The situation at LastPass may be worse than they are letting on • Hacker News Board

Re: The situation at LastPass may be worse than they are letting on

#151

Post by lolinder » Sat, Dec 24, 2022, 3:38 AM UTC

mgsouth wrote: post #135

lolinder wrote: post #120

Earlier quoted context omitted.

But that is the same claim that Bitwarden and 1Password make. Both insist that they don't ever see your master password, which means that your vault security depends entirely on it being good enough. And both encrypt everything. Assuming that I trust Bitwarden not to lie about their security model, what do I gain by piecing together multiple tools to accomplish the same thing?

(Sorry, I turned around and made an edit, but not before you replied.) KeePass encrypts the entire database, all fields, as one giant blob. LastPass stores URLs and other fields as plaintext; these too can contain critically sensitive information. [Edit: (See I flagged it)] As far as know it wasn't LastPass's client that was compromised--it was their servers/data store.

Haha, the edits got very confusing but I think we're now on the same page.

Re: The situation at LastPass may be worse than they are letting on

#152

Post by pedrovhb » Sat, Dec 24, 2022, 3:40 AM UTC

ddejohn wrote: post #5

For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…

Doesn't necessarily mean it's safe. Say there's passwords accidentally appearing in logs as part of a traceback - even if the passwords are kept encrypted, just having access to the logs is enough. Even if everything is encrypted client-side, it could appear as part of a client crash dump being sent by telemetry. Leaked plaintext databases aren't the only possibility.

Re: The situation at LastPass may be worse than they are letting on

#153

Post by paulpauper » Sat, Dec 24, 2022, 3:42 AM UTC

bawolff wrote: post #49

If this was true, i feel like it would be a little strange for the attacker to use it to steal a small amount of crypto. Once its revealed how bad this is, there would probably be a small window before people change their passwords, i would assume attackers would either go for a big score before revealing this capability, or they would try to hit everything very quickly. Just hitting a tiny amount of crypto seems odd…

in a 3rd world country, a tiny bit of crypto is a nice sum

Re: The situation at LastPass may be worse than they are letting on

#154

Post by wlonkly » Sat, Dec 24, 2022, 3:50 AM UTC

aborsy wrote: post #124

This claim looks strange. A 16 characters password from all character types can’t be broken. How could hackers break the vault, with end to end encryption and such password?

A _random_ 16-character password from all character types can't be brute-forced. A password made from common dictionary words, with numbers substituted in with l33tsp3ak, and an exclamation mark on the end, is a different story. Passwords like that would be sitting in precomputed hash lists already.

Re: The situation at LastPass may be worse than they are letting on

#155

Post by jeeeb » Sat, Dec 24, 2022, 3:52 AM UTC

chank wrote: post #64

Having all your keys/passwords on a 3rd party server is something that I've never been willing to accept from a security standpoint. That's what always kept me from using a `hosted` solution. I do get the allure from a multi-user management aspect though.

FWIW. After using it at my previous workplace, I got a 1Password family account.

It’s got my (not particularly technical) wife using unique strong passwords for all her online accounts and made family password sharing easy. I think the convenience of the cloud is key to this.

I get that there’s a security risk that 1Password gets compromised and the app is infected with malware or there ends up being a vulnerability on their encryption scheme but it still feels like a net improvement to my overall online security.

Also MFA can help mitigate the risks of the passwords being compromised.

Re: The situation at LastPass may be worse than they are letting on

#156

Post by Eleison23 » Sat, Dec 24, 2022, 3:55 AM UTC

StanislavPetrov wrote: post #80

I feel like this is an excellent time to, once again, give out two reminders to anyone who needs reminding: "The cloud" is just someone else's computer. Sharing your password with anyone always makes you less secure.

[dead]

Re: The situation at LastPass may be worse than they are letting on

#157

Post by rio517 » Sat, Dec 24, 2022, 3:56 AM UTC

xwowsersx wrote: post #54

I've been using LastPass for years. Looks like I'm going to have to export everything from my LP vault and import it into Bitwarden. Any downsides to Bitwarden that anyone knows of? I'm asking more about convenience, i.e. how well the browser extensions and Android app work and less about security.

I moved to bitwarden and was happy at first, but after a while the app UIs were really annoying. They save/update password functions kept messing up and I would lose the password.

I eventually decided that the UI was too clunky to move my whole family onto and opted for 1password. Very happy with that choice.

Re: The situation at LastPass may be worse than they are letting on

#158

Post by smeej » Sat, Dec 24, 2022, 3:57 AM UTC

MBCook wrote: post #55

phphphphp wrote: post #47

Earlier quoted context omitted.

I agree: LastPass has been hot garbage for many years but it still has a significant presence, some guy’s low-value crypto wallets would not be the first we hear about a compromise of LastPass vaults. There are entire companies using LastPass for critical systems. I absolutely believe it’s possible that LastPass has been compromised more than they’ve let on and I won’t be surprised if we eventually find out vaults ar…

But if you had a ton of credentials from people, scanning for crypto credentials and trying to use those may be easier/faster/safer to turn into money than system credentials to some random company network.

They weren't really credentials, but keys. Pop those into any compatible wallet and you control the money now.

If someone had put the key in the URL field (because there is no corresponding URL because it's not a credential), and the URL field was unencrypted, that could account for it.

Re: The situation at LastPass may be worse than they are letting on

#159

Post by lolinder » Sat, Dec 24, 2022, 3:58 AM UTC

fanso99 wrote: post #87

Please stop commenting whether you are a LastPass user or not. Some of your profiles on HN have an email address and in general all your comments are public so can be mined, plus "rich techies" could be prime targets for more direct and elaborate phishing campaigns.

Aren't we assuming at this point that the attackers have the complete customer list? I imagine that it would be way easier for them to have a script query that list directly and search for names and emails to find high value targets, rather than reading through HN hoping for a hit.

Re: The situation at LastPass may be worse than they are letting on

#160

Post by msravi » Sat, Dec 24, 2022, 3:58 AM UTC

Best to just use pass (https://www.passwordstore.org/) with your own gpg key rather than rely on any 3rd party service. Then set up a git repository on a (free) google cloud instance, (or even use github/gitlab), and you're set to sync your passwords to all your devices.