Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

141–150 of 587 posts

Re: Lastpass Security Incident

#141

Post by kawsper »

babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

I keep them local too, but I haven't found a solution on how to keep my laptop and phone in sync.

It is not fun having to type a 30+ character password consisting uppercase+lowercase letters, numbers and special characters on a mobile device.

But it has helped me to keep my phone clutter free, so maybe there's an upside to it too :)

Re: Lastpass Security Incident

#142

Post by shakow »

kawsper wrote: post #141
babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

I keep them local too, but I haven't found a solution on how to keep my laptop and phone in sync. It is not fun having to type a 30+ character password consisting uppercase+lowercase letters, numbers and special characters on a mobile device. But it has helped me to keep my phone clutter free, so maybe there's an upside to it too :)

Have you tried pass (https://www.passwordstore.org/)?

Re: Lastpass Security Incident

#143

Post by MerelyMortal »

kibwen wrote: post #79
_zer0 wrote: post #60

Earlier quoted context omitted.

I generate the password and stored them in my password manager under the notes. 1Password added functionality seemingly recently to add security questions and generate a random word string that I use these days.

Note that you should not generate a random password like D27fX$0f7RyD for your security questions. These are designed to give to a human operator on the other end of a phone. If an attacker calls up the account recovery line, gets asked for a security question, and just says "heh, I think it was a string of random characters", there's a decent chance the human operator will let them into the account. As you say, use…

Yep, if you can choose the question, choose something like "What was your first pet's name?" and then make up something silly like "Mister Poopy Eyes" (a conceivable child-given pet name).

Re: Lastpass Security Incident

#144

Post by matkoniecz »

postalrat wrote: post #81
tylerhou wrote: post #61

Earlier quoted context omitted.

What's the alternative? 1. Have people manage their own secrets storage? Most people don't have the time or ability do this securely either. I'd rather pay someone else to secure infra, code, distribution, encryption, backups, etc. for me. 2. Reuse the same password on every site? One site gets hacked and now you're screwed. 3. Memorize a unique, long password for every site? Not feasible. Third-party/commercial pass…

Passwords suck. Move on to something better.

what?

Re: Lastpass Security Incident

#145

Post by brazzledazzle »

babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

Last time I tried it the UX for sharing/collaborating on a keepass database was horrendous at best. Has that improved in the intervening years?

Re: Lastpass Security Incident

#146

Post by paulryanrogers »

kawsper wrote: post #141
babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

I keep them local too, but I haven't found a solution on how to keep my laptop and phone in sync. It is not fun having to type a 30+ character password consisting uppercase+lowercase letters, numbers and special characters on a mobile device. But it has helped me to keep my phone clutter free, so maybe there's an upside to it too :)

KeePass2android and KeePassDX can help on Android. You can self host such as on NextCloud

Re: Lastpass Security Incident

#147

Post by SparkyMcUnicorn »

nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

I can never recommend 1Password enough.

When it comes to hosted options, they are hands down the best. Worth pointing out that they also have integrated 2FA, if you're satisfied with first and second factor living in the same spot.

https://1password.com

Re: Lastpass Security Incident

#148

Post by joenathanone »

aussieguy1234 wrote: post #132
cwkoss wrote: post #74

If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts

LastPass is architectured so that your master password is never sent to their servers. Decryption of your vault happens locally on your device. Maybe such an attacker might get your email address (username).

Well, it should go without saying but their architecture cannot be trusted at this point.

Re: Lastpass Security Incident

#149

Post by sirmarksalot »

bigDinosaur wrote: post #41
bombcar wrote: post #20

Someday one of these password managers is going to be hacked wide open and it is NOT going to be pretty.

The core problem is really that passwords suck and should never be the entirety of authentication. Time for hardware tokens! (admittedly there are some big problems when people lose tokens, but at least that's not a problem of insecurity ;-))

Depends on how you define "insecurity". Availability is one of the pillars of security, so even your joke falls apart.

Several years ago the trendy thing to do for security was to get a USB-A security dongle and lock your important accounts with it. Nowadays, laptops from several major manufacturers no longer ship with a USB-A port, so if you need to log in again and don't have a USB-C dock handy, you're locked out until you can find one.

Re: Lastpass Security Incident

#150

Post by matkoniecz »

babypuncher wrote: post #102

And here I am still just using KeePass. I feel like passwords can be way too sensitive to entrust to a third party. Even if you can verify that it is secure, you could still find yourself in a jam if their service goes down or is otherwise inaccessible. You don't have to worry about any of this with a KeePass database. You just have to deal with the very mild inconvenience of keeping your database synchronized across…

> You just have to deal with the very mild inconvenience of keeping your database synchronized across devices.

For HN crowd that is likely easy. (I also use that solution)

Post reply on HN