Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

171–180 of 311 posts

Re: LastPass Security Notice

#171

Post by andrewaylett »

asquabventured wrote: post #115
jjarmoc wrote: post #30

Earlier quoted context omitted.

> Maybe there are people out there who will accept much more inconvenience in exchange for avoiding the risk associated with a cloud-based service. But, for me, the inconvenience is simply too much. Sure, it's a balance everyone has to find for themselves. As you note earlier, a cloud password manager is better than shared passwords. I'm certainly happy to accept a bit more inconvenience than most. I only do banking…

A solution I have found that (I think) is relatively secure. Setup a keepass database that requires the use of an unlock password and key file. Sync the database to Google Drive but never sync the key file! Only store the keyfile on a locally ecrypted thumb drive or only stored locally on the devices (preferably encrypted) that you need to access keepass from. In random time/day intervals reset your key file and keep…

I'm concerned (but not qualified to judge) that changing your password and keyfile may not be as beneficial as it appears.

A password for an encryption key is very different to a password for a server. Once you change your password on a server, there's little harm in publishing it -- it can't be used any more. But the key is a file that may still exist (see also Wikileaks' key being published by David Leigh).

Consider: your database exists as a file. If someone is able to gain access to a copy, that copy remains valid as long as at least one password within it remains unchanged. So you need a strong key, because it's subject to offline bruteforcing. Now they get a second copy of your database, with a different password. If any of your passwords are ever published or cracked, your database is exposed. If you have to change your password regularly, it's going to be tempting to make it weaker, or to store it somewhere less securely. If you're using key files, they only need to get one of your files. It seems to me that the more key material you need to secure, the more difficult it's going to be?

Anyone who knows better want to chime in?

Re: LastPass Security Notice

#172

Post by pgrote »

I found out from an article on Lifehacker. Still have yet to get an announcement in email, extension or app from LastPass themselves.

While the blog post was nice, it would have been better to directly let subscribers know.

I am a premium subscriber with 2fa enabled.

Just received the announcement at 6:54pm CT:

Dear LastPass User,

We wanted to alert you that, recently, our team discovered and immediately blocked suspicious activity on our network. No encrypted user vault data was taken, however other data, including email addresses and password reminders, was compromised.

We are confident that the encryption algorithms we use will sufficiently protect our users. To further ensure your security, we are requiring verification by email when logging in from a new device or IP address, and will be prompting users to update their master passwords.

We apologize for the inconvenience, but ultimately we believe this will better protect LastPass users. Thank you for your understanding, and for using LastPass.

Regards, The LastPass Team

Re: LastPass Security Notice

#173

Post by _pcdx »

Hi, creator of StrongBox Password Safe (https://itunes.apple.com/us/app/strongbox-password-safe/id89...) here. I think LastPass have done a pretty good job of being upfront and honest about their techniques and have a handy little product. Comments above mention the centralised nature of storage and indeed it is an issue as it becomes a real bullseye for hackers. Ultimately it’s a tradeoff between convenience and security. For what it’s worth my app uses the standard Password Safe format (http://passwordsafe.sourceforge.net/), designed by Bruce Schneier. It can store your encrypted password databases locally on device or on Dropbox or Google Drive. This can be easily exported or imported. An added bonus is you can store other tidbits of information in there, notes of any kind, not just passwords. Might be useful for those of you with more stringent security in mind, or more general encryption requirements. It’s also free.

Re: LastPass Security Notice

#174

Post by fluidcruft »

cmdrfred wrote: post #87
AdmiralAsshat wrote: post #76

See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS. It also has a way better Firefox add-on than any of the others I've seen (which is my main browser), and the Android apps, if unofficial, aren't bad either [0]. Importantly, they feature the ability to either pull from a local Keepass DB or to get it from a connected Google Drive account. I've take…

I have a sftp account on my server for my keepass data, I can sync it from anywhere and I don't have to worry about google drive having access to my (encrypted) data. I like it.

Is there any solution for keepass on ChromeOS (I mean other than the whole developer mode/crouton thing, I prefer to keep ChromeOS in secure mode)?

Re: LastPass Security Notice

#175

Post by pieter_mj »

DoubleMalt wrote: post #138
matwood wrote: post #129

Earlier quoted context omitted.

When thinking about security who has more resources and expertise? LastPass or Google?

It depends on your threat model. If you are more afraid of the government than of a random script kiddie, the vastly bigger resources of Google do not matter as your (encrypted) database is just a NSL away. And then the NSA is trying to crack it

When you've put your passwordfile in the cloud, you should assume it's fallen into the wrong hands (NSA) already.

I've put my keepass file in the cloud for extra backup, and I know I can only rely on its cryptographic strength to keep it safe.

Re: LastPass Security Notice

#176

Post by mitchty »

nahname wrote: post #114
Zaheer wrote: post #92

Earlier quoted context omitted.

How hard was it to make the switch? I'm considering doing a switch soon if it's not too painful.

Manual, so the number of accounts will determine your pain. That said, 1Password has an OSX client + Chrome extension. Day to day is much easier to use.

Does it have extensions for safari and firefox on osx at least? Yes I use all three browsers on osx, and linux too sans safari obviously. If there is a safari extension too so my iphone can form fill too that would be good. Otherwise I'll stick to my normal new passphrase every 6 months and new passwords for each site every year approach. Tonight I'll be doing the yearly update of passwords, which is a pita but not too bad with lastpass as long as I have a show to watch.

Re: LastPass Security Notice

#177

Post by serf »

jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

Lastpass is a huge target, and while I believe they generally take reasonable security measures, for many the risk of compromise may be greater than an encrypted stand-alone password database.

Couldn't you frame that same basic belief around any large 'nearly-monolithic' web service, like Google, Apple, or Facebook?

I agree, passwords are a risky business (you're storing security tokens for other people for chrisakes), but the power that access to someones Facebook or Google account is pretty equivalent - people run their worlds on those services.

By the way, I happen to agree with your stance. We rely on singular entities far too much on the net.

Re: LastPass Security Notice

#178

Post by serf »

groby_b wrote: post #63
JadeNB wrote: post #57

Earlier quoted context omitted.

> (Though if you've found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?) I don't know if it meets but your needs, but I love PasswordMaker ( http://passwordmaker.org ). There is no need for sync'ing, because the password is generated from a master pa…

That means one compromised password - your master password - compromises all your sites. That's the kind of risk I can't stomach. LastPass is a huge target, yes - but (if we trust them) the data is only decrypted client side, so they have no access to it. Which means the only viable exploit is in the lastpass browser extension.

Not that it's a cure-all, but one probably shouldn't be using a centralized password store without some sort of multifactor authentication enabled.

Re: LastPass Security Notice

#179

Post by NeutronBoy »

cheetos wrote: post #142

Slightly off-topic: am I naive to believe that my personal system of password management is just about as good something like 1Password or LastPass? Hear me out. My passwords are generated as follows: [Low|Med|Hi] + [Key] + [Initials] + [Number] Low|Med|High = One of three keys based on how sensitive the site is. High: banking / work / email, Low: I don't trust the site, Med: other. Key = Random string that only I kn…

> What is wrong with this? What would be the advantage to using 1Password / LastPass over this?

My Keepass database currently has 221 entries in it. Some of these I only use once per year. There's no possible way for me to manage that without a program to help me record them.

Re: LastPass Security Notice

#180

Post by felickz2 »

tbabb wrote: post #166
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify/salt in a way that's predictable (to me) across sites, such that each site's credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it's simple enough to remember. I don't use any password manager, because like OP, that seems like too mu…

The flaw in your scheme lies in the fact that "it's simple enough to remember" ... this would imply that if one were to target you they could likely correlate your credentials across multiple leaked PW databases and guess at your scheme. That of coarse has plenty of assumptions...
Post reply on HN