I just wish Firefox would integrate Apple’s Keychain. I don’t know if it is even possible or not. But it is such a pain because I really am tired of all these password managers and also security breaches from multiple silos. Medibank has leaked all my data and now I have lastpass to deal with too.
The situation at LastPass may be worse than they are letting on
101–110 of 436 posts
Re: The situation at LastPass may be worse than they are letting on
#102Please stop commenting whether you are a LastPass user or not. Some of your profiles on HN have an email address and in general all your comments are public so can be mined, plus "rich techies" could be prime targets for more direct and elaborate phishing campaigns.
This
Re: The situation at LastPass may be worse than they are letting on
#103This pushed me to move my Bitwarden data to a self-hosted Vaultwarden instance tonight.
At this point I just don't want my data in the big, juicy hacking target.
Re: The situation at LastPass may be worse than they are letting on
#104If this was true, i feel like it would be a little strange for the attacker to use it to steal a small amount of crypto. Once its revealed how bad this is, there would probably be a small window before people change their passwords, i would assume attackers would either go for a big score before revealing this capability, or they would try to hit everything very quickly. Just hitting a tiny amount of crypto seems odd…
Perhaps the crypto passwords were stored in the unencrypted URL field, or could be understood from data in there. https://twitter.com/SwiftOnSecurity/status/16060717986671738...
Seems very likely, it's now known (maybe always was) that metadata fields aren't encrypted. If Twitter poster added those keys to a 'metadata field's then they were clear text.
LastPass has a LOT to answer for.
Re: The situation at LastPass may be worse than they are letting on
#105Earlier quoted context omitted.
Is the added security just that Dropbox is a lower value target (possible) and that attackers won't think to look for password databases in Dropbox accounts if they do compromise Dropbox (less likely)? Or is there something more to it? EDIT: Given the replies below, I should be clear that I'm not interested in comparing to LastPass, I'm comparing to Bitwarden. LastPass had an obviously bad security model that failed…
Drop box is just the sync mechanism, with keepass' encryption (and their own care to keep the keys safe and not carried on the same medium) being all the protection. Dropbox is not added security in this setup, it is a natural factor if what is being transferred [the keepass file(s)] is sufficiently secure in itself.
I know Dropbox isn't added security, my question is why Dropbox losing the vault wouldn't be just as bad and as likely as Bitwarden losing the vault?
Another reply indicates that the main thing is that you don't have to trust the cloud service to do the encryption and zero-knowledge stuff right.
Re: The situation at LastPass may be worse than they are letting on
#106I feel like this is an excellent time to, once again, give out two reminders to anyone who needs reminding: "The cloud" is just someone else's computer. Sharing your password with anyone always makes you less secure.
And so does sending your passwords to a phone or a home/work pc via chats or email, or using a single password everywhere, or maybe a couple of them with trivial variations. Cloud password managers wouldn’t even exist if people didn’t do much more stupid things to enter their passwords on a different device than the cloud could ever think of.
Re: The situation at LastPass may be worse than they are letting on
#107this sort of thing is why I append the name of the website + a unique identifier + password, so that I don't have to bother changing my password during such nonsense, ugh.
Do this instead https://spectre.app/
Doesn't that make your passwords predictable? If you use the same secret for every domain and now if an attacker figures out your one secret then they would be able to find out all your passwords.
Re: The situation at LastPass may be worse than they are letting on
#108If this was true, i feel like it would be a little strange for the attacker to use it to steal a small amount of crypto. Once its revealed how bad this is, there would probably be a small window before people change their passwords, i would assume attackers would either go for a big score before revealing this capability, or they would try to hit everything very quickly. Just hitting a tiny amount of crypto seems odd…
That tiny amount of crypto is going to be worth a fortune someday!
Re: The situation at LastPass may be worse than they are letting on
#109Earlier quoted context omitted.
But if you had a ton of credentials from people, scanning for crypto credentials and trying to use those may be easier/faster/safer to turn into money than system credentials to some random company network.
If the hack of LastPass happened yesterday, sure, but it happened months ago. There are a variety of different attacks that could be executed in that time, and the sooner the attacks are executed, the better — because less time for credentials to be rotated. I find it implausible that the first hint of vault compromise comes 4 months after the hack and is against a low value cryptocurrency wallet. Especially consider…
I largely agree with you, however it may also be the case that the attackers have been working on cracking vaults quietly since the hack and the announcement made them go after everything they had cracked so far instead of continuing to work quietly. They might have decided the crackable vaults don’t rotate credentials within them often, but it becomes much more likely after the announcement.
Re: The situation at LastPass may be worse than they are letting on
#110This is why Microsoft's requirement to drink a verification can was so genius. Imagine being a hacker and have to drink multiple verification cans to be able to proceed throughout multiple transactions. "Hacker dies from overdose due to ingestion of too much Doritos and Mountain Dew"