Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass setting the delete account div to display: none

infosec.exchange

Post reply on HN
Print view View original

141–150 of 210 posts

Re: Lastpass setting the delete account div to display: none

#141

Post by ziml77 »

owlbynight wrote: post #128

I pay close attention to the UX and UI of the tools that I use that are security critical. I switched off of LastPass 2 years ago and convinced my brother to do the same because some things in LastPass apps started to feel very old, especially their 2FA implementation, which signals to me that either their stack is inflexible or there's a lot of churn in their dev teams. When those things are true, that means they're…

Their interface has always felt clunky and outdated. I used to use them many years ago but ended up switching to Bitwarden and then to 1Password. I checked Lastpass out again a year or two ago, when evaluating if I wanted to stick with 1Password, and I was shocked to see that absolutely nothing had changed about their interface. Their password import-export mechanism was still a mess too. I had to manually fix-up many entries in the output CSV.

Re: Lastpass setting the delete account div to display: none

#142

Post by wilg »

atq2119 wrote: post #134
wilg wrote: post #127

I'm not seeing a lot of clarity on what I should do as a LastPass user? Nothing? Move to 1Password? I can't use iCloud keychain because I use Chrome on Mac.

Doesn't Chrome have a built-in password storage? Firefox does, which is what I use and recommend.

I just really don't want it to be tied to my browser or platform.

Re: Lastpass setting the delete account div to display: none

#143

Post by wilg »

CharlesW wrote: post #133
wilg wrote: post #127

I'm not seeing a lot of clarity on what I should do as a LastPass user? Nothing? Move to 1Password? I can't use iCloud keychain because I use Chrome on Mac.

FWIW, I did this exact migration a few years ago (to 1Password Family), and am generally very happy with 1Password. https://support.1password.com/import-lastpass/

Yeah, I've been thinking it probably has a nicer UX and is the best option. It's not exactly clear to me if LastPass actually has bungled the security here or if its just FUD. Is 1Password better from a security perspective in any concrete way?

Re: Lastpass setting the delete account div to display: none

#144

Post by selfmodruntime »

irrational wrote: post #109

I am a LastPass user. Unfortunately. I have things in passwords notes field (like answers to security questions) because I assumed that the notes section was encrypted. Some comments here on HN made me think they are actually not encrypted. I asked if they were encrypted or not to LastPass support and to the support forum. That was 2 days ago and there has been no response. I’m going to take that as a no. I’m working…

Metadata fields were unencrypted in last pass, sorry.

Re: Lastpass setting the delete account div to display: none

#145

Post by daveoc64 »

driscoll42 wrote: post #23
garganzol wrote: post #11

Is LastPass one of those password managers that only encrypt passwords and leave other data as is? I always cringe when password managers do that. This is a funny joke for anyone who understands even a little about cryptography.

This is very frustrating... I operated with LastPass on the assumption that the other data was encrypted in there. So backup authentication codes stored. Alas, time to invalidate a bunch of crap.

Most data fields are encrypted in the LastPass vault.

The real exception is URLs linked to passwords. Some metadata is also unencrypted (e.g. created date).

Both the "secure notes" category and the "notes" section on a password are encrypted.

Take a look at the following analysis of the LastPass data structure:

https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

Re: Lastpass setting the delete account div to display: none

#146

Post by grupthink »

thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

Might as well store your online passwords in your email, since it’s used for password resets. Might feel weird but your email is your weakest link anyway.

Re: Lastpass setting the delete account div to display: none

#147

Post by usrusr »

eurticket wrote: post #80
dhdgrygev wrote: post #43

Earlier quoted context omitted.

The average person, when not allowed to use a convenient password manager, will either use the same password for every site or come up with a predictable pattern. Encouraging a password manager helps make sure they don't get destroyed completely when a blog they signed up on 5 years ago is hacked. This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impos…

What are some good methods to not create patterns, while allowing yourself to have an easier time remembering more complicated passwords?

If you go for the shared strong secret part "uniquefied" by an added per-site trivial part (not saying that you should), you increase risk the longer the trivial part gets: if an attacker somehow determines that your password here is 123hacker456news789 they will easily guess that they can get into your Facebook using 123face456book789. Less easy if it's 123h456n789 (Because you don't really use the spaceballs password, in reality h and n don't stand out half as much). If it's 123c456w789 guessing Facebook's 123c456o789 from that would be quite close to brute forcing unless they get their hands on dozens off that kind.

Re: Lastpass setting the delete account div to display: none

#148

Post by lamontcg »

thot_experiment wrote: post #33

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting. Using a password manager is one…

> using a mental algorithm that generates a unique password per site.

If someone has access to one or more of your passwords and can reverse engineer your 'algorithm' then you have effectively just reused the same password everywhere. Even if you include some amount of memorized numbers or whatever the entropy is probably a lot lower than having an xkcd-strong password in a manager and randomized passwords stored in it.

Re: Lastpass setting the delete account div to display: none

#149

Post by daveoc64 »

irrational wrote: post #109

I am a LastPass user. Unfortunately. I have things in passwords notes field (like answers to security questions) because I assumed that the notes section was encrypted. Some comments here on HN made me think they are actually not encrypted. I asked if they were encrypted or not to LastPass support and to the support forum. That was 2 days ago and there has been no response. I’m going to take that as a no. I’m working…

All notes fields are encrypted.

Take a look at the following analysis of the LastPass data structure:

https://github.com/cfbao/lastpass-vault-parser/blob/master/l...

Re: Lastpass setting the delete account div to display: none

#150

Post by paledot »

koolba wrote: post #107
0x45696e6172 wrote: post #50

Earlier quoted context omitted.

Because it is better than the alternative. Pick two: (1) memorizable passwords (2) bruteforce-resistant passwords (3) account-unique passwords. The best tradeoff for me is (2)+(3) sacrificing (1), so I use a local password manager (named 'pass'). That said, I would never trust a 3rd party like LastPass.

Not being able to do #1 can be a feature. If you can’t easily login to your accounts it adds just the right amount of friction to buying things online.

Indeed, made worse/better by the need to fetch my Yubikey to sign in. Likewise how Firefox Focus helped me to kick my Facebook habit.
Post reply on HN