Were there any breached sub-accounts/credentials?
How did LastPass master passwords get compromised?
131–140 of 189 posts
Re: How did LastPass master passwords get compromised?
#132Earlier quoted context omitted.
LastPass's statement is extremely vague. _Why_ were these alerts triggered in error? What error triggered them?
The lack of that specific information doesn't make it vague in my view. If I tell to that the world appears to be shaped as a globe then that statement isn't vague just because I don't explain _why_ it appears shaped as a globe.
This isn't some abstract argument about your view of the world. This is a blogpost about a potentially very serious system fault. Customers want to know what the root cause of the fault was, so that they can evaluate whether to continue to do business with the company or not. It's very cut and dry.
Re: How did LastPass master passwords get compromised?
#133The article suggests that hashing (PBKDF2) is done client-side only, and that LastPass stores this hash directly. If true, this is very bad. However, LastPass claims that PBKDF2 is also used server side: > We then take that value, and use a salt (a random string per user) and do another 100,000 rounds of hashing, and compare that to what is in our database. https://blog.lastpass.com/2015/06/lastpass-security-notice/…
Which to me begs the question: then why hash client-side at all? What are the threats it protects against?
Hashing client side has a non-cryptographic benefit of making all passwords a fixed length. This, in turn, helps avoid accidents with bcrypt misuse.
Re: How did LastPass master passwords get compromised?
#134So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…
That statement is too squirrelly for me to trust if my passwords were stored with them. “SOME of these security alerts” “were LIKELY triggered” “HAS BEEN solved” (Emphasis mine) How can the issue be definitely solved if you aren’t sure that they were actually triggered in error, if they were in error then it’s only some of them.
I've definitely used that exact wording when ALL of the problems were DEFINITELY triggered by something but I still didn't fully understand how.
Re: How did LastPass master passwords get compromised?
#135Earlier quoted context omitted.
Which is exactly what you say when facing an existential crisis. If you have a master password leak you either: 1. lie about it and the truth never comes to light 2. lie about it and get caught and the consequences are the same as if you came clean If LP suffered a master password leak then there is no benefit to telling the truth.
One advantage of telling the truth is that you don't go to prison for fraud. When evaluating this kind of conspiracy theory, it's important to consider the number of people who would have to remain silent for the conspiracy to survive, and to consider how much it would cost to keep that many people silent. In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very lo…
Tech companies are not held liable by the justice department or any other federal org. It's against their interests because they now depend on these services to operate. Which is why you will never see Amazon, Google, or Microsoft sued in any damaging capacity for the obvious fraud they commit. That being fake products, reviews, promoting scams, antitrust, etc.
Re: How did LastPass master passwords get compromised?
#136Earlier quoted context omitted.
This is broken thinking built on faulty assumptions. There are countless examples of massive conspiracies and secrets never leaking.
Can you provide some? I have previously only heard "santa".
JFK, 9/11, and Epstein spring to mind for major conspiracies. I think anyone with a head on can see the government bodies tasked to investigate those affairs were rife with conflicted interests, duplicitous individuals, and some intent that they should be as narrow investigations as possible. Those secrets have been kept or at the very least the limited hangout worked so well that people think only nuts question them.
Re: How did LastPass master passwords get compromised?
#137Earlier quoted context omitted.
Sure, I do contracting work for the military. There are hundreds of millions of secrets kept every day with hundreds of thousands of people keeping their mouths shut. Leaking is exceedingly rare.
You have not provided any evidence or examples, just a “trust me”, which is essentially worthless. Also, there is a difference between a secret and a conspiracy. Secrets can survive for a long time, whereas history suggests that conspiracies rarely, if ever, succeed long term.
Well, you know that the military has a lot of secret stuff you know nothing about right? Let’s use Area 51 as an example.
Leaks like Snowden or Manning are a drop in the bucket compared to the total amount of secrets that were not leaked.
As far as examples of successfully kept secrets, I can’t give those, because I’m in on it.
All a conspiracy is, is a group of people keeping a secret.
As far as conspiracies not being successful long term, history tells us no such thing. Conspiracies with tons of people are successfully kept every single day, only to be discovered decades later when something is declassified for example.
You can never prove if a conspiracy to keep a secret is not successful if you never knew it existed.
Am I making any sense?
Re: How did LastPass master passwords get compromised?
#138The article suggests that hashing (PBKDF2) is done client-side only, and that LastPass stores this hash directly. If true, this is very bad. However, LastPass claims that PBKDF2 is also used server side: > We then take that value, and use a salt (a random string per user) and do another 100,000 rounds of hashing, and compare that to what is in our database. https://blog.lastpass.com/2015/06/lastpass-security-notice/…
When I was doing some research into building an app that encrypted data similar to these cloud password managers, I encountered OPAQUE[1] which seems to be the ideal way to perform authentication and securing a master encryption key. It is an asymmetric PAKE that also has a step for providing a salt. This removes the need to do what LastPass does with treating the first hash as a password. There is a great article from Cloudflare on how it works[2], and a working implementation of the spec in rust[3].
[1]: https://github.com/cfrg/draft-irtf-cfrg-opaque
[2]: https://blog.cloudflare.com/opaque-oblivious-passwords/