Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

111–120 of 326 posts

Re: LastPass users warned their master passwords are compromised

#111

Post by tarboreus »

civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

I do this, though I encrypt with GPG and a password. When I open the file, Emacs prompts for the password. It's pretty convenient, honestly, and I use the same system for sensitive notes, etc.

Re: LastPass users warned their master passwords are compromised

#112

Post by tgsovlerkhgsel »

They claim it's credential stuffing, but there are plenty of people on the HN thread (https://news.ycombinator.com/item?id=29705957) claiming to have used a unique password.

Does LastPass/LogMeIn have a history of lying about/downplaying security incidents? I only remember a controversial (and to my knowledge unresolved) issue at TeamViewer (where the company claimed no compromise but due to the number of reports there were doubts about that claim).

Re: LastPass users warned their master passwords are compromised

#113

Post by Lanrei »

civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

If you want to store you passwords locally, then at least use something like Keepass or KeepassXC. It's far from a perfect solution as it's still vulnerable to targeted attacks when it's being used if your computer is compromised. But at least they're not store in plain text. Also password auto-typing and generation are nice to have.

You can sync the encrypted files to your phone or other computers.

Re: LastPass users warned their master passwords are compromised

#114

Post by dahart »

civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

I see nothing wrong with using a plaintext file on your computer, that’s likely going to be safer than using a cloud based solution for a desktop computer that only you access, especially if you don’t have remote access.

Important questions might be how secure is your computer (encrypted HD, multiple users, etc), what incoming services have you enabled (ssh?), does your computer ever travel (is it a laptop, is it prone to loss or theft), and how secure is your apartment/house (is a robbery plausible).

The main thing a desktop file is, for most people who use password managers, is inconvenient. Without some kind of remote access at home, it might mean not having access to passwords when doing errands or traveling, any time when not physically at home. But with remote access, the password file access does become riskier, that does become cloud access where you’re responsible for the security of all methods of remote access (are any ports open you don’t know about?).

Having my password manager on my phone has been incredibly useful at times.

Re: LastPass users warned their master passwords are compromised

#115

Post by SCLeo »

To those who are recommending all different password managers, I have a question: why not using Chrome (or Firefox/Edge/)'s built-in password manager?

I have been using it for a couple years and haven't noticed any issue. Even if Google decides to screw me over and terminates my Google account, I can still access the passwords via the local copy in Chrome, so that is not really a concern.

(Though, don't take this as my recommendation to use Google' password manager. I have not done enough research in the password manager landscape, which is why I am asking this question in the first place.)

EDIT: also include other browsers' password managers. (It appears that it is a mistake to mention anything Google on HN :/)

Re: LastPass users warned their master passwords are compromised

#116

Post by sabhiram »

onlyrealcuzzo wrote: post #107
civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

You could just use KeePass: https://keepass.info/ It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely. And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

Seems useful, the name gave me a chuckle. If I only saw the URL, I would imagine this was a service that providing info on preserving your buttocks.

Re: LastPass users warned their master passwords are compromised

#117

Post by tgsovlerkhgsel »

vorpalhex wrote: post #92
gkoberger wrote: post #55

Earlier quoted context omitted.

Agreed, and I highly recommend 1Password. But just because they've had problems in the past doesn't mean the framing of this article is fair. The title made me think everyone's passwords were compromised due to a leak or hack, when in reality the article is a rehash of a HN post from yesterday.

The official story from LastPass and the claims of the reporters are in direct conflict. Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. One [incident] reporter claims they changed their master password and had a breach attempt using the new password. If that is true that is extremely alarming. There could be some malware targeting a…

> Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users.

As you mention yourself at the end, there are other plausible explanations (e.g. malware on the machines).

Re: LastPass users warned their master passwords are compromised

#118

Post by gruez »

vorpalhex wrote: post #91
gruez wrote: post #83

Earlier quoted context omitted.

>You may want to enroll multiple and keep them in other places too, but you can't enroll a key you don't have so things like a safe deposit box are not useful for the average case. That seems like a usability nightmare. Are there plans to improve this? Hardware wallets for cryptocurrencies seem to have it solved. You can keep multiple copies of the keys around (ie. multisig wallets) for maximum security, or you can w…

Because each hardware key is unique, this is not a feature currently available nor likely to become available. Each token from the yubikey is not (readily) linkable to the key itself since the underlying secret is opaque and can't be exported, so tricks like Shamir's aren't readily possible. Yubikeys do solve a lot of use cases very well but that is a downside to them. That is probably still a good tradeoff for most…

>Because each hardware key is unique, this is not a feature currently available nor likely to become available.

You don't necessarily have to do it crypto wallet style and have the private key be exportable. Just adding a public key export (on the security token side) and a way to enroll a token by its public key (on the browser/website side) would allow you to enable 2fa without having to make a trip to the safe deposit box (either to store your backup codes, or to fetch your backup token for enrollment).

>Each token from the yubikey is not (readily) linkable to the key itself since the underlying secret is opaque and can't be exported

That's not an issue. You can derive more ECDSA public keys from a single master ECDSA public key[1]. The corresponding private keys can only be derived using the corresponding master ECDSA private key, and the generated public keys can't be linked back to the master ECDCSA public key. Bitcoin hierarchical deterministic uses this property to generate wallets that don't need regular backup (all your addresses are derived from one key) and apple's find my network uses something similar.

[1] exact mechanism is described here: https://bitcointalk.org/index.php?topic=19137.msg239768#msg2... starting at "Type-2 is a bit less obvious [...]"

Re: LastPass users warned their master passwords are compromised

#119

Post by _jal »

junon wrote: post #66
_jal wrote: post #51

Earlier quoted context omitted.

Nope. Keeping my secrets store on someone else's computer is simply not compatible with my threat model. Yes, they say it is encrypted, and I believe them and believe they're competent. But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.

1password has been audited a bazillion times. They're E2EE. They're cheap. Your master passwords aren't stored on their servers. Neither is your key information. The only thing I pay for is the managed hosting, but in theory it's not much different than anything else properly designed (e.g. bitwarden) aside from the obvious things, such as OSS-ness. The only relevant CVEs are relatively mild compared to LastPass. Giv…

Happy to give them credit. I just refuse to give them my passwords.

> The only thing I pay for is the managed hosting

Funny, I was happy to pay them until they removed my ability to store it myself.

edit:

> CVEs are relatively mild compared to LastPass

LP is not the relevant comparison. The relevant comparison is an encrypted store on my laptop.

Re: LastPass users warned their master passwords are compromised

#120

Post by AceJohnny2 »

SCLeo wrote: post #115

To those who are recommending all different password managers, I have a question: why not using Chrome (or Firefox/Edge/ )'s built-in password manager? I have been using it for a couple years and haven't noticed any issue. Even if Google decides to screw me over and terminates my Google account, I can still access the passwords via the local copy in Chrome, so that is not really a concern. (Though, don't take this as…

Browser-based managers only work in those browsers.

I use passwords on my iPhone, MacBook, and Windows, so I need a manager that can provide passwords across all of those (and not just in a browser)

Post reply on HN