Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

171–180 of 326 posts

Re: LastPass users warned their master passwords are compromised

#171

Post by CyberRage »

2OEH8eoCRo0 wrote: post #121
civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

Confession: I write them down. My threat model is 100% aimed at remote attacks/hackers. I could not care less about law enforcement. I also use a hardware backed second factor.

That's still an issue. humanly generated passwords tend to be predictable, repetitive and not very long.

A computer will always do a better job at generating\remembering passwords.

hardware 2FA is definitely a good idea.

Re: LastPass users warned their master passwords are compromised

#172

Post by kerneloftruth »

samtho wrote: post #90
yawaworht1978 wrote: post #74

Earlier quoted context omitted.

Wow, how can this amount of files be justified? And how did this breached exactly happen?

> Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.

File count and general "bloat" is an indicator of the quality of the engineering in the product. Especially for a security product _minimalism_ should be evident -- nobody with good security sense would want or allow anything not truly necessary to the product's functionality to be included.

There's a lot of room between "super trivial" and "needlessly complex" -- it shouldn't be either.

Trusting a cloud-based third party with my passwords is a non-starter for me.

Re: LastPass users warned their master passwords are compromised

#173

Post by ThalesX »

I was considering some options to store passwords for both myself and my customers and LastPass was one of the candidates. After thinking about it, I went with Keepass and a single file that is stored on my cloud account. It's working great to be honest and at least I can keep track of my security chain.

Re: LastPass users warned their master passwords are compromised

#174

Post by Latty »

civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

Inherently less secure than an extension that fills the passwords, as it relies on you checking the URL correctly, while an extension will only fill it when the origin is correct, which means you are less likely to be phished (although a security key is even better for that).

Re: LastPass users warned their master passwords are compromised

#176

Post by CyberRage »

Barrin92 wrote: post #5
smegsicle wrote: post #2

related: Ask HN: How did my LastPass master password get leaked? https://news.ycombinator.com/item?id=29705957

all the speculation in that thread about how the password could have been leaked reminded me of a post earlier this year that drastically changed my view on password managers. (also generated a lot of discussion here) https://news.ycombinator.com/item?id=27407603

It doesn't compromise the master-password and is not wide-reaching as it requires the victim to be lured to a specific website.

Doesn't match what people claim here

Re: LastPass users warned their master passwords are compromised

#177

Post by vorpalhex »

tgsovlerkhgsel wrote: post #117
vorpalhex wrote: post #92

Earlier quoted context omitted.

The official story from LastPass and the claims of the reporters are in direct conflict. Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. One [incident] reporter claims they changed their master password and had a breach attempt using the new password. If that is true that is extremely alarming. There could be some malware targeting a…

> Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. As you mention yourself at the end, there are other plausible explanations (e.g. malware on the machines).

If there is a LastPass cache that is not encrypted, that is a breach since it is an application flaw.

If it is something like a keylogger, not so much.

Re: LastPass users warned their master passwords are compromised

#178

Post by tgsovlerkhgsel »

shakna wrote: post #147
tgsovlerkhgsel wrote: post #112

They claim it's credential stuffing, but there are plenty of people on the HN thread ( https://news.ycombinator.com/item?id=29705957 ) claiming to have used a unique password. Does LastPass/LogMeIn have a history of lying about/downplaying security incidents? I only remember a controversial (and to my knowledge unresolved) issue at TeamViewer (where the company claimed no compromise but due to the number of reports t…

Not lying, but definitely downplaying past incidents [0], of which they have had a number. [0] https://en.wikipedia.org/wiki/LastPass#Security_issues

Oh, that leads to an interesting possibility: Yet another vulnerability in their extension, allowing a malicious web site to access the master password.

This could be very hard to trace since users would have to notice the correlation between visiting a certain web site (or e.g. one of many compromised sites) and getting hacked. Worse, combined with malvertising, it could be exploited from almost any web site if the user doesn't block ads.

Re: LastPass users warned their master passwords are compromised

#179

Post by tyingq »

kerneloftruth wrote: post #172
samtho wrote: post #90

Earlier quoted context omitted.

> Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.

File count and general "bloat" is an indicator of the quality of the engineering in the product. Especially for a security product _minimalism_ should be evident -- nobody with good security sense would want or allow anything not truly necessary to the product's functionality to be included. There's a lot of room between "super trivial" and "needlessly complex" -- it shouldn't be either. Trusting a cloud-based third…

I posted the GP, with the sizes, etc. I think they do have a somewhat hard problem to solve though. They probably also want to minimize remote calls so that the extension is functional offline, is more secure, etc. Which would drive the size up, especially with localized errors, etc.

Re: LastPass users warned their master passwords are compromised

#180

Post by CyberRage »

laurent123456 wrote: post #11
Krasnol wrote: post #3

Let this be your Last non-selfhosted Pass solution.

Securing a server is hard for the average user. But in any case LastPass uses E2EE so if the password was compromised that's most likely on client side, and for this self-hosted or not would make no difference.

While I agree, Cloud based PM do have other issues.

Mainly with compromised\rogue updates, you push a malicious update to customers and then get access without needing to compromise the hosts.

Very similar to a supply-chain attack.

Post reply on HN