Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

151–160 of 326 posts

Re: LastPass users warned their master passwords are compromised

#151

Post by howdydoo »

civilized wrote: post #125
onlyrealcuzzo wrote: post #107

Earlier quoted context omitted.

You could just use KeePass: https://keepass.info/ It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely. And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

Thanks for the tip! I will look into it. I am curious to find out how it syncs without servers. (I assume this is not an incredibly hard problem but we are just not used to doing things without "the cloud" these days)

Use any service you want, Syncthing, Dropbox, etc. Keepass is smart about saving. If the DB is modified in the background while it's open, it will merge your changes rather than overwrite.

Re: LastPass users warned their master passwords are compromised

#152

Post by SCLeo »

hn_throwaway_99 wrote: post #131
SCLeo wrote: post #115

To those who are recommending all different password managers, I have a question: why not using Chrome (or Firefox/Edge/ )'s built-in password manager? I have been using it for a couple years and haven't noticed any issue. Even if Google decides to screw me over and terminates my Google account, I can still access the passwords via the local copy in Chrome, so that is not really a concern. (Though, don't take this as…

Google's/Chrome's password manager would be reasonable if I could actually add passwords to it, manually . It only saves passwords that you type in a login page in the browser. So for the plethora of other credentials I need to manage it's less than useless, because it just gets in the way.

Oh. That is true. I did not run into this issue personally but I just checked and they indeed do not have such option. It is kind of bizarre they don't have this functionality.

Re: LastPass users warned their master passwords are compromised

#153

Post by Kiro »

AceJohnny2 wrote: post #120
SCLeo wrote: post #115

To those who are recommending all different password managers, I have a question: why not using Chrome (or Firefox/Edge/ )'s built-in password manager? I have been using it for a couple years and haven't noticed any issue. Even if Google decides to screw me over and terminates my Google account, I can still access the passwords via the local copy in Chrome, so that is not really a concern. (Though, don't take this as…

Browser-based managers only work in those browsers. I use passwords on my iPhone, MacBook, and Windows, so I need a manager that can provide passwords across all of those (and not just in a browser)

My passwords from Chrome propagate automatically to my Android apps.

Re: LastPass users warned their master passwords are compromised

#154

Post by umvi »

marcus_cemes wrote: post #148
umvi wrote: post #128

Algorithmic passwords. Come up with an algorithm a(website, rules) that you can remember and that generates unique passwords per website. Store the rules (length restrictions, special character restrictions, number of times the password has changed, etc) in a google doc or something. Print out your algorithm on a physical piece of paper and put it in a safe place for after you die and people need to access your accou…

Sounds like a lot of mental work just to log in. Or... Try a self-hosted password manager, or one that generally has a much better reputation?

Mental work vs. physical work, pick your poison. Self-hosted password managers aren't work-free, you have to set them up and get them working across all your devices and maintain them.

When I need to log into Nintendo's eShop from my Switch, I use my algorithm. How does that work for a self-hosted super long random Bitwarden password? I'm guessing I need to bring up the password on my phone or something and manually copy and compare it digit by digit into the Switch which sounds like a lot of work.

Re: LastPass users warned their master passwords are compromised

#155

Post by SCLeo »

AceJohnny2 wrote: post #120
SCLeo wrote: post #115

To those who are recommending all different password managers, I have a question: why not using Chrome (or Firefox/Edge/ )'s built-in password manager? I have been using it for a couple years and haven't noticed any issue. Even if Google decides to screw me over and terminates my Google account, I can still access the passwords via the local copy in Chrome, so that is not really a concern. (Though, don't take this as…

Browser-based managers only work in those browsers. I use passwords on my iPhone, MacBook, and Windows, so I need a manager that can provide passwords across all of those (and not just in a browser)

You can actually access the passwords via passwords.google.com. That is what I have been using when I need to log into an app on my phone.

Re: LastPass users warned their master passwords are compromised

#156

Post by dylan604 »

_jal wrote: post #119
junon wrote: post #66

Earlier quoted context omitted.

1password has been audited a bazillion times. They're E2EE. They're cheap. Your master passwords aren't stored on their servers. Neither is your key information. The only thing I pay for is the managed hosting, but in theory it's not much different than anything else properly designed (e.g. bitwarden) aside from the obvious things, such as OSS-ness. The only relevant CVEs are relatively mild compared to LastPass. Giv…

Happy to give them credit. I just refuse to give them my passwords. > The only thing I pay for is the managed hosting Funny, I was happy to pay them until they removed my ability to store it myself. edit: > CVEs are relatively mild compared to LastPass LP is not the relevant comparison. The relevant comparison is an encrypted store on my laptop.

I still use an older version of 1Pass specifically so I can run things locally. Sometimes, I wish I was ignorant to all of this stuff and could just be a plebe out in the wild using all of the convenient software out there. Just take the blue pill and put me back in the matrix. The knowing of all of this stuff just makes life so much more difficult.

Re: LastPass users warned their master passwords are compromised

#157

Post by foxfluff »

sabhiram wrote: post #116
onlyrealcuzzo wrote: post #107

Earlier quoted context omitted.

You could just use KeePass: https://keepass.info/ It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely. And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

Seems useful, the name gave me a chuckle. If I only saw the URL, I would imagine this was a service that providing info on preserving your buttocks.

There's a service "keeping donkeys". You can adopt your own https://www.thedonkeysanctuary.org.uk/adopt

Re: LastPass users warned their master passwords are compromised

#158

Post by jjav »

jeffrallen wrote: post #48

Several years ago, I chose LastPass, bought it, and did all the set up. Then they were acquired by someone I didn't trust, so I immediately switched to 1Password, and never regretted it for a second. If 1Password sold out, I'd switch again, in a second.

While this is a good approach at a high level, it's also worth pointing out that the usage should not be based on trust.

You should evaluate if you're comfortable using this or that password manager even if they were aquired by the most evil company you can think of. If the design is solid, it shouldn't matter since the evil company shouldn't be able to compromise anything. If it does matter, then you shouldn't be using that software no matter how much you trust the company (because regardless of trust, they're still subject to secret court orders etc.)

Re: LastPass users warned their master passwords are compromised

#159

Post by shakna »

bryan0 wrote: post #7

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. Must be a compromised browser extension at this point. > To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after c…

> Must be a compromised browser extension at this point.

In their 2019 breach, JS on arbitrary pages was able to access the contents of LastPass' own extension to obtain the last used username/password combinations. [0]

As, today, the extension now contains 25Mb of JS, making it difficult to audit, I wouldn't say that it has to be someone else's fault until proven.

[0] https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

Re: LastPass users warned their master passwords are compromised

#160

Post by dylan604 »

FearlessNebula wrote: post #61
_jal wrote: post #51

Earlier quoted context omitted.

Nope. Keeping my secrets store on someone else's computer is simply not compatible with my threat model. Yes, they say it is encrypted, and I believe them and believe they're competent. But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.

How do you sync your passwords across all of your machines? Do you self host your passwords on your own server? Do you manually sync?

1Pass has the ability to sync via WiFi, Dropbox, iCloud, etc. I only use the WiFi as the other options are still cloud platforms I don't trust.
Post reply on HN