LastPass Security Notice • Hacker News Board

Re: LastPass Security Notice

#291

Post by lost_my_pwd » Tue, Jun 16, 2015, 12:44 PM UTC

savanaly wrote: post #168

lost_my_pwd wrote: post #159

Earlier quoted context omitted.

It's a matter of target payoff. Dropbox, Drive, etc. are not specific to just storing password DBs. If my account is compromised, the attacker has one DB for their effort. If a cloud storage is compromised, the attacker has to scan through everything looking for DB files. LastPass cloud storage is meant only for storing password DBs, so an attacker knows that within a single target lies a large trove a specific type…

I don't understand this. So LastPass could increase their security by including a bunch of pictures of puppies in their folder for me? Why not do it then?

If one were looking to steal a bunch of jewelry, would it make more sense to hit a jewelry store or some large shopping mall?

Re: LastPass Security Notice

#292

Post by hawkes » Tue, Jun 16, 2015, 1:00 PM UTC

I've learnt a lot reading this thread. Thank you all.

But I can't believe almost everyone here, talking about security, is talking about Dropbox even as a hypothetical cloud option for storing password related info.

- Dropbox (and most of the other cloud storage services) do not encrypt your data, or if they do now as they claim, with SHA256, I'd say they must be able to decrypt it whenever they want to, as they give you the "Did you forgot your password" option to change it, so they have to be able to decrypt it and encrypt it with your new password o whatever they use to encrypt) and they hired ¡Condoleeza Rice! for their board of executives (she puts "national security" over any privacy so...), so you can count any worker at Dropbox can peep at everything you upload whenever they want to.

Of course you'll think: "I'm not a terrorist, I don't care." Well, if a worker can take a look, and you don't even know him... The threat is quite clear to me.

MEGA, for example, does encrypt everything you upload taking as seed some derivation of your password, but they DO NOT store your password, so they can't ever decrypt it for themselves. Probably no one could know even the names of the files you have uploaded unless they already had your password (of course, if you lose it, you lose all of the files uploaded!!! Beware!!!).

I rather trust MEGA than Condoleeza's (big-brother government) Dropbox, seriously.

There must be other cloud storage services which encrypt data not storing enough info to decrypt it without your input. I just stumbled upon MEGA and liked the synch app.

Re: LastPass Security Notice

#293

Post by hawkes » Tue, Jun 16, 2015, 1:11 PM UTC

PuffinBlue wrote: post #282

deciplex wrote: post #265

Earlier quoted context omitted.

Why does anyone use LastPass when KeepPass and GDrive/BTSync/SpiderOak exist?

I use LastPass and KeePass extensively in the setup you outline. Why do people use LastPass? Convenience, and you aren't really gaining any extra security (except through obscurity) when using those other services. LastPass encrypts and decrypts client side, their cloud only synchronises the encrypted blob. This is what is happening in the KeePass + Cloud service scenario too. You gain a little security through obscu…

My problem with LastPass is that the Android app is not for free (ok to me) but I find the price too high (I haven't compared with others and Spain economy is right now pure shit, just my situation).

That's the only reason I'm gradually moving to localy stored Keeper.

Re: LastPass Security Notice

#294

Post by hawkes » Tue, Jun 16, 2015, 1:28 PM UTC

maccam94 wrote: post #47

TheSwordsman wrote: post #29

Earlier quoted context omitted.

Dropbox doesn't encrypt files, AFAIK.

- Dropbox files at rest are encrypted using 256-bit Advanced Encryption Standard (AES). - Dropbox uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit between Dropbox apps and our servers; it's designed to create a secure tunnel protected by 128-bit or higher Advanced Encryption Standard (AES) encryption. Source: https://www.dropbox.com/help/27

But don't they provide the "I forgot my password" option?? Doesn't that mean tjey have enough info to decrypt your data whenever thy want to, let you change your password, and encrypt it again with that new one??? Looks like the same problem to me in the fact that any Dropbox worker can take anything you upload. Moreover, Condoleza Rice hired??! Wtf.

Re: LastPass Security Notice

#295

Post by hawkes » Tue, Jun 16, 2015, 1:48 PM UTC

sroerick wrote: post #170

No mention of pass? http://www.passwordstore.org/ gpg password storage. Synchronization with rsync. Beats the heck out of proprietary cloud hosted software.

Thank you for sharing.

Re: LastPass Security Notice

#296

Post by ocdtrekkie » Tue, Jun 16, 2015, 1:48 PM UTC

zaroth wrote: post #277

ocdtrekkie wrote: post #193

Earlier quoted context omitted.

Yes, and I'd consider Google, Apple, and Facebook huge targets with major compromise risk as well. People tell me Google security is absolutely without equal, but when it's hacked, I, for one, will be unsurprised. With cloud services hacks, there is no "if"s, only "when"s.

What do you mean "when"? Google was hacked quite thoroughly by China a few years past. Not to mention the NSA.

How about... "when" it'll happen again then. ;)

Re: LastPass Security Notice

#297

Post by cmdrfred » Tue, Jun 16, 2015, 2:20 PM UTC

AdmiralAsshat wrote: post #119

tokenizerrr wrote: post #98

Earlier quoted context omitted.

Which extension do you use for that?

He might be using the IOProtocol Extension: http://keepass.info/plugins.html#ioprotocolext

That's the one.

Re: LastPass Security Notice

#298

Post by mynameisvlad » Tue, Jun 16, 2015, 2:21 PM UTC

dzhiurgis wrote: post #235

archinal wrote: post #206

Earlier quoted context omitted.

But if your password for foo.com is 10,000 rounds of PBKDF2-SHA256(foo-hunter2-XYZ) and so on, this is extremely effective.

Yeah that would be nice. I actually think browsers should have this as a feature. But the problem is that not all websites accept long passwords. My bank wouldn't take longer than 8 characters and doesn't even have a second factor auth. Office 365 wouldn't accept more than 16 characters. I think it was Paypal who wouldn't take more than 10.

Be happy, one of my banks has a 6-digit numeric PIN (I shit you not) as their "security".

Re: LastPass Security Notice

#299

Post by spacko » Tue, Jun 16, 2015, 2:34 PM UTC

Schneier's Password Safe is the real deal:

http://passwordsafe.sourceforge.net/

I use it on:

- Ubuntu

- Windows

- Android

Synchronisation of the password db files is accomplished by storing a master file on Google Drive (Multi-Fac Auth here). I only change passwords on Ubuntu - upload to Drive and download to Android and Company.

Re: LastPass Security Notice

#300

Post by omouse » Tue, Jun 16, 2015, 2:41 PM UTC

jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

I use Keepassx and the only thing I use the cloud for is to store the password file which is encrypted by either a pass phrase or key file. LastPass always struck me as a dumb thing to use.

The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised.

Great so maybe you can't attack the stolen hashes (at least not all of them) but you can use this information for social engineering which narrows things down.

In my case, you'd have to break into SpiderOak and steal the passwords.kdb file and attack the hash, but at least that would only attack my passwords; you wouldn't have a target-rich environment.