111–118 of 118 posts
Earlier quoted context omitted.
But if you don’t have the printout and a device with the encrypted key, you cannot access anything. I’m not sure users are going to be happy.
To lose your passwords, you have to lose literally every device you have LastPass on and your printout and any E2EE backups of the key (e.g. to iCloud.)
Earlier quoted context omitted.
To lose your passwords, you have to lose literally every device you have LastPass on and your printout and any E2EE backups of the key (e.g. to iCloud.)
Yes but it’s convenient to access your online accounts when you don’t have access to your devices and your printout.
Earlier quoted context omitted.
What does the system hold? Your library loan history or nuclear weapon launch codes? Assuming it’s reset every 10 attempts, you have lost keyspace and gained random odds. 1:1000000 of getting the password right, 1:500k on average. Assuming I can perform one attempt per second, about 139 hours to successfully brute force a single account. One second is probably pessimistic, most systems are capable of serving much hig…
The pin is the MFA. Is it 1000k or 10k (99999/10 guesses)? I can't give full details of what is within accounts without potential exposure of the company. So I called a local bank and asked what I needed to set up an account. All the information required was part of a potential breach. Is there a rate limit where protecting information with 5 digits is ok?
Rate limits and account lockouts create accessibility and availability issues, I’m not aware of any real world case studies where they have been abused, my guess is demographics are important (a student is more likely to do it to a school rather than a random on the street doing it to a finance company). Though, if usernames are possible to enumerate, you should still consider the risk of someone doing it at scale as a dos.
What is / is not okay is probably largely defined by any security frameworks that you’re required to adhere to - in Australian Gov there is the Information security manual (google ISM ACSC). It states that password complexity goes up if you do not have MFA, and that without it credentials should be 14+ characters long.
Given your assertion that a breach would be possible, I would strongly suggest that your current methodology is dangerous. If you can enumerate usernames doubly so. Are you able to script a proof of concept brute force? Tools like hydra do this, but I prefer python3/requests.
Earlier quoted context omitted.
The pin is the MFA. Is it 1000k or 10k (99999/10 guesses)? I can't give full details of what is within accounts without potential exposure of the company. So I called a local bank and asked what I needed to set up an account. All the information required was part of a potential breach. Is there a rate limit where protecting information with 5 digits is ok?
I would say 1m, rather than 10k, as the value rolls every 10 attempts, the true odds are slightly less than 1:1m, but only because every 9th attempt is 1:(1m-9) and 8th is 1:(1m-8), this is a minute difference. Rate limits and account lockouts create accessibility and availability issues, I’m not aware of any real world case studies where they have been abused, my guess is demographics are important (a student is mor…
There is always a potentially critical vulnerability in any centralized password storage. Especially, if it requires a (relatively) simple master password to access. A many factors system like the one of Apple is IMO more secure but also easier to remember because they are all pin/passwords one needs (almost) every day.
1Password is also inherently more secure because of the extra Secret Key. If a breach like this ever happens to them, users with weak master passwords will still be safe. Also, Lastpass doesn't encrypt URLs. There's really no excuse for that.
So, if my lastpass master password is actually secure (~30 characters and contains capital, lowercase, symbols, and a long string of randomly-generated numbers that I memorized as part of it, and no part of this is reused anywhere else), do I have to worry? It does seem like a good idea to switch, but do I have to switch urgently ?
Switching to a different password manager now would do nothing to address the concern that someone has an older copy of your password database and has cracked it. The way to address that particular concern is to change the passwords of all your services themselves. If you do that, it would a good time to change password managers too—just save the new passwords in the new manager. Another approach would be to turn on…
Earlier quoted context omitted.
You don't have to pick all words in the same language. Most people know at least 3 languages well enough. I often make passphrases out of 5 to 6 languages.
No, that’s highly unusual. Maybe people know a handful of greetings / numbers in other languages but I think you’re vastly overestimating the number of people capable of speaking more than one language.