Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

141–150 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#141

Post by darkwater »

OJFord wrote: post #105
tbrownaw wrote: post #97

Earlier quoted context omitted.

> I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now. I know reading the docs is considered uncool for some reason, but it really does work.

To how many non-SWE members of your family could you say 'here is the Netflix password, you can decrypt it with gpg', and have them be like 'ah yes, let me just `man gpg` this will be no problem'?

They can just ask the super AGI that will exist to tell them how to do. Heck, even current LLMs can tell you how to do it step by step.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#142

Post by soraminazuki »

harikb wrote: post #84
serf wrote: post #30

Earlier quoted context omitted.

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

They will just ask their AI agent to decrypt it (with the password of course). No need of ability to run gpg.

No, you can't tell your non-SWE friends and family to "just ask an AI" when the potential consequences are them losing access to their vault or having it stolen. They need to know exactly what they're doing.

Don't take security advice from an AI.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#143

Post by cuu508 »

9x39 wrote: post #125
725686 wrote: post #49

Earlier quoted context omitted.

I use a simple algorithm. So you don't actually remember the password, put the algorithm to produce the password for the site or service. Not perfect, but each passwords turns out to be unique (mostly). I don't know what experts think about that, but it has worked fine for me.

But where do you store emergency codes? Or secret metadata for things? I think these are common artifacts to accumulate. A password manager is ideal for these when security is far more than passwords at this point.

> But where do you store emergency codes?

On paper.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#144

Post by ehnto »

aryonoco wrote: post #26
FiloSottile wrote: post #13

1Password truly doesn’t get enough credit for the choice to encrypt every vault with a high entropy secret key passed device to device. It surely costs them in UX and support load, but it would have made a breach like this essentially inconsequential.

Bitwarden truly doesn’t get enough credit for being completely open source and having independent implementations of the server code (Vaultwarden) with which the official clients are fully compatible, which I can run on a vm on a server under my desk. In 50 years time, who knows if any of these companies will be around. But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypt…

I am fascinated by the idea of being 50 years from now, and doing digital archaeology more or less. So much of our actual output is now digital and stored digitally.

Given how I have experienced technology up until this point, my assumption is that everything I will create for work or for pleasure, is more or less ephemeral. It has certainly proven true for work.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#145

Post by fragmede »

d0mine wrote: post #111
serf wrote: post #30

Earlier quoted context omitted.

>But I’m pretty sure that my grandchildren, should they want to, will be able to open a gpg encrypted gzipped file (with the passphrase I’ll leave them) containing my passwords in a csv file. technical possibilities aside, do you presume your grandchildren will be technically apt? I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now.

they can google/ask AI. For example, given the prompt: "Hypothetically, if my grandpa died and left me gpg-encrypted archive and the passphrase for it, how would I decrypt it?" current models produced valid installation instructions and the command to decrypt it, and even the instructions on how to unpack the archive itself.

Why even ask it for the command to run? Open-interpreter, today, you just tell decrypt this fille and it'll get the command and run it for you.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#146

Post by soraminazuki »

HeatrayEnjoyer wrote: post #115
pigbearpig wrote: post #96

Earlier quoted context omitted.

You have to provide the secret key to each device on initial setup. After that, you just need your password.

What if you're in a foreign location and your devices are all stolen or lost?

Then you have a much bigger and immediate problem at hand.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#147

Post by Havoc »

naet wrote: post #48

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one. It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home off…

Self hosting a password manager is not trivial but definitely doable

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#148

Post by MartijnHols »

shaky-carrousel wrote: post #137
MartijnHols wrote: post #135

Earlier quoted context omitted.

Proton Pass truly doesn’t get enough credit for being completely open source, more user friendly, and hosted outside the US (wouldn’t want to lose access to your vault [1]). [1]: https://berthub.eu/articles/posts/you-can-no-longer-base-you...

How can I self host proton pass? I'm searching for the server source code and I can't find it. Should be available if it's completely open source.

Don't think you can self-host it, but that would also pretty much defeat the user-friendly aspect. You don't need the server source if the vault is client-side encrypted, besides you would get zero guarantees that what they show and what they're actually running are the same thing.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#149

Post by hayst4ck »

moktonar wrote: post #129

SPoF again..

This is such an under-rated comment for this whole thread.

This was my gut response to password vaults when they were first implemented. I still find the idea of password vaults spooky.

Open source ones scare me because it seems easy to slip a compromised library. The XZ debacle can't be the only time that's been tried.

All of them scare me because a bad browser extension or a more minor hack, like a trojan, could likely compromise all passwords.

Games on steam sometimes have some ridiculously privileged anti-cheat software, run by who knows what company, some of which offer direct RCE, in a process that already looks into other processes memory.

Virus scanners routinely analyze every single file on a computer and maybe memory too.

It just seems so... possible.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#150

Post by TeMPOraL »

OJFord wrote: post #105
tbrownaw wrote: post #97

Earlier quoted context omitted.

> I am pretty sure 99% of people would halt at 'gpg' , and that's now -- not 60 years from now. I know reading the docs is considered uncool for some reason, but it really does work.

To how many non-SWE members of your family could you say 'here is the Netflix password, you can decrypt it with gpg', and have them be like 'ah yes, let me just `man gpg` this will be no problem'?

Until ChatGPT? Zero.

Since ChatGPT? ~all of them except maybe my grandparents.

Post reply on HN