Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

241–250 of 311 posts

Re: LastPass Security Notice

#241

Post by wstrange »

throwaway562167 wrote: post #238
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

Here's my solution: 1. Think of a 'stock phrase' that is simple for me to remember but likely to be unique, such as "angry dogs never jump for joy". 2. Write a simple program to generate 4 words at random, so it might generate "led show joke via" or "dean rock ranch ocean". 3. Generate a password by concatenating first letters of the stock phrase, the first two letters of the site name and the 4 random words. So the…

Interesting - but you know this isn't going to work for 99.9% of the population.

Re: LastPass Security Notice

#242

Post by x3n0ph3n3 »

newman314 wrote: post #198
rwhitman wrote: post #133

Earlier quoted context omitted.

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

Dropbox is not the only option. While not officially supported, I sync 1Password just fine using BTSync in local mode (no tracker, no relay). Sure, it's kind of a pain (I can only sync on my home network) but worth the trade off to me. I mean how often do you have to sync passwords?

Consider using dynamic DNS for a central home server and predefined hosts in your mobile devices or laptops.

Re: LastPass Security Notice

#243

Post by wstrange »

Time to kill the password.

Federated login using OpenID Connect seems like a far better solution. I can't fathom why so many web sites want the awful responsibility of storing your password. Why not leave that to Google, Facebook or Microsoft? Or you bank for that matter...

And yes - you should secure your IDP login with multi-factor authentication.

Re: LastPass Security Notice

#244

Post by pyre »

tbabb wrote: post #166
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify/salt in a way that's predictable (to me) across sites, such that each site's credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it's simple enough to remember. I don't use any password manager, because like OP, that seems like too mu…

On the other hand, in the even of your untimely demise, your friends/family may end up in a bit of a pickle without access to some of your accounts. Granted, this is of less concern if you're single and without kids.

Re: LastPass Security Notice

#245

Post by tbabb »

jjoonathan wrote: post #239
tbabb wrote: post #166

Earlier quoted context omitted.

My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify/salt in a way that's predictable (to me) across sites, such that each site's credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it's simple enough to remember. I don't use any password manager, because like OP, that seems like too mu…

Just how long have you kept this up? When I gave it a go, the sites which didn't accept the base+permutation approach stacked up quickly. Some mandated a length which was too short, some mandated a length which was too long, some required certain special characters, others forbade the same, some required multiple separate passwords (i.e. security questions or pins), some just gave me a password and didn't let me chan…

I've found a length of password that covers probably 85-90 percent of my accounts, and is a good tradeoff between security and portability. Most sites accept special characters, and the ones that don't also tend to be the same ones that have retarded length restrictions. Ironically these tend to be banks, who should know better!

The small subset of sites that don't fit into the scheme get one from a pool of fixed passwords that I just remember-- so if I forget, I just try from the pool until I get in. Or reset, but that happens rarely enough that it's no big deal.

IMO there should be federal regulation about password handling which would render that problem moot: There should be no length restriction, no special character restriction, no storage in plaintext, and mandatory salting. It's arguably a national security issue.

Re: LastPass Security Notice

#246

Post by magoon »

iCloud Keychain doesn't store your passwords on Apple-controlled servers when you do not configure an iCliud Keychain storage PIN; you can use it in a mode that simply syncs keychains across devices, all of which allow password-based encryption.

Re: LastPass Security Notice

#247

Post by archinal »

click170 wrote: post #220
archinal wrote: post #206

Earlier quoted context omitted.

But if your password for foo.com is 10,000 rounds of PBKDF2-SHA256(foo-hunter2-XYZ) and so on, this is extremely effective.

Only as long as you can keep your permutation process secret. The problem with using any standard algorithm like that is that the algorithm becomes your password.

> The problem with using any standard algorithm like that is that the algorithm becomes your password.

That's not true at all. The press released linked in this thread, for example, is very open that they use 100,000 rounds of PBKDF2-SHA256 to encrypt their passwords. That's a very standard algorithm. The security it provides is not its obscurity, but rather that the only way to check against an output hash is the naive brute force method which takes a long time - impractically long for attackers to try to brute force.

Re: LastPass Security Notice

#248

Post by SN76477 »

throwaway562167 wrote: post #238
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

Here's my solution: 1. Think of a 'stock phrase' that is simple for me to remember but likely to be unique, such as "angry dogs never jump for joy". 2. Write a simple program to generate 4 words at random, so it might generate "led show joke via" or "dean rock ranch ocean". 3. Generate a password by concatenating first letters of the stock phrase, the first two letters of the site name and the 4 random words. So the…

Creating passwords and such is never a problem for me. The problem is when I have to constantly reset passwords due to this, or that reason.

Re: LastPass Security Notice

#249

Post by bradknowles »

ernsheong wrote: post #202
klue07 wrote: post #160

Earlier quoted context omitted.

1Password can sync your passwords through WiFi [1] without going through some cloud service like Dropbox. This is the main reason I use 1Password, and it so far has met my needs. Caveat is apparently it can only sync with a single computer. [1] https://support.1password.com/guides/mac/sync-wi-fi.html

Unfortunately I can't use 1Password at work because it doesn't have a browser client, and I can't install anything I like on my computer (corporate). Sticking to Dashlane for now.

1Password has integration with Firefox, Safari, Chrome, and presumably also IE.

They don't build their own browser into which their tool is built, no.

They don't provide you a browser-only solution like LastPass, no.

But they do fully integrate with most of the common browsers.

Re: LastPass Security Notice

#250

Post by anon3_ »

pdabbadabba wrote: post #22
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

> But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it.

Correct me if I'm wrong, I read this as if you're equating hacking a frequented website (and password) as hijacking a % of someone's accounts, if they use the pw there.

Random websites don't know about the other accounts you own, let alone the user ID and password them (if that same pw cracked is workable on the other service).

LastPass, or any cloud password service, has to store the relation between the service, your username for it, along with the password. That is global ownage.

Find my password on some irrelevant site, you may not even be able to link it back to me. If so, that doesn't mean you know which services I'm signed up to, let alone my user ID or password.

Post reply on HN