Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass’ Authenticator app is not secure

medium.com

Post reply on HN
Print view View original

101–110 of 118 posts

Re: LastPass’ Authenticator app is not secure

#101

Post by balladeer »

darrmit wrote: post #3

I can’t figure out why LastPass is still so popular. Ease of use since it’s completely browser based? They were early to market? I don’t get it. So many better designed, more secure options out there. KeePass, Bitwarden, or 1Password to name a few.

KeePass is anything but user friendly or convenient - it involves a lot of tinkering and not a lot of people have time, patience, or even know-how for that.

1Password has ignored every other platform other than the fruit company ecosystem for a really long time now.

Bitwarden comes close. OSS, polished, and seemingly with a business model. After checking on Firefox (on Linux), iOS, and Android apps when I wanted to install it on my Mac I found out its Safari extension doesn't exist and the Github issue is clear that they will not be working on that anytime soon [0]. Also, I read a reddit comment that there is only one full time developer and this was just few weeks ago[1]. Now I know it's an open source project but I want to use a service that is really ready to be used for my password management while I want to pay for it.

LastPass is everywhere - Windows, Linux, Mac, Chrome, Ff, Safari, IE, iOS, Android. You name it. And it has been on these various platforms since long. Sync, client side encryption, easy import from other apps, good extensions, decent support ticket TATs (even for free accounts), continuous development (however I must add that they have started to add bloat and useless gloss after the sale) - have really been consistent. This is what makes it a favourite option.

So when you say "better designed" I assume you mean better security architecture/design and yes the reason for its popularity is indeed ease of use with acceptable security for the most. I have really tried all other apps out there and for some reason or the other I keep coming back to LastPass.

[0] https://github.com/bitwarden/browser/issues/17

[1] https://www.reddit.com/r/Bitwarden/comments/7htswv/how_many_...

Re: LastPass’ Authenticator app is not secure

#103

Post by banachtarski »

scarhill wrote: post #73
banachtarski wrote: post #67

Earlier quoted context omitted.

Now I'm confused. It says it in the title? Where might the confusion stem from?

If people don't know that LastPass has a 2FA app, they might think LastPass Authenticator is the password manager app, and is affected by this bug. As a matter of fact, a number of commenters seem to think exactly that.

Right but I guess to me "password management" and "authentication" are two entirely separate concepts (i.e. authorization vs authentication being separate English words).

I can authorize someone to do something. I authenticate that a person is who he or she claims to be.

Re: LastPass’ Authenticator app is not secure

#104

Post by strictnein »

larvaetron wrote: post #95
strictnein wrote: post #24

Earlier quoted context omitted.

The article whose "exploit" requires handing your unlocked phone to someone?

> (Edit #1, 7.30pm GMT): A lot of people are saying that this flaw requires physical access. However, as I pointed out above, you don’t need physical access, a maliciously installed application can easily access the activity and capture the code.)

So you don't need physical access you just need to install a malicious application? Okay then.

Why can one application even explore and access the views of another?

Re: LastPass’ Authenticator app is not secure

#105

Post by Belphemur »

banachtarski wrote: post #103
scarhill wrote: post #73

Earlier quoted context omitted.

If people don't know that LastPass has a 2FA app, they might think LastPass Authenticator is the password manager app, and is affected by this bug. As a matter of fact, a number of commenters seem to think exactly that.

Right but I guess to me "password management" and "authentication" are two entirely separate concepts (i.e. authorization vs authentication being separate English words). I can authorize someone to do something. I authenticate that a person is who he or she claims to be.

The combo username password authenticate the person as much as it authorize them to access the service.

Different meaning but connected nonetheless.

Re: LastPass’ Authenticator app is not secure

#106

Post by ufmace »

corobo wrote: post #100
scarhill wrote: post #76

Earlier quoted context omitted.

Except there is no forum login page, just a SAML redirect to their SSO login.

Modify login page to have a login form

At that point, it gets a little silly honestly. If you can modify the login page to have a login form, then you can also modify it to bypass any type of security system you could ever dream up. The GP here seems to want the support forum to have an independent password. Even if they did that, if we're completely changing the login form, you could change it to say "due to new security features, you now log into our forum using your master password, please enter it below". So exactly what is it that they should do, and how would that be more secure than what they're doing now?

Re: LastPass’ Authenticator app is not secure

#107

Post by MBCook »

Someone1234 wrote: post #81
MBCook wrote: post #31

Earlier quoted context omitted.

iCloud Keychain does, and it’s free, but obviously it’s limited to Macs and iOS devices.

iCloud Keychain doesn't work with all apps or even all browsers, when it doesn't there's no trivial way of copying in a password, it isn't cross-platform, and you cannot import or export existing passwords. I consider the other products listed as actual competitors of Lastpass, I don't even rank iCloud Keychain that high, it lacks even basic features.

Copying a password isn’t that hard, you can get to it through keychain or the password section in iOS Settings.

It’s definitely not cross platform, but that’s to be expected from an Apple product.

Doesn’t support other browsers? I suppose, but for me and many other people that’s not an issue.

It works fine in for many individuals I think they could consider it a competitor. It’s certainly not an answer for MOST people, but if you’re in the right group it works great.

Re: LastPass’ Authenticator app is not secure

#108

Post by ufmace »

david-cako wrote: post #62
UncleMeat wrote: post #53

Earlier quoted context omitted.

This "problem" has precisely nothing to do with open source vs closed source. "Tell me the list of activities that are public" and "tell me the name of each activity as I launch it" are babies-first-app-analysis level and work equally well on open and closed source apps. Are we really concerned about an exploit that requires somebody to have unlocked access to your phone?

I'm not saying that's the problem, I'm just suggesting that you have to have a lot of faith in a company to trust it with all of your passwords, especially when there's only a handful of eyes on its source code. It's not for me, personally. And yes, because the scariest aspect of password managers is the fact that you have basically shifted the responsibility of "I use the same password everywhere" to a different par…

Given the recent number of cripplingly awful security bugs that have been found in open-source infrastructure projects (Shellshock, Heartbleed, etc) which have been in the wild for many years before being discovered, I'm rather less interested in arguments that open-source software is supposedly more secure than closed-source due to the number of eyes that are supposedly on it. When was the last time there were any security flaws of that magnitude in the Windows Server/IIS stack?

The reality seems more like that even if anybody can look at the code, auditing security code well is damn hard, very few people can do it well, and those people basically never audit open-source projects in their spare time. How secure something is depends more on how battle-tested it is, how good the people who wrote it are, and how well and often it's been tested for security flaws by experts.

Re: LastPass’ Authenticator app is not secure

#109

Post by ufmace »

zupzupper wrote: post #65

LastPass produces two apps, the Password Manager and this Authenticator App, which looks like a 2FA competitor to Google Authenticator. The bug the article is detailing is in the Authenticator application, not the Password Manager application, which wasn't very clear to me on my first read.

Thanks for the clarification. This reveals a couple of other points.

This flaw is that the fingerprint/PIN auth for their TOTP authenticator app can be bypassed by manually launching one of the app's activities. This is a separate auth layer over the phone's screen lock. The first exploit path here is thus that if a malicious user gets access to your unlocked phone, they could install one of these activity opener utilities and access this app's TOTP code screen. That gets them the current TOTP codes, but not the secret for generating them. Note that this is currently the security level that Google's Authenticator app already has.

The other, which I'm a little less clear on, is that a malicious app gets installed somehow, it launches the activity, and manipulates the UI to hit the buttons and read the screen to get your current TOTP codes. I think Android apps' abilities along these lines have changed around several times between Android versions, and I'm not sure which version does what, but I think the current version requires the user to set a special checkbox in settings for an app to be able to do these things. If you can get a user to do that for your malicious app, it can do all sorts of bad things.

In both cases, the attacker would be getting current codes, not the secret, which would still be locked away safely in the app's storage. So while this flaw is kind of bad and should be fixed, it doesn't have me running for the hills, esp. since I don't even use this app.

Re: LastPass’ Authenticator app is not secure

#110

Post by chocolatkey »

scarhill wrote: post #71

As it happens, I switched from Google Authenticator to LastPass Authenticator a few days ago. The app has a feature that allows you to require a PIN or fingerprint in order to use it. That feature is disabled by default. (Note that Google Authenticator has no such feature.) As I understand it, this attack allows someone with access to my unlocked phone to install a activity launcher app and then generate 2FA codes wi…

LineageOS users can enable Privacy Guard to protect google authenticator, which requires device credentials (pattern, finger etc.) to start app. Also don't put it on your homescreen
Post reply on HN