Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

201–210 of 311 posts

Re: LastPass Security Notice

#201

Post by peteretep »

tptacek wrote: post #94
Zaheer wrote: post #10

Thoughts on LastPass vs 1Password?

I understand 1Password's security design, it makes sense to me, and it has a fairly minimal attack surface. It's not perfect, but it's a sound design of a very conventional cryptosystem. I do not understand LastPass's design; the shared authenticator/decrypting key, the website with HTML form fields for my master password, the public key crypto in Javascript with JSBN. Also, Steve Thomas doesn't like them, and found…

I also like that in an emergency I can log in to Dropbox (one of four passwords) I remember, and open the HTML 1Password implementation (another I remember), and start to reaccess my services if all my devices get stolen.

Re: LastPass Security Notice

#202

Post by ernsheong »

klue07 wrote: post #160
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

1Password can sync your passwords through WiFi [1] without going through some cloud service like Dropbox. This is the main reason I use 1Password, and it so far has met my needs. Caveat is apparently it can only sync with a single computer. [1] https://support.1password.com/guides/mac/sync-wi-fi.html

Unfortunately I can't use 1Password at work because it doesn't have a browser client, and I can't install anything I like on my computer (corporate). Sticking to Dashlane for now.

Re: LastPass Security Notice

#203

Post by rwhitman »

lost_my_pwd wrote: post #159
rwhitman wrote: post #133

Earlier quoted context omitted.

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

It's a matter of target payoff. Dropbox, Drive, etc. are not specific to just storing password DBs. If my account is compromised, the attacker has one DB for their effort. If a cloud storage is compromised, the attacker has to scan through everything looking for DB files. LastPass cloud storage is meant only for storing password DBs, so an attacker knows that within a single target lies a large trove a specific type…

There are several ways to expose data on dropbox as the result of human error that don't apply to lastpass

Re: LastPass Security Notice

#204

Post by snarfy »

tbabb wrote: post #166
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify/salt in a way that's predictable (to me) across sites, such that each site's credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it's simple enough to remember. I don't use any password manager, because like OP, that seems like too mu…

If your password for foo.com is foo-hunter2-XYZ and your password for bar.com is bar-hunter2-XYZ, you've got problems.

Re: LastPass Security Notice

#205

Post by AdamGibbins »

dragontamer wrote: post #189
ecdavis wrote: post #157

Earlier quoted context omitted.

I've considered this before. It's a nice idea, but it suffers due to the arbitrary length and complexity requirements that many sites place on passwords.

I've actually got a very basic solution to that. Use lowercase hexadecimal as the "baseline" password. From there, truncate to the length requirement, and add symbols to the end to guarantee complexity requirement. For example, "masterpass gmail.com" will md5sum to "194b52e5". If a password requires symbols, add a "!" to the end. If it requires a capitol letter, add "A" to the end. Add in the order of "number->letter…

That does't sound simple, because I'm not going to remember the site specific password requirements for each of the 250 logins I have within my password manager.

Re: LastPass Security Notice

#206

Post by archinal »

snarfy wrote: post #204
tbabb wrote: post #166

Earlier quoted context omitted.

My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify/salt in a way that's predictable (to me) across sites, such that each site's credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it's simple enough to remember. I don't use any password manager, because like OP, that seems like too mu…

If your password for foo.com is foo-hunter2-XYZ and your password for bar.com is bar-hunter2-XYZ, you've got problems.

But if your password for foo.com is 10,000 rounds of PBKDF2-SHA256(foo-hunter2-XYZ) and so on, this is extremely effective.

Re: LastPass Security Notice

#207

Post by arikrak »

cheetos wrote: post #142

Slightly off-topic: am I naive to believe that my personal system of password management is just about as good something like 1Password or LastPass? Hear me out. My passwords are generated as follows: [Low|Med|Hi] + [Key] + [Initials] + [Number] Low|Med|High = One of three keys based on how sensitive the site is. High: banking / work / email, Low: I don't trust the site, Med: other. Key = Random string that only I kn…

I tried a system like this for a while, but it became too complicated to keep track of. How to classify a website? What happens when one site gets hacked? Etc...

Re: LastPass Security Notice

#208

Post by AdmiralAsshat »

fluidcruft wrote: post #174
cmdrfred wrote: post #87

Earlier quoted context omitted.

I have a sftp account on my server for my keepass data, I can sync it from anywhere and I don't have to worry about google drive having access to my (encrypted) data. I like it.

Is there any solution for keepass on ChromeOS (I mean other than the whole developer mode/crouton thing, I prefer to keep ChromeOS in secure mode)?

For my Chromebook, I use a chrome app called Browsepass. It's still pretty rough, but it at least lets me open the KeePass database:

https://chrome.google.com/webstore/detail/browsepass/pihdapf...

Re: LastPass Security Notice

#209

Post by mynameisvlad »

snarfy wrote: post #204
tbabb wrote: post #166

Earlier quoted context omitted.

My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify/salt in a way that's predictable (to me) across sites, such that each site's credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it's simple enough to remember. I don't use any password manager, because like OP, that seems like too mu…

If your password for foo.com is foo-hunter2-XYZ and your password for bar.com is bar-hunter2-XYZ, you've got problems.

He never said it was. It could be something like etc.

Just because it's predictable to him does not mean it's predictable to all. There are ways of keeping predictability while still obscuring it from everyone else.

Re: LastPass Security Notice

#210

Post by aembleton »

klue07 wrote: post #160
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

1Password can sync your passwords through WiFi [1] without going through some cloud service like Dropbox. This is the main reason I use 1Password, and it so far has met my needs. Caveat is apparently it can only sync with a single computer. [1] https://support.1password.com/guides/mac/sync-wi-fi.html

Doesn't seem to be anyway to run it on Linux.
Post reply on HN