Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

101–110 of 326 posts

Re: LastPass users warned their master passwords are compromised

#101

Post by tuwtuwtuwtuw »

latortuga wrote: post #47

This has to be a security issue with LastPass, right? Something like an as-yet unidentified usage of Log4j. > Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. This sounds to me like either a widely-compromised browser extension (LP itself?) or LP infrastructure.

Or just some malware like the latest keyloggers bundled with NPM packages? Wasn't it just a couple of weeks since that happened previous time?

Re: LastPass users warned their master passwords are compromised

#102

Post by causality0 »

civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

Not that your approach doesn't have advantages, but at that point I would just keep them in a paper notebook hidden in my desk.

Re: LastPass users warned their master passwords are compromised

#103

Post by foxfluff »

gkoberger wrote: post #35

This is framed so negatively toward LastPass, which is unfortunate. They stopped all usage of correct passwords they believed were compromised, which is exactly what I'd want them to do in this situation. Them warning users their master passwords are compromised is a good thing! Yet it's framed as though they're admitting to something. "However, users receiving these warnings have stated that their passwords are uniq…

It's negative because something's up and they haven't given a good explanation.

> They stopped all usage of correct passwords they believed were compromised

Immediate question: how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? From the information provided, the only thing they have is the IP & geolocation data, which isn't going to be reliable when the attacker(s) are using VPNs. For everyone whose account was protected by blocking access from odd region, how many are there whose accounts were quietly accessed and no email was shot off to warn the owner?

They are claiming that the master password was used on some other (compromised) service, but they provide zero evidence for this. And if they don't know your passwords, how on earth do they know that you've reused them on a compromised service? Can they name that service? Has anyone yet found a service every affected user has in common? I haven't seen that.

> "However, users receiving these warnings have stated that their passwords are unique to LastPass and not used elsewhere." That's really hard to verify.

That is true, but there are so many reports now that it's really hard for me to believe they were all dumb enough to reuse their master passwords elsewhere and are also bullshitting us on HN.

> I haven't seen any indication at this point that LastPass has been compromised at all.

Neither have I, but I still believe it to be a plausible explanation. I don't think we have a "smoking gun" or a site/service/extension that is common to everyone who reported this thing happening to them.

Re: LastPass users warned their master passwords are compromised

#105

Post by civilized »

causality0 wrote: post #102
civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

Not that your approach doesn't have advantages, but at that point I would just keep them in a paper notebook hidden in my desk.

I'm a lazy bastard.

Re: LastPass users warned their master passwords are compromised

#106

Post by civilized »

kalekold wrote: post #98
civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

I do the same and encrypt the file with a simple encryption tool.

Good idea. I wish I could be bothered to do this slightly more secure thing to protect my entire livelihood, lol... I'll think about it.

Re: LastPass users warned their master passwords are compromised

#107

Post by onlyrealcuzzo »

civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

You could just use KeePass: https://keepass.info/

It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely.

And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

Re: LastPass users warned their master passwords are compromised

#108

Post by throw10920 »

junon wrote: post #66
_jal wrote: post #51

Earlier quoted context omitted.

Nope. Keeping my secrets store on someone else's computer is simply not compatible with my threat model. Yes, they say it is encrypted, and I believe them and believe they're competent. But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.

1password has been audited a bazillion times. They're E2EE. They're cheap. Your master passwords aren't stored on their servers. Neither is your key information. The only thing I pay for is the managed hosting, but in theory it's not much different than anything else properly designed (e.g. bitwarden) aside from the obvious things, such as OSS-ness. The only relevant CVEs are relatively mild compared to LastPass. Giv…

> Your master passwords aren't stored on their servers. Neither is your key information.

...and, those are the only things that really matter for an attacker. Encrypted data (assuming reasonably strong encryption) is useless without the key.

Re: LastPass users warned their master passwords are compromised

#109

Post by tgsovlerkhgsel »

samtho wrote: post #90
yawaworht1978 wrote: post #74

Earlier quoted context omitted.

Wow, how can this amount of files be justified? And how did this breached exactly happen?

> Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.

"total of 25MB of javascript" is a good metric of the complexity of the application's code, and correspondingly the difficulty of auditing it (I'd say 25 MB of JS code make it infeasible).

Re: LastPass users warned their master passwords are compromised

#110

Post by koprulusector »

I use LastPass - have been using it for years, and I'm pretty happy with it. I'm even happier now that they're going to be an independent company, no longer owned by "LogMeIn123" lol. But incidents like this don't bother me, because I require yubikey MFA. In fact, password breaches rarely bother me anymore, unless there's a rare case where I have an account on a site that doesn't allow me to use MFA.
Post reply on HN