Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass stores passwords so securely, not even its users can access them

theregister.co.uk

Post reply on HN
Print view View original

151–160 of 266 posts

Re: LastPass stores passwords so securely, not even its users can access them

#151

Post by antoncohen »

jazzkingrt wrote: post #127
ghastmaster wrote: post #107

Earlier quoted context omitted.

If the service is down for a limited amount of individuals I consider it still up. This does beg the question of how many constitutes "down". I think the nature of the problem and quantity of users affected is important.

I disagree. The SLA ought to be made on a per-customer basis. 1% of users affected would mean 1% of users would be entitled to refunds/remedies that the SLA prescribes.

GCP has different SLAs for each product, but the ones I've seen are per-customer. The details vary by service, but they generally define downtime, like x% errors for y% amount of time, and then have financial penalties for z% downtime[1]. There are sometimes clauses requiring retries with exponential backoff[2].

Their SLAs are short and readable. It is worth reading a few of them, especially if you have a SaaS and are thinking about your own SLAs. Just search Google for [google $product sla] to find them.

[1] https://cloud.google.com/stackdriver/sla

[2] https://cloud.google.com/datastore/sla

Re: LastPass stores passwords so securely, not even its users can access them

#152

Post by yarrel »

iamaelephant wrote: post #108
criley2 wrote: post #49

I'm shocked to see a post of such low quality on hacker news. It reads like an instagram post or twitter replies. I'm not familiar with "theregister.co.uk" but I honestly think it's the lowest quality article I've ever seen on this website

> I'm not familiar with "theregister.co.uk" Then you're not qualified to be discussing software or the tech industry, frankly.

Or we're in an era where that sneering prototype for clickbait blogs is being rightly consigned to the dustbin of history.

When faced with a link to an article on The Register, searching for the source it's been copied from is a good first step.

Re: LastPass stores passwords so securely, not even its users can access them

#153

Post by Faark »

chousuke wrote: post #91
harryf wrote: post #53

Earlier quoted context omitted.

Not the OP and personally less radically against cloud-based services... But storing something as critical as passwords with a SAAS company which is obviously going to be target of attack and may or may not have the engineering resources to provide a reliable quality of service... seems like a bad idea. Google(Drive) at least I trust to have the engineering resources to keep data secure, perhaps not from government s…

They don't really store your passwords, just an encrypted blob that's openable with your master password (more accurately, a key that is derived from it using an expensive operation so that brute-forcing is unfeasible.) You do need to trust them enough that they will never sniff your master password (AFAIK even the web vault is local only) but eg. the command-line client is open source, so you can at least verify the…

I just don't want to store my passwords in exactly the same way everyone else does. I'm not a high value target, so my threat model is a 3rd party getting screwed / screwing us. Just a little bit of customization should be enough to throw off whatever tools attackers will build to mass harvest.

Re: LastPass stores passwords so securely, not even its users can access them

#154

Post by dehrmann »

robocat wrote: post #121
darkwater wrote: post #34

On a side, am I the only person that doesn't like The Register write style, especially the headings? Yeah, irony and fun all that you want, but it ends up looking like a gossip/tabloid magazine

It is very “British” with wit, puns, long running silly gags, in-jokes, smart headlines, sarcasm, and self-deprecating jokes. However, The Register is usually technically correct and regularly breaks important news (good journalism). Minor technical (or grammatical) errors will be lambasted in comments. Essentially, the style meshes well with it’s target readership, and they are very happy that anyone that doesn’t li…

"Biting the hand that feeds IT"

Re: LastPass stores passwords so securely, not even its users can access them

#155

Post by ars »

deepspace wrote: post #134
filipn wrote: post #7

So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: https://support.1password.com/import-lastpass/

I was a longtime LastPass customer, but the service just kept getting worse and worse, to the point where a year ago I realized I was spending more time fighting the user interface than it was saving me. And their support was absolutely useless. So I also switched over to 1Password, and never looked back. It is such a refreshing and trouble free experience compared to LP, and the few times I needed to ask a question,…

I've never used LastPass, why do people use it (or other password managers) instead of the built in browser password manager?

Re: LastPass stores passwords so securely, not even its users can access them

#156

Post by djannzjkzxn »

Supermancho wrote: post #68
sgift wrote: post #61

Earlier quoted context omitted.

> The fix went out less than half an hour after they learned about it, The article says the issues started on Friday and users told them then. So, it seems to be three days for a fix, not half an hour.

> it seems to be three days for a fix, not half an hour. You are trying to conflate 2 different metrics. The first assertion, is from the time the ticket was investigated, not submitted. It might be useful to talk about expectation of service, since that's what you are getting at. 3 days (over a weekend) is reasonable for a free tier, I would think. For a paid tier, maybe it should be more immediate.

As a user of paid LastPass and many other SaaS products, for me part of the value proposition is that I’m benefiting from the QA provided by free users. I expect bugs to be fixed quickly even if I don’t personally make a bug report. I’m especially unlikely to make a report if I already saw other people publicly complaining about the bug. Since most users don’t report bugs, software companies need to behave as though bugs are more common than reported.

Re: LastPass stores passwords so securely, not even its users can access them

#157

Post by joshschreuder »

mikedilger wrote: post #135
filipn wrote: post #7

So glad I switched to 1Password, haven't had an issue since. They provide an easy transfer of your passwords from LastPass, you can just follow their guide and be done in 5 minutes: https://support.1password.com/import-lastpass/

Bitwarden is also very good

I went from LastPass to Bitwarden and really like it also.

Re: LastPass stores passwords so securely, not even its users can access them

#158

Post by djannzjkzxn »

mk89 wrote: post #69
nullspace wrote: post #57

Earlier quoted context omitted.

That’s bullshit. In reality (I was affected by this and it’s now fixed), this happened 3 days ago, and I kept watching the status to see if they would identify it. I had to upgrade to premium support for them to even respond to the issue. I filed the issue on Friday or Saturday, and they got back to me on Sunday. And it looks like they have fixed it now. This was not a quick response time, don’t give them credit for…

It's a nice trick that many companies use. The best way is to build small agents to monitor the service you depend on to know whether they truly respect their SLA. In case of LastPass they don't even have an SLA....so good luck with an updated status.

I think this is an artifact of how SLAs are tied to billing. Anyone who had ever billed a corporation knows how they will jerk you around. It’s obvious that you won’t get a straight answer if you go and ask a company how much they owe you. That’s what a status page is. It’s the company’s first offer in the negotiation on how much they owe you for the outage. You need to calculate your own number in response.

Maybe a more scalable solution would be a third-party company that sells this information. I think there’s a lot of money to be made there.

Re: LastPass stores passwords so securely, not even its users can access them

#159

Post by hinkley »

arcticfox wrote: post #94
mk89 wrote: post #69

Earlier quoted context omitted.

It's a nice trick that many companies use. The best way is to build small agents to monitor the service you depend on to know whether they truly respect their SLA. In case of LastPass they don't even have an SLA....so good luck with an updated status.

I learned another nice trick from GCP the other day; Stackdriver log ingestion was down, at least for me and a number of people on Twitter, and they simply put a yellow warning at the top of status.cloud.google.com while fixing it instead of making an official incident. Magic, 100% uptime!

Saucelabs are kings of the "100% outage for 5% of our users = 95% availability" status update.

In particular I'd see repeatable problems where they couldn't launch whatever browser X operating system in under 2 minutes (when our tests would time out) and list allocation time as 'elevated' (say, 8s average vs their normal of 3s). If you start believing your own statistics you get into almost as much trouble as believing your own PR.

For an 18 month period where they were particularly bad, I think they only copped to an actual problem one time out of around a dozen cases where our CD pipeline was blocked for half a day or more unless we just turned off e2e tests entirely.

Re: LastPass stores passwords so securely, not even its users can access them

#160

Post by rafaelvasco »

Been using LastPass for years. Couldn't imagine living without it, with the gazzilon of passwords we have to handle. There's other services of course, but I've never felt compelled to leave. But I'd much prefer to not have to deal with any passwords at all in any service;
Post reply on HN