Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

121–130 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#121

Post by technion »

pigsty wrote: post #36
ddejohn wrote: post #5

For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

I definitely feel the opposing law works. When I see a project with a massive disclaimer about "this crypto is not audited, I'm a noob never deploy this anywhere" I'm likely to see better crypto than most of the commercial products I work with, including ones with sales people that talk about unbreakable crypto.

Re: The situation at LastPass may be worse than they are letting on

#122

Post by disillusioned »

lolinder wrote: post #105
dspillett wrote: post #100

Earlier quoted context omitted.

Drop box is just the sync mechanism, with keepass' encryption (and their own care to keep the keys safe and not carried on the same medium) being all the protection. Dropbox is not added security in this setup, it is a natural factor if what is being transferred [the keepass file(s)] is sufficiently secure in itself.

I know Dropbox isn't added security, my question is why Dropbox losing the vault wouldn't be just as bad and as likely as Bitwarden losing the vault? Another reply indicates that the main thing is that you don't have to trust the cloud service to do the encryption and zero-knowledge stuff right.

No possibility for a MITM attack (except, I suppose, with a keylogger, but then you've got bigger problems), and absolutely NOTHING outside of encryption, whereas whoever has this leak now knows what users have accounts on what websites, which is a veritable treasure trove.

That plus security through obscurity: no one is presuming you're going to come out of a Dropbox hack with millions of password vaults. Even finding them would be... nightmarish. (Though I suppose you could somehow hack a Dropbox file index database?) The value of a target like LastPass is absolutely insanely high: it's a concentrated honeypot of encrypted vaults.

Plus, the Android app makes using a Dropbox synced folder location fairly trivial, so that works pretty well. And you can set your own number of password rotations, which, while annoying when it takes my phone 5-10 seconds to unlock, realllllllly helps ensure no one else is going to crack this vault if they ever got it.

Re: The situation at LastPass may be worse than they are letting on

#123

Post by lolinder »

roperj wrote: post #97
lolinder wrote: post #92

Earlier quoted context omitted.

Is the added security just that Dropbox is a lower value target (possible) and that attackers won't think to look for password databases in Dropbox accounts if they do compromise Dropbox (less likely)? Or is there something more to it? EDIT: Given the replies below, I should be clear that I'm not interested in comparing to LastPass, I'm comparing to Bitwarden. LastPass had an obviously bad security model that failed…

> Or is there something more to it? The part where they said they do not store either the key or password on Dropbox.

You do not store the password on a password manager either. LastPass swears up and down that they never see your master password, all encryption happens client side. I can see good reasons not to trust LastPass at their word, but Bitwarden?

Re: The situation at LastPass may be worse than they are letting on

#125

Post by cmsj »

_-____-_ wrote: post #50
dreamyfigment wrote: post #37

Earlier quoted context omitted.

Thanks! They seem to encrypt everything too. Items contain overviews and details which are encrypted separately by the vault key. We encrypt these separate so that we can quickly decrypt the information needed to list, sort, and find items without having to first decrypt everything in the vault. Item overviews include the item fields needed to list items and to quickly match items to websites, such as Title, URLs, pa…

Additionally, 1Password makes the extra effort to never even send the URLs of your accounts to their servers. Even with their Watchtower service, which notifies you of breached accounts and websites that support 2-factor authentication, your passwords and website URLs are never sent to 1Password servers. https://support.1password.com/watchtower-privacy/

They still require that your vault be hosted by them though. Terrible policy.

Re: The situation at LastPass may be worse than they are letting on

#126

Post by vba616 »

fanso99 wrote: post #87

Please stop commenting whether you are a LastPass user or not. Some of your profiles on HN have an email address and in general all your comments are public so can be mined, plus "rich techies" could be prime targets for more direct and elaborate phishing campaigns.

For all you know, they are bots or shills to encourage actual users to comment.

Remember this?

     hey, if you type in your pw, it will show as stars
     ********* see!
     hunter2
     doesnt look like stars to me
      *******
     thats what I see
     oh, really?
     Absolutely
     you can go hunter2 my hunter2-ing hunter2
     haha, does that look funny to you?
     lol, yes. See, when YOU type hunter2, it shows to us as *******
     thats neat, I didnt know IRC did that
     yep, no matter how many times you type hunter2, it will show to us as *******
     awesome!
     wait, how do you know my pw?
     er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
     oh, ok.

Re: The situation at LastPass may be worse than they are letting on

#127

Post by beardedwizard »

ern wrote: post #76

This is quite interesting. A couple of weeks ago, I received an extortion phishing email, but it was directed to a secondary email address that hasn’t been previously compromised. It made it past Gmail’s spam and phishing filters into my inbox. Maybe a coincidence, but I guess every weird thing that happens is going to raise alarm bells. I was suspicious of the LastPass concept (storing passwords in a cloud app) when…

I had exactly the same experience, and I even filed a bug in the bounty program about it 4 years ago.

In my case I was off boarded by an employer, but retained access to it on my mobile device and could read all passwords.

Their initial response was that it was by design, then later tried to pay a bounty I never accepted.

Re: The situation at LastPass may be worse than they are letting on

#128

Post by TylerE »

usefulcat wrote: post #71
DethNinja wrote: post #9

Is there any reason to use these cloud based solutions when open source alternatives like KeepassXC is available?

I used KeePass + Dropbox/Syncthing for years, but eventually gave up. At some point I saved my KeePass db with a newer version (of the software and the DB format), and later found out that the newer software version will not run on an older version of MacOS that I still use on one machine. I mean, I could maybe update the OS on that machine (not sure--it's over 10 years old) but at that point it was less work and les…

If you’re using a ten year old OS your password manager is the least of your security concerns.

Re: The situation at LastPass may be worse than they are letting on

#129

Post by paulpauper »

either two possibilities:

1. password was somehow left in plain text

2. there was a problem with the encryption implementation by LastPass. likely this is the reason.

this is why you always encrypt crypto stuff with offline computer using well-vetted tools like VeraCrypt or openssl, and not rely on cloud storage encryption. Only you can do your encryption. relying on others doomed to fail eventually.

Re: The situation at LastPass may be worse than they are letting on

#130

Post by hollerith »

TylerE wrote: post #128
usefulcat wrote: post #71

Earlier quoted context omitted.

I used KeePass + Dropbox/Syncthing for years, but eventually gave up. At some point I saved my KeePass db with a newer version (of the software and the DB format), and later found out that the newer software version will not run on an older version of MacOS that I still use on one machine. I mean, I could maybe update the OS on that machine (not sure--it's over 10 years old) but at that point it was less work and les…

If you’re using a ten year old OS your password manager is the least of your security concerns.

That's not what he stated.
Post reply on HN