Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

261–270 of 311 posts

Re: LastPass Security Notice

#261

Post by nrser »

PuffinBlue wrote: post #183
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

You understand that all the passwords/data are encrypted client side and only the encrypted blob is stored in the cloud? This is exactly what users of Keepass et al espouse when they talk of having their 'locally encrypted database' and syncing it over dropbox etc. You, at least, are identifying the benefit of physical security, but if we are to place any trust at all in encryption then we must accept such a scheme (…

yeah... the synchronization for these services should be zero-knowledge. though maybe not the best idea, my vault should remain secure even if available publicly, right?

sync is a must have feature for many, myself included.

Re: LastPass Security Notice

#262

Post by sekasi »

tssuser wrote: post #217
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

My solution: 3 security tiers: high (email, banking): Just memorize a unique password for each medium (sites that might have my credit card info): Lastpass + salt, which I memorize and manually insert (last pass doesn't have it) low (everything else, e.g. hacker news): I trust lastpass (w/ 2f) for these sites. I feel that this strikes a good balance between security and convenience for me, without putting too much tr…

This is identical to how I approach passwords.

Super interesting to hear I'm not alone. I'm finding it works extraordinarily well, and even in situations where my Lastpass details are compromised (like today), it's not necessarily a disaster, just an inconvenience. But in return, almost complete peace of mind and liberation from passwords.

Re: LastPass Security Notice

#263

Post by kriro »

On a related note...I'm using KeePass+Yubikey but am a bit worried that the project is still hosted on sourceforge. The devteam seems to think it's no problem at least that's the impression I get from reading the forum.

Re: LastPass Security Notice

#264

Post by skrause »

tptacek wrote: post #94
Zaheer wrote: post #10

Thoughts on LastPass vs 1Password?

I understand 1Password's security design, it makes sense to me, and it has a fairly minimal attack surface. It's not perfect, but it's a sound design of a very conventional cryptosystem. I do not understand LastPass's design; the shared authenticator/decrypting key, the website with HTML form fields for my master password, the public key crypto in Javascript with JSBN. Also, Steve Thomas doesn't like them, and found…

What I really don't like about 1Password is that they actually store an item's name and domain unencrypted in the vault:

https://discussions.agilebits.com/discussion/38180/vault-1pa...

For my taste that's already too much unencrypted info being synced over Dropbox etc, an attacker can easily see on which sites I have accounts.

Re: LastPass Security Notice

#265

Post by deciplex »

jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

Why does anyone use LastPass when KeepPass and GDrive/BTSync/SpiderOak exist?

Re: LastPass Security Notice

#266

Post by developer1 »

jjarmoc wrote: post #34
wepple wrote: post #20

Earlier quoted context omitted.

I would however appreciate more detail on the breach. This would at least give an indication of their general security posture. I'm reading this as an embarrassing security lapse in general security, so they misdirect by talking in depth about password hashing.

I would also appreciate more detail, but that shouldn't be their first priority. They note that they discovered the breach on 'Friday' so I imagine they have an ongoing Incident Response right now. They may not have or be ready to share this information at this time, and that's fine. They might be working with law enforcement, further hardening systems, and continuing to confirm their findings to date to ensure they'…

Another pain point is the delay from Friday's discovery to Monday's disclosure. While it's better than the sometimes weeks other companies have taken, it screams of the discovery happening at 4pm on a Friday, and everybody then saying "bah fuck it, go home for the weekend, we'll work on it Monday". A security compromise like this should have been made known by Saturday at the latest, and worked on over the weekend. 3 days is a long time for leaked passwords to go unnoticed to users, regardless of the encryption scheme being used.

Re: LastPass Security Notice

#267

Post by developer1 »

cheetos wrote: post #142

Slightly off-topic: am I naive to believe that my personal system of password management is just about as good something like 1Password or LastPass? Hear me out. My passwords are generated as follows: [Low|Med|Hi] + [Key] + [Initials] + [Number] Low|Med|High = One of three keys based on how sensitive the site is. High: banking / work / email, Low: I don't trust the site, Med: other. Key = Random string that only I kn…

Honestly the only problem with your scheme has been sharing it. If your hackernews account can be used to find other accounts of yours online, you've just made writing a custom brute force script for your accounts much easier.

I imagine you've done more than most people who customize passwords based on the site/domain name, but you should never share the specifics of your algorithm. It reduces brute force effort against you from nearly infinite to possibly hackable.

Re: LastPass Security Notice

#268

Post by baby »

LawnGnome wrote: post #5

I don't use LastPass, but one thing that impresses me about their blog post: they didn't hide behind "your passwords are hashed" or something equally weaselly, but instead said exactly and clearly how passwords are hashed. Every online company should take note.

well they are a "password" company. Nothing surprising here.

Re: LastPass Security Notice

#269

Post by socceroos »

PuffinBlue wrote: post #191
socceroos wrote: post #185

Earlier quoted context omitted.

ROT13 fan?

?

Encryption is as good as it's independent proofs. Even then, the proofs are only as good as the attention it gets from qualified, quality cryptographers. And again, only when used in a library that can independently prove it's algorithm and implementation is sound - open source.

For everything important, there is OTP.

Re: LastPass Security Notice

#270

Post by ascorbic »

tptacek wrote: post #81
groby_b wrote: post #63

Earlier quoted context omitted.

That means one compromised password - your master password - compromises all your sites. That's the kind of risk I can't stomach. LastPass is a huge target, yes - but (if we trust them) the data is only decrypted client side, so they have no access to it. Which means the only viable exploit is in the lastpass browser extension.

But isn't it encrypted with a secret that is also used to log into their web site, or to log into their API to recover the vault?

The password is hashed on the client side before sending to the server.
Post reply on HN