Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

281–290 of 311 posts

Re: LastPass Security Notice

#281

Post by PuffinBlue »

socceroos wrote: post #269
PuffinBlue wrote: post #191

Earlier quoted context omitted.

?

Encryption is as good as it's independent proofs. Even then, the proofs are only as good as the attention it gets from qualified, quality cryptographers. And again, only when used in a library that can independently prove it's algorithm and implementation is sound - open source. For everything important, there is OTP.

You're stating truisms really. And you trust OTP (quite rightly) - ergo you trust encryption. My personal trust point is properly implemented AES-256 with a slow hashing function.

Re: LastPass Security Notice

#282

Post by PuffinBlue »

deciplex wrote: post #265
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

Why does anyone use LastPass when KeepPass and GDrive/BTSync/SpiderOak exist?

I use LastPass and KeePass extensively in the setup you outline.

Why do people use LastPass? Convenience, and you aren't really gaining any extra security (except through obscurity) when using those other services.

LastPass encrypts and decrypts client side, their cloud only synchronises the encrypted blob. This is what is happening in the KeePass + Cloud service scenario too.

You gain a little security through obscurity as you'd probably need to be attacked as an individual, but mass breaches are not unknown (Dropbox for example) and at that point you have no more security than LastPass.

KeePass does have the keyfile feature, which is a particularly nice version of two-factor authentication, but LastPass offers various options - including One Time Passwords (Sesame), YubiKey and even good old fashioned offline paper grid method (arguably more secure as you have a an air-gapped authentication method).

LastPass has fantastic apps and plugins that make using unique high entropy random strings for your online accounts absolutely painless. The plugins are better and more widely available than the KeePass versions.

I've said it in another comment, but it comes down to trust in the encryption method. If the method is properly implemented then the overall scheme is secure (save for other attacks like keyloggers which both would be susceptible to).

Re: LastPass Security Notice

#283

Post by pckspcks »

_pcdx wrote: post #173

Hi, creator of StrongBox Password Safe ( https://itunes.apple.com/us/app/strongbox-password-safe/id89... ) here. I think LastPass have done a pretty good job of being upfront and honest about their techniques and have a handy little product. Comments above mention the centralised nature of storage and indeed it is an issue as it becomes a real bullseye for hackers. Ultimately it’s a tradeoff between convenience and s…

I like Bruce. I trust Bruce. However, as far as I can tell, this is a black box. There is no documentation on formats, protocols, and similar. I have no reason to trust the security of this system. The closest I could come would be to read the source code.

Re: LastPass Security Notice

#285

Post by deciplex »

PuffinBlue wrote: post #282
deciplex wrote: post #265

Earlier quoted context omitted.

Why does anyone use LastPass when KeepPass and GDrive/BTSync/SpiderOak exist?

I use LastPass and KeePass extensively in the setup you outline. Why do people use LastPass? Convenience, and you aren't really gaining any extra security (except through obscurity) when using those other services. LastPass encrypts and decrypts client side, their cloud only synchronises the encrypted blob. This is what is happening in the KeePass + Cloud service scenario too. You gain a little security through obscu…

Ah, I did not realize LastPass had a client which did the encryption and decryption locally. Thanks for clarifying. Is the client open-source?

Re: LastPass Security Notice

#287

Post by PuffinBlue »

deciplex wrote: post #285
PuffinBlue wrote: post #282

Earlier quoted context omitted.

I use LastPass and KeePass extensively in the setup you outline. Why do people use LastPass? Convenience, and you aren't really gaining any extra security (except through obscurity) when using those other services. LastPass encrypts and decrypts client side, their cloud only synchronises the encrypted blob. This is what is happening in the KeePass + Cloud service scenario too. You gain a little security through obscu…

Ah, I did not realize LastPass had a client which did the encryption and decryption locally. Thanks for clarifying. Is the client open-source?

Therein lies the rub, I don't think it is - the main plugins aren't anyway. There is an open source CLI version though [1].

So it's on trust.

I trust them to have correctly implemented it based on the logic that their entire business' existence is build on the security of the platform.

If it fails, they fail, so I trust them to have put the work in and to do continual monitoring.

I have to trust KeePass too, I don't have the skill to audit it myself and the fact it's Open-Source is no guarantee of security (Heartbleed anyone?) so it's all about where your trust point/compromise lies.

[1] https://blog.lastpass.com/2014/10/open-sourced-lastpass-comm...

Re: LastPass Security Notice

#288

Post by _pcdx »

pckspcks wrote: post #283
_pcdx wrote: post #173

Hi, creator of StrongBox Password Safe ( https://itunes.apple.com/us/app/strongbox-password-safe/id89... ) here. I think LastPass have done a pretty good job of being upfront and honest about their techniques and have a handy little product. Comments above mention the centralised nature of storage and indeed it is an issue as it becomes a real bullseye for hackers. Ultimately it’s a tradeoff between convenience and s…

I like Bruce. I trust Bruce. However, as far as I can tell, this is a black box. There is no documentation on formats, protocols, and similar. I have no reason to trust the security of this system. The closest I could come would be to read the source code.

Sorry, should have mentioned a bit about that. The Password Safe format is public, open, and available here [1]. There's also plenty of code/libraries you can use to write your own clients, e.g. Javascript [2], Java [3], Python [4]. For what it's worth the core data encryption is done using the Twofish cipher. Hope that helps.

[1]: http://sourceforge.net/p/passwordsafe/git-code/ci/master/tre...

[2]: https://github.com/scintill/pwsafejs

[3]: http://sourceforge.net/projects/jpwsafe/

[4]: https://github.com/ronys/pypwsafe

Re: LastPass Security Notice

#289

Post by MaxGhost »

jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

An offline alternative with tons of features (still mostly in development but available for purchase and support): https://www.password-injector.com/

Re: LastPass Security Notice

#290

Post by cmorelli »

pdabbadabba wrote: post #22
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

This reinforces the general problem that strings of characters are bad candidates for authentication. Users generally fit into two categories: those who will use the same password for everything, and those who won't. The latter half is the more technically savvy - which means they were likely to take the appropriate steps, read the appropriate news, and protect themselves against most classes of attacks. In short: the people who are likely the most vulnerable are also the ones that are least equipped to do anything about it.

It's a general problem with username/passwords as authentication and I think this is an interesting space for new start ups and service providers. Even with standards like FIDO, companies will want to be able to integrate it easily into their systems. The faster we can just kill passwords, the better.

Post reply on HN