Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass: Notice of Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

101–110 of 141 posts

Re: LastPass: Notice of Security Incident

#101

Post by sbf501 »

jrm4 wrote: post #21

For all of its warts, at least crypto has managed to come up with a clever little motto that correctly states the issue, in the form of "not your keys, not your crypto." Putting your passwords in the hands of a third party drastically increases your threat surface and no amount of hand-wavy "but it's not as convenient" will change this fact. Now, it may be true that the convenience factor is very strong right now, bu…

Well it's a good thing LastPass doesn't require you to put your passwords in the hands of a third party! Just the locally encrypted passwords. This is vastly different than, say, a crypto exchange, where the meme originated because in that case, the exchange can literally sign blockchain transactions for your wallet, because they share a key.

Re: LastPass: Notice of Security Incident

#102

Post by asoberbeck »

woojoo666 wrote: post #88
AdamJacobMuller wrote: post #84

Earlier quoted context omitted.

> even a full breach of their servers would fail to leak passwords This is a dangerous fallacy. Nothing fundamentally would prevent someone who attacked their infrastructure from pushing a malicious app update or a malicious extension update which exfiltrated the decrypted library from the client side.

Are there any instances of this happening? I feel like it would be caught so fast it's not worth trying

> As customers downloaded the update, they unwittingly pulled down and installed the backdoor at the same time. The malicious code was itself cleverly designed, would execute commands, and provided remote admin access. The hackers then used that foothold to create and cryptographically sign the necessary security tokens to hoodwink systems into believing subsequent access to other accounts and resources was legitimate.

https://www.theregister.com/2020/12/15/solar_winds_update/

Re: LastPass: Notice of Security Incident

#103

Post by notimetorelax »

aceazzameen wrote: post #100

I'm so glad we switched from LastPass to Bitwarden earlier this year. It seems like every few years there's some kind of breach with LastPass.

What advantages does Bitwarden have in terms of security? I’m on LastPass and curious if and why I should switch.

Re: LastPass: Notice of Security Incident

#104

Post by woojoo666 »

asoberbeck wrote: post #102
woojoo666 wrote: post #88

Earlier quoted context omitted.

Are there any instances of this happening? I feel like it would be caught so fast it's not worth trying

> As customers downloaded the update, they unwittingly pulled down and installed the backdoor at the same time. The malicious code was itself cleverly designed, would execute commands, and provided remote admin access. The hackers then used that foothold to create and cryptographically sign the necessary security tokens to hoodwink systems into believing subsequent access to other accounts and resources was legitimat…

Wow that is worrying how long it took to catch....seems like companies need to be monitoring their releases more carefully

Re: LastPass: Notice of Security Incident

#105

Post by woojoo666 »

woojoo666 wrote: post #90
larrybud wrote: post #14

I wish they were more definitive as to if there was (or was not) any compromise of the source code repository credentials. Eg could the attacker have injected malware into the code as in the Solarwinds incident?

They would have to push an infected update to all the client-side apps, which is something that would be extremely obvious and would have been immediately announced by Lastpass

Update: another comment mentioned that the SolarWinds hack was a hijacked download, and companies did not catch on until much later. It seems like companies are not monitoring their releases as much as I'd hoped

Re: LastPass: Notice of Security Incident

#106

Post by Ch4otic »

notimetorelax wrote: post #103
aceazzameen wrote: post #100

I'm so glad we switched from LastPass to Bitwarden earlier this year. It seems like every few years there's some kind of breach with LastPass.

What advantages does Bitwarden have in terms of security? I’m on LastPass and curious if and why I should switch.

All of the applications (Desktop, Mobile, CLI) and the API itself are completely open source: https://github.com/bitwarden

Re: LastPass: Notice of Security Incident

#107

Post by armada651 »

vlan0 wrote: post #95
armada651 wrote: post #94

Earlier quoted context omitted.

You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical. Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation. That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master passw…

While this is true, and I did this for the better part of 2010s, it was pretty clunky. Especially if one needs a platform for their wife or children to also use. I'm gonna ride out LastPass until webauthn really takes off. Which could be soon based on what we're hearing from the mobile vendors.

Yeah I'm definitely not saying this is the right solution for everyone, but for my personal password database I'm willing to sacrifice a bit of polish to make sure the zero-knowledge claim is iron clad.

Re: LastPass: Notice of Security Incident

#108

Post by Timothycquinn »

armada651 wrote: post #94
smt88 wrote: post #3

Earlier quoted context omitted.

Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.

You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical. Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation. That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master passw…

I sync my keepass using signal's 'note to self' feature.

Re: LastPass: Notice of Security Incident

#109

Post by collegeburner »

armada651 wrote: post #94
smt88 wrote: post #3

Earlier quoted context omitted.

Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.

You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical. Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation. That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master passw…

You don't even need Dropbox, for a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.

Re: LastPass: Notice of Security Incident

#110

Post by andreareina »

armada651 wrote: post #94
smt88 wrote: post #3

Earlier quoted context omitted.

Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.

You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical. Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation. That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master passw…

I've had multiple failures to merge (including corrupted databases) with keepass. I'm still using it but I'm considering moving to {bit,vault}warden
Post reply on HN