Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did LastPass master passwords get compromised?

palant.info

Post reply on HN
Print view View original

101–110 of 189 posts

Re: How did LastPass master passwords get compromised?

#101

Post by InspiredIdiot »

palant wrote: post #69
kurthr wrote: post #18

Earlier quoted context omitted.

You say that the LastPass protocol is subject to hash replay attacks (my description). I'd be surprised if there wasn't some time dependent pepper (e.g. challenge/response) in the hash, since this seems like a huge vulnerability, and storage of the hash allows for off-line attacks. Normally, I'd think diffie-hellman for this.

No, there is nothing. The complication with challenge/response schemes is that the server doesn’t know the master password – it only has that one hash, so it’s always comparing against it. There are PAKE protocols which work around this issue, but LastPass didn’t implement any of them (probably for historical reasons already, I think LastPass is older than most of these approaches). Normally, it isn’t such a huge vul…

Can you explain how PAKE would help here? Going just off Wikipedia, it is a key-establishment protocol "based only on their knowledge of a shared password". So I would expect that the shared password is the master password or its hash and the parties are the user and the LP server. So wouldn't using PAKE require the server to know your master password or its hash? That sounds the same as before. Is the idea that they both know the hash only transiently (instead of the server knowing it persistently as it does today) and then establish some other key which they use after that?

Re: How did LastPass master passwords get compromised?

#102

Post by [deleted] »

tuwtuwtuwtuw wrote: post #82
palant wrote: post #78

Earlier quoted context omitted.

I haven’t seen it when I wrote the article. However, the formulation is vague enough that it could mean anything. Maybe the alerts were sent out by mistake which would be good news. But they don’t quite say that. Their statement might also mean that they rather disabled legitimate alerts so that people don’t get concerned. So they might have “cured” the symptoms without addressing the actual issue. It certainly isn’t…

What's the difference between "triggered in error" and "sent out by mistake" then? In this context they seem like the same..

[deleted]

Re: How did LastPass master passwords get compromised?

#103

Post by ViViDboarder »

jmull wrote: post #11

> "First of all, malware provides a level of access that makes hacking LastPass accounts unnecessary. If it can intercept or extract the LastPass master password, it can do the same for all other passwords as well." That logic doesn't really make sense. Malware might make hacking LastPass accounts unnecessary, but it would still be highly desirable (one target gives you everything else). Frankly, it feels like OP dec…

The additional justification there seems to ring true to me at least. If you had machine access, why not download the database from the “trusted” (compromised) machine? Why not extract the plain text passwords when they unlock their vault? How would it impact users who hadn’t logged into their accounts in years?

Malware doesn’t seem to fit to me.

Re: How did LastPass master passwords get compromised?

#104

Post by tuwtuwtuwtuw »

ohyeshedid wrote: post #94
syvanen wrote: post #25

So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…

I'm curious how that balances with everyone sharing random IP's from attempted account access. Where did those addresses come from? Why are users seeing them? Did the bug they're talking about cause bad data to be pushed to users dashboards?

Several people have reported that if you tried to log on from a new IP with incorrect master password, then you got an email saying that someone tried to log on using your master password even though that was not the case.

Re: How did LastPass master passwords get compromised?

#105

Post by tuwtuwtuwtuw »

_aavaa_ wrote: post #100
md_ wrote: post #37

Earlier quoted context omitted.

It's easy for me to imagine how you get here. - Eng are still writing the postmortem - Marketing want to put out a statement - Eng know or suspect a bug exists that can trigger spurious notifications, but don't have sufficient logs to be able to reconstruct if that bug was in fact in play in production - Legal advises not to say anything definitive that they can't stand behind later I don't see any of that as particu…

Be that as it may, which I have my doubts about since they are quite definitive about the problem being solved, I don't want a PR filter from the company that I would trust with my passwords. What I want to know is have I been compromised or not, the PR saves face at further expense of users (if they truly have been compromised).

> What I want to know is have I been compromised or not,

They have been extremely clear that they have not found any signs of compromise. Did you miss that?

Of course no company can technically guarantee that they have not being compromised. If you are looking for someone telling you at any point they are 100% confident no user accounts have been compromised, then you will pick a company lying to you.

Re: How did LastPass master passwords get compromised?

#107

Post by jonny_eh »

jazzyjackson wrote: post #42
willis936 wrote: post #28

Earlier quoted context omitted.

Which is exactly what you say when facing an existential crisis. If you have a master password leak you either: 1. lie about it and the truth never comes to light 2. lie about it and get caught and the consequences are the same as if you came clean If LP suffered a master password leak then there is no benefit to telling the truth.

The consequences of “Mea Culpa, please reset your master password” seem much less existential than denying and eventually being revealed as untrustworthy.

> eventually being revealed as untrustworthy

Replace "eventually" with "maybe".

Re: How did LastPass master passwords get compromised?

#108

Post by _aavaa_ »

tuwtuwtuwtuw wrote: post #105
_aavaa_ wrote: post #100

Earlier quoted context omitted.

Be that as it may, which I have my doubts about since they are quite definitive about the problem being solved, I don't want a PR filter from the company that I would trust with my passwords. What I want to know is have I been compromised or not, the PR saves face at further expense of users (if they truly have been compromised).

> What I want to know is have I been compromised or not, They have been extremely clear that they have not found any signs of compromise. Did you miss that? Of course no company can technically guarantee that they have not being compromised. If you are looking for someone telling you at any point they are 100% confident no user accounts have been compromised, then you will pick a company lying to you.

I did not miss that. But it's harder for me to read that as a technical statement and not more PR after the rest of the PR.

I also agree with you about the 100% confidence about not being compromised. Perhaps my previous statement was too black/white. I don't want PR or placating statements, I want a transparent status report without weasel words and which exhaustively covered the different cases (e.g. SOME of the messages were sent in error. what about the rest? Are the rest routine compromises that happen normally? Or was there a spike in compromised accounts?)

Re: How did LastPass master passwords get compromised?

#109

Post by [deleted] »

_aavaa_ wrote: post #27
syvanen wrote: post #25

So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…

That statement is too squirrelly for me to trust if my passwords were stored with them. “SOME of these security alerts” “were LIKELY triggered” “HAS BEEN solved” (Emphasis mine) How can the issue be definitely solved if you aren’t sure that they were actually triggered in error, if they were in error then it’s only some of them.

[deleted]

Re: How did LastPass master passwords get compromised?

#110

Post by aflag »

tuwtuwtuwtuw wrote: post #105
_aavaa_ wrote: post #100

Earlier quoted context omitted.

Be that as it may, which I have my doubts about since they are quite definitive about the problem being solved, I don't want a PR filter from the company that I would trust with my passwords. What I want to know is have I been compromised or not, the PR saves face at further expense of users (if they truly have been compromised).

> What I want to know is have I been compromised or not, They have been extremely clear that they have not found any signs of compromise. Did you miss that? Of course no company can technically guarantee that they have not being compromised. If you are looking for someone telling you at any point they are 100% confident no user accounts have been compromised, then you will pick a company lying to you.

They should be able to explain why so many people received the email though. Was there a fault in the notification system or not? Are they going to send messages to the individuals which received the notification in error?

I get that direct evidence of a leak is difficult. However, a sudden surge of master passwords being known by third parties in uncorrelated accounts is a very good evidence that something happened. If that's not what happened, then what happened exactly? Was it really a bug in the notification system? Do they have evidence that the password used in the blocked login attempts weren't really the actual master password?

There is a lot of things they can do to show they are on top of things.

Post reply on HN