Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

161–170 of 326 posts

Re: LastPass users warned their master passwords are compromised

#161

Post by [deleted] »

civilized wrote: post #125
onlyrealcuzzo wrote: post #107

Earlier quoted context omitted.

You could just use KeePass: https://keepass.info/ It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely. And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

Thanks for the tip! I will look into it. I am curious to find out how it syncs without servers. (I assume this is not an incredibly hard problem but we are just not used to doing things without "the cloud" these days)

[deleted]

Re: LastPass users warned their master passwords are compromised

#162

Post by 40four »

benbristow wrote: post #141
wepple wrote: post #31

LastPass has had a history of security incidents (no company can completely avoid incidents, but if security is literally a primary part of your value, you shouldn’t be having so many). Even worse, they have a history of doing hand-wavy corporate non-explanations for what actually happened in these incidents. The antithesis of being responsible and respecting users in the modern day.

To be fair to LastPass/LogMeIn, they're a company handling a lot of valuable information (passwords/form-fill data/card numbers/notes etc.) - and they're one of the biggest out there. You'd expect them to be one of the more targeted companies just because of the 'treasure' they hold - hence the more security breaches.

An “Ask HN” was just trending about this yesterday (https://news.ycombinator.com/item?id=29705957). Sounds like a good reason not to trust any third party service with my password database to me.

I’ve always taken the route of managing my own local Keepass DB & key files. Sure it’s more cumbersome, but it prevents me from having to decide whether or not to trust some third party vendor or not.

I know 100% that I’m in full control and I’ve never put my DB or key file in the cloud. I can sleep sound knowing that whatever password service, or file sharing service, somehow getting compromised, cannot endanger one of my most valuable assets

Re: LastPass users warned their master passwords are compromised

#163

Post by jgalt212 »

benbristow wrote: post #141
wepple wrote: post #31

LastPass has had a history of security incidents (no company can completely avoid incidents, but if security is literally a primary part of your value, you shouldn’t be having so many). Even worse, they have a history of doing hand-wavy corporate non-explanations for what actually happened in these incidents. The antithesis of being responsible and respecting users in the modern day.

To be fair to LastPass/LogMeIn, they're a company handling a lot of valuable information (passwords/form-fill data/card numbers/notes etc.) - and they're one of the biggest out there. You'd expect them to be one of the more targeted companies just because of the 'treasure' they hold - hence the more security breaches.

once again, maybe security through obscurity is not the worst idea...

Re: LastPass users warned their master passwords are compromised

#164

Post by GavinMcG »

gravypod wrote: post #53

Is there anything like lastpass that has TOTP + password remote backup that has a chrome plugin and an android application? I'm getting to the point where I'd love to switch off.

Bitwarden. Its TOTP service is a premium feature ($10 per year).

Re: LastPass users warned their master passwords are compromised

#165

Post by jeffrallen »

jjav wrote: post #158
jeffrallen wrote: post #48

Several years ago, I chose LastPass, bought it, and did all the set up. Then they were acquired by someone I didn't trust, so I immediately switched to 1Password, and never regretted it for a second. If 1Password sold out, I'd switch again, in a second.

While this is a good approach at a high level, it's also worth pointing out that the usage should not be based on trust. You should evaluate if you're comfortable using this or that password manager even if they were aquired by the most evil company you can think of. If the design is solid, it shouldn't matter since the evil company shouldn't be able to compromise anything. If it does matter, then you shouldn't be us…

Yes, but password manager vendors seem to insist on moving towards cloud subscriptions, instead of "buy it once and you host it", which means you are somewhat dependent on them. If 1Password keeps pushing this direction and makes Dropbox sync stop, I'm SO outta there.

Re: LastPass users warned their master passwords are compromised

#166

Post by Kiro »

SCLeo wrote: post #115

To those who are recommending all different password managers, I have a question: why not using Chrome (or Firefox/Edge/ )'s built-in password manager? I have been using it for a couple years and haven't noticed any issue. Even if Google decides to screw me over and terminates my Google account, I can still access the passwords via the local copy in Chrome, so that is not really a concern. (Though, don't take this as…

For most people, using the browser's built-in password manager is the only realistic way for them to start using a password manager. All you have to do is select "Suggest strong password" and the rest is taken care of. My mom now uses a password manager without even knowing what a password manager is. She would never install something like LastPass.

I've done the same transition. I was too lazy to install a password manager and didn't care enough about my online accounts. Now I have strong passwords on all my accounts and they propagate to my Android apps automatically, without me having to do anything. I also trust Google's security.

Re: LastPass users warned their master passwords are compromised

#167

Post by sysstemlord »

foxfluff wrote: post #157
sabhiram wrote: post #116

Earlier quoted context omitted.

Seems useful, the name gave me a chuckle. If I only saw the URL, I would imagine this was a service that providing info on preserving your buttocks.

There's a service "keeping donkeys". You can adopt your own https://www.thedonkeysanctuary.org.uk/adopt

Asley looks nice, I always wanted when I get a donkey to name it Ashley.

Re: LastPass users warned their master passwords are compromised

#168

Post by KennyBlanken »

Lanrei wrote: post #113
civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

If you want to store you passwords locally, then at least use something like Keepass or KeepassXC. It's far from a perfect solution as it's still vulnerable to targeted attacks when it's being used if your computer is compromised. But at least they're not store in plain text. Also password auto-typing and generation are nice to have. You can sync the encrypted files to your phone or other computers.

This is why newer versions of MacOS require you to grant permissions for an application to access folders in your user account. If you keep the keepass database in a folder like "secure", then no other program will be able to get to it. On Linux, there are a ton of ways of implementing something similar.

KeepassXC requires authorizing a plugin, and authorizing specific sites before it releases a password.

Re: LastPass users warned their master passwords are compromised

#170

Post by foxfluff »

strenholme wrote: post #150

This is why I rolled my own cryptography to generate random passwords for each site I use. There is a tradition here that we tell programmers they must never write cryptographic code, that they will screw it up, and so on. To which I say: Yes, I agree that writing crypto code if you don’t know what you are doing can cause problems. It should not be done unless you know what you are doing; if you think using MD5 in an…

I have planned a very similar thing. I'll probably have it in my custom keyboard's firmware once I'm done building it.

The idea is one or more "master" password(s) that can be stored in keyboard's RAM (so you don't need to type them every time; and yet you still never need to input it into your computer at all!), then a short memorable site-specific "password" (could be as simple as the site's name) plus a prefix/postfix that adjusts the output to work around different services' fucked up password rules.

I might also make a completely offline device for this in case I need to "look up" a password without actually typing it into a computer.

I don't need to write any crypto for this, just use a well known and secure KDF / hash.

Post reply on HN