Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did LastPass master passwords get compromised?

palant.info

Post reply on HN
Print view View original

141–150 of 189 posts

Re: How did LastPass master passwords get compromised?

#141

Post by jjav »

mgraczyk wrote: post #34
willis936 wrote: post #28

Earlier quoted context omitted.

Which is exactly what you say when facing an existential crisis. If you have a master password leak you either: 1. lie about it and the truth never comes to light 2. lie about it and get caught and the consequences are the same as if you came clean If LP suffered a master password leak then there is no benefit to telling the truth.

One advantage of telling the truth is that you don't go to prison for fraud. When evaluating this kind of conspiracy theory, it's important to consider the number of people who would have to remain silent for the conspiracy to survive, and to consider how much it would cost to keep that many people silent. In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very lo…

> In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very long.

This is a very unlikely expectation. Employees are under NDA so nobody will talk publically about it unless one of them feel so strongly about it to sacrifice their career (they'd certainly get fired, and being sued for breaching the NDA isn't going to make finding a new job easier).

Employees at all companies keep quiet about bugs like these all the time, that's the most common outcome.

Re: How did LastPass master passwords get compromised?

#142

Post by ohyeshedid »

tuwtuwtuwtuw wrote: post #127
ohyeshedid wrote: post #113

Earlier quoted context omitted.

I was referring to the IP's being shown to users.[1] So then; Is the bug also responsible for pushing bad data to the users dashboards? If this is really a bug, it's a complicated one. I'd be curious if those IP's are still being shown on the users end. [1]: https://news.ycombinator.com/item?id=29705957

What "dashboards" are you referring to? I have not seen any dashboards in LastPass. Why would it need to be a complicated bug? It could be as simple as: If UnkownIP OR InvalidMasterPassword Then LogAndSendNotication Instead of: If UnkownIP AND InvalidMasterPassword Then LogAndSendNotication Please tell me why it needs to be a complicated bug.

I don't have a link handy, nor currently familiar with LP's site or extensions:

The part of the site that shows the recent connections to your account, with IP's. People were sharing those IP's and thoughts in the linked thread.

That data came from somewhere; if it's related to this bug then this bug is also pushing incorrect data into other parts of the service. It's also entirely possible that it wasn't a bug, and instead a security issue, and that data is correct, and they're bending words to play it off as just a bug.

I can understand a bug triggering a warning system, but when it's also presenting related data in the account security logs; it's either a complicated bug or there's more to the story.

Re: How did LastPass master passwords get compromised?

#144

Post by tuwtuwtuwtuw »

ohyeshedid wrote: post #142
tuwtuwtuwtuw wrote: post #127

Earlier quoted context omitted.

What "dashboards" are you referring to? I have not seen any dashboards in LastPass. Why would it need to be a complicated bug? It could be as simple as: If UnkownIP OR InvalidMasterPassword Then LogAndSendNotication Instead of: If UnkownIP AND InvalidMasterPassword Then LogAndSendNotication Please tell me why it needs to be a complicated bug.

I don't have a link handy, nor currently familiar with LP's site or extensions: The part of the site that shows the recent connections to your account, with IP's. People were sharing those IP's and thoughts in the linked thread. That data came from somewhere; if it's related to this bug then this bug is also pushing incorrect data into other parts of the service. It's also entirely possible that it wasn't a bug, and…

> it's either a complicated bug or there's more to the story.

I showed you pseudo-code which could trigger this issue. It was trivial code which could cause it in practice. Yet you claim it must be complicated or more to the story. I have no idea why you feel that classifying a request in a certain way must be caused by a complicated bug - very strange.

I think you're into FUD-mode now because even after being shown wrong, you continue to spread misinformation.

Also, you are referring to LP functionality which to my knowledge doesn't even exist, and when asked you say you don't know the software being discussed.

Very strange behavior by you.

Re: How did LastPass master passwords get compromised?

#145

Post by tuwtuwtuwtuw »

aflag wrote: post #114
tuwtuwtuwtuw wrote: post #85

Earlier quoted context omitted.

The lack of that specific information doesn't make it vague in my view. If I tell to that the world appears to be shaped as a globe then that statement isn't vague just because I don't explain _why_ it appears shaped as a globe.

It's vague because we don't know why you consider it to appear to be a globe. Did you fly in a rocket and saw it or do you just think that round is the perfect shape and God wouldn't create the world in any other way?

That's not what the word vague mean though. If you make up your own definitions of words then it's not worth discussing with you.

Re: How did LastPass master passwords get compromised?

#146

Post by ptmvp »

bth wrote: post #143

I've received the email about login attempt from replies@m.lastpass.com even though I've removed my account 24h before that. When I try to login, I'm getting an error that my account doesn't exist. Maybe this is a phishing attack after all.

Same thing happened to me. I contacted support and they confirmed my account had been deleted, but I'm still uneasy..

Re: How did LastPass master passwords get compromised?

#147

Post by Sebb767 »

SavantIdiot wrote: post #31
wubbert wrote: post #20

This is exactly why I have never used LastPass, and have always stuck with KeePass (and KeePassXC). It is much more secure to keep all of my passwords locally than in the cloud.

This argument has never made sense to me. Keeping an encrypted password file in the cloud or locally makes no difference. There exists no computer system than can crack an AES256 encrypted document. The weaknesses are in the protocol. Storing the encrypted database in the cloud and downloading it is the same as storing it locally if the decryption protocol is performed locally. If the decryption was done in the cloud…

> Storing the encrypted database in the cloud and downloading it is the same as storing it locally if the decryption protocol is performed locally.

The problem is that, with web-based password managers, you are not only downloading the database, but also the code to decrypt it. A locally installed Keypass requires your PC to be compromised, whereas for LastPass it is sufficient for their servers to be compromised (while not avoiding the problem if you are compromised, either).

Re: How did LastPass master passwords get compromised?

#148

Post by helloworld11 »

I never trusted or used LastPass and others of this type for this very reason. Powerful passwords created by a single central expert source? Sounds great, very secure, except for the little tiny detail of that source being broken wide open despite its claims of excellent security. It's impressive how many supposedly tech-oriented people on this very site and its comments I've frequently seen recommending such an obviously insecure way of keeping you private stuff protected. This not to mention the possibility of collusion with certain alphabet agencies.

It's like data management in general: If you don't uniquely, personally control it, you don't really control it.

Re: How did LastPass master passwords get compromised?

#149

Post by ohyeshedid »

tuwtuwtuwtuw wrote: post #144
ohyeshedid wrote: post #142

Earlier quoted context omitted.

I don't have a link handy, nor currently familiar with LP's site or extensions: The part of the site that shows the recent connections to your account, with IP's. People were sharing those IP's and thoughts in the linked thread. That data came from somewhere; if it's related to this bug then this bug is also pushing incorrect data into other parts of the service. It's also entirely possible that it wasn't a bug, and…

> it's either a complicated bug or there's more to the story. I showed you pseudo-code which could trigger this issue. It was trivial code which could cause it in practice. Yet you claim it must be complicated or more to the story. I have no idea why you feel that classifying a request in a certain way must be caused by a complicated bug - very strange. I think you're into FUD-mode now because even after being shown…

Your example would've caused a much larger response, no? By most accounts, it didn't trigger for most users, so a simple flub like that should've triggered on more accounts.

I'm viewing this through the lens of multiple days of differing social groups poking at this, and the crowdsourced information that's yielded.

> ...shown wrong, you continue to spread misinformation.

You haven't shown anything wrong: neither of us know what actually happened. nor am I spreading misinformation, nor making statements as to what happened; I'm questioning it. Is there some reason you're so accusatory?

> Also, you are referring to LP functionality which to my knowledge doesn't even exist, and when asked you say you don't know the software being discussed.

[1]. I haven't touched LP in, ehhh, 10ish years, and it was a feature even back then.

[1]: https://support.logmeininc.com/lastpass/help/lastpass-accoun...

Re: How did LastPass master passwords get compromised?

#150

Post by mcguire »

ajb wrote: post #88
md_ wrote: post #37

Earlier quoted context omitted.

It's easy for me to imagine how you get here. - Eng are still writing the postmortem - Marketing want to put out a statement - Eng know or suspect a bug exists that can trigger spurious notifications, but don't have sufficient logs to be able to reconstruct if that bug was in fact in play in production - Legal advises not to say anything definitive that they can't stand behind later I don't see any of that as particu…

No, they say "As a result, we have adjusted our security alert systems and this issue has since been resolved." They are claiming they know what the bug was.

Not necessarily. That could be read as them simply turning off the alerts (ideally, until they figure out and fix the bug).
Post reply on HN