive account. I've take…

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

It's a matter of target payoff. Dropbox, Drive, etc. are not specific to just storing password DBs.

If my account is compromised, the attacker has one DB for their effort. If a cloud storage is compromised, the attacker has to scan through everything looking for DB files.

LastPass cloud storage is meant only for storing password DBs, so an attacker knows that within a single target lies a large trove a specific type of data.

Re: LastPass Security Notice

#160

Post by klue07 »

pdabbadabba wrote: post #22
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

1Password can sync your passwords through WiFi [1] without going through some cloud service like Dropbox. This is the main reason I use 1Password, and it so far has met my needs. Caveat is apparently it can only sync with a single computer.

[1] https://support.1password.com/guides/mac/sync-wi-fi.html

Post reply on HN