Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did LastPass master passwords get compromised?

palant.info

Post reply on HN
Print view View original

161–170 of 189 posts

Re: How did LastPass master passwords get compromised?

#161

Post by latortuga »

tuwtuwtuwtuw wrote: post #46
latortuga wrote: post #39

Earlier quoted context omitted.

Plenty of folks who reported getting this email from LP, including myself, reported that they used a strong unique passphrase for LP only.

LastPass wrote that there was a bug causing these emails to be sent. That may be correct, because several persons have reported reproducing that issue before the LastPass fix - they have written that they logged on with incorrect password while using an IP from another country and still got the email that their master password was used.

Very interesting and would set my mind a bit more at ease.

Re: How did LastPass master passwords get compromised?

#162

Post by wongarsu »

nmca wrote: post #89
imwillofficial wrote: post #86

Earlier quoted context omitted.

This is broken thinking built on faulty assumptions. There are countless examples of massive conspiracies and secrets never leaking.

Can you provide some? I have previously only heard "santa".

D-Day and the operations around it? Various price fixing cartels that were eventually prosecuted?

Naming conspiracies that have never leaked is kind of hard, since we wouldn't know about them. So you have to look for examples of things that were talked about after they stopped being relevant, or that were uncovered without anyone blabbing.

Re: How did LastPass master passwords get compromised?

#163

Post by sixothree »

necovek wrote: post #22
8organicbits wrote: post #16

Earlier quoted context omitted.

I wish there was a good way to implement this sort of double hashing in web apps. Doing the extra salted hash client side ensures that the value the server sees is globally unique, even when the user is reusing passwords across sites. Unfortunately the only way I know how to implement that is to have the server send JS down to the browser that instructs it to perform the hashing. For certain types of compromises serv…

Everything you explain points at no need to do client side hashing: what exact attack vector would be stopped by having it? (The only thing you bring up is reuse of passwords, but then you explain how that would be easily exploited if server was compromised, and it's even easier if client is) I would imagine most developers unfamiliar with encryption would assume that client hashing is sufficient and not bother with…

I assumed the point would be to store all of the salt values ever used server side and never allow reuse of a salt. That way if the hash is captured but has already been used then it is useless.

Re: How did LastPass master passwords get compromised?

#164

Post by t0astbread »

yonixw wrote: post #152
Dedime wrote: post #128

This whole LastPass kerfuffle has solidified my choice to continue using FOSS + self hosted password managers only. If my passwords get stolen, I'd rather be responsible for the loss than wait for a company to put out a squirrely statement.

I was self-hosted enthusiast myself, until I found out that self- updating is not fun, not always compatible and thus not secure*. And therefore, I take the hard pill of SaaS even if security wise, it is hard to swallow. *Not secure: It will always catch you off guard, and will require a lot of work, so you will postpone it which is, not secure.

What about an offline password manager? Like pass[1] or one that supports the KeePass format. Then you could use your regular file synchronization tool to synchronize the database files. You could also use a P2P sync tool like Syncthing. (Of course this makes more sense if you already have some kind of file sync setup.)

[1] https://www.passwordstore.org/

Re: How did LastPass master passwords get compromised?

#165

Post by 8organicbits »

grogenaut wrote: post #99
8organicbits wrote: post #72

Earlier quoted context omitted.

I've only seen client certs used in contexts where an IT department assigns them to employees. Has anyone had success with these on public facing websites? Extra hardware seem cool, but I've also rarely seen people using them. I'm guessing the added cost is a deterrent.

before the current wave of password managers most people didnt use more than one password. they made it easy enough for people to use. now theyre everywhere. the things you list above are the new oddball ui issues, smooth them out a but amd people will use them too.

I see lots of folks in the tech industry using password managers and using the password manager to create and fill passwords. I've also seen people use password managers to remember the ~1 password they self created and consistently reuse.

I'd like to see more password manager use, but changing user behavior is hard. Google suggests https://services.google.com/fh/files/blogs/google_security_i...

Re: How did LastPass master passwords get compromised?

#166

Post by lemarchr »

faeyanpiraat wrote: post #19
8organicbits wrote: post #16

Earlier quoted context omitted.

I wish there was a good way to implement this sort of double hashing in web apps. Doing the extra salted hash client side ensures that the value the server sees is globally unique, even when the user is reusing passwords across sites. Unfortunately the only way I know how to implement that is to have the server send JS down to the browser that instructs it to perform the hashing. For certain types of compromises serv…

But then malware on the user’s machine could catch that password. There is no 100% solution to this.

Malware on the user's machine could catch the password in either case.

Re: How did LastPass master passwords get compromised?

#168

Post by nix9000 »

jjav wrote: post #141
mgraczyk wrote: post #34

Earlier quoted context omitted.

One advantage of telling the truth is that you don't go to prison for fraud. When evaluating this kind of conspiracy theory, it's important to consider the number of people who would have to remain silent for the conspiracy to survive, and to consider how much it would cost to keep that many people silent. In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very lo…

> In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very long. This is a very unlikely expectation. Employees are under NDA so nobody will talk publically about it unless one of them feel so strongly about it to sacrifice their career (they'd certainly get fired, and being sued for breaching the NDA isn't going to make finding a new job easier). Employees at all…

>being sued for breaching the NDA isn't going to make finding a new job easier

NDAs are unenforceable against whistleblowers who report illegal activity.

Re: How did LastPass master passwords get compromised?

#169

Post by ajb »

foobiekr wrote: post #130
joenathanone wrote: post #119

Earlier quoted context omitted.

They *need* to go into great detail if people are supposed to trust them with their digital life. That statement isn't nearly enough.

After all the problems with lastpass, who was even trusting them at this point?

My employer tried to move off them 2 years ago and didn't manage it.

The problem is the year subs. To avoid wasting money you need to do it at the end of a year, but you also need to get your users trained up before the switch. We hit a complication and ran out of time and so had to re-up.

Re: How did LastPass master passwords get compromised?

#170

Post by ajb »

joenathanone wrote: post #119
ajb wrote: post #88

Earlier quoted context omitted.

No, they say "As a result, we have adjusted our security alert systems and this issue has since been resolved." They are claiming they know what the bug was.

They *need* to go into great detail if people are supposed to trust them with their digital life. That statement isn't nearly enough.

Yeah absolutely.
Post reply on HN