Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

181–190 of 326 posts

Re: LastPass users warned their master passwords are compromised

#181

Post by feoren »

hetspookjee wrote: post #99
samtho wrote: post #90

Earlier quoted context omitted.

> Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.

I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.

Nitpick: "orthogonal" would mean "independent of"; that is, a high dependency count has no effect on exposure. I think you might have meant "antithetical", meaning "in opposition to".

Re: LastPass users warned their master passwords are compromised

#182

Post by vorpalhex »

gruez wrote: post #118
vorpalhex wrote: post #91

Earlier quoted context omitted.

Because each hardware key is unique, this is not a feature currently available nor likely to become available. Each token from the yubikey is not (readily) linkable to the key itself since the underlying secret is opaque and can't be exported, so tricks like Shamir's aren't readily possible. Yubikeys do solve a lot of use cases very well but that is a downside to them. That is probably still a good tradeoff for most…

>Because each hardware key is unique, this is not a feature currently available nor likely to become available. You don't necessarily have to do it crypto wallet style and have the private key be exportable. Just adding a public key export (on the security token side) and a way to enroll a token by its public key (on the browser/website side) would allow you to enable 2fa without having to make a trip to the safe dep…

It looks like Yubikey supports ECDSA keys as of 5.2.3 (Yubikey 5+ devices) and will export the public keys and allows private key signing so this should be possible. It will be an irregular yubikey flow code wise but user wise will appear normal.

Re: LastPass users warned their master passwords are compromised

#183

Post by CyberRage »

umvi wrote: post #128

Algorithmic passwords. Come up with an algorithm a(website, rules) that you can remember and that generates unique passwords per website. Store the rules (length restrictions, special character restrictions, number of times the password has changed, etc) in a google doc or something. Print out your algorithm on a physical piece of paper and put it in a safe place for after you die and people need to access your accou…

Password managers offer plenty of perks. Automatic logins, notes, tokens\OTP and more.

Writing passwords each time is so old now. there are plenty of good password managers either local or cloud based.

Re: LastPass users warned their master passwords are compromised

#184

Post by smitop »

bryan0 wrote: post #7

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. Must be a compromised browser extension at this point. > To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after c…

For me I was able to reset my account (which removes all data) but not delete it. It appears to be an issue with their WAF blocking requests to the account deletion endpoint.

Re: LastPass users warned their master passwords are compromised

#185

Post by ak217 »

benbristow wrote: post #141
wepple wrote: post #31

LastPass has had a history of security incidents (no company can completely avoid incidents, but if security is literally a primary part of your value, you shouldn’t be having so many). Even worse, they have a history of doing hand-wavy corporate non-explanations for what actually happened in these incidents. The antithesis of being responsible and respecting users in the modern day.

To be fair to LastPass/LogMeIn, they're a company handling a lot of valuable information (passwords/form-fill data/card numbers/notes etc.) - and they're one of the biggest out there. You'd expect them to be one of the more targeted companies just because of the 'treasure' they hold - hence the more security breaches.

You can search "lastpass project zero" to see a pattern of specific examples of how LastPass does not seem to have a well-organized approach to security.

Re: LastPass users warned their master passwords are compromised

#186

Post by foxfluff »

tyingq wrote: post #72
bryan0 wrote: post #7

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. Must be a compromised browser extension at this point. > To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after c…

>Must be a compromised browser extension at this point Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit. Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility. Edit #2: Some of the larger js files do have a fair amount o…

> Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping .. total of 25MB of javascript.

For (a totally bogus but hey) comparison, I'm shipping products which include the Linux kernel, userland (busybox plus a pile of scripts and some daemons & other utilities), "the application" (two-three hundred thousand lines of C maybe?) plus deps (including sqlite, crypto libs, etc.) and the compressed image that contains all of this easily fits in 16MB SPI NOR flash with a few megs to spare.

Re: LastPass users warned their master passwords are compromised

#187

Post by phs318u »

40four wrote: post #162
benbristow wrote: post #141

Earlier quoted context omitted.

To be fair to LastPass/LogMeIn, they're a company handling a lot of valuable information (passwords/form-fill data/card numbers/notes etc.) - and they're one of the biggest out there. You'd expect them to be one of the more targeted companies just because of the 'treasure' they hold - hence the more security breaches.

An “Ask HN” was just trending about this yesterday ( https://news.ycombinator.com/item?id=29705957 ). Sounds like a good reason not to trust any third party service with my password database to me. I’ve always taken the route of managing my own local Keepass DB & key files. Sure it’s more cumbersome, but it prevents me from having to decide whether or not to trust some third party vendor or not. I know 100% that I’m…

I recommend this every time a similar news item gets posted. Password Safe (designed by Bruce Schneier). I use the iOS and Linux apps and keep them synced via DropBox. Been around for years (I've been using it almost as long). Still getting updates. Still works. https://pwsafe.org

Re: LastPass users warned their master passwords are compromised

#188

Post by lathiat »

dylan604 wrote: post #156
_jal wrote: post #119

Earlier quoted context omitted.

Happy to give them credit. I just refuse to give them my passwords. > The only thing I pay for is the managed hosting Funny, I was happy to pay them until they removed my ability to store it myself. edit: > CVEs are relatively mild compared to LastPass LP is not the relevant comparison. The relevant comparison is an encrypted store on my laptop.

I still use an older version of 1Pass specifically so I can run things locally. Sometimes, I wish I was ignorant to all of this stuff and could just be a plebe out in the wild using all of the convenient software out there. Just take the blue pill and put me back in the matrix. The knowing of all of this stuff just makes life so much more difficult.

Maybe look at BitWarden

Re: LastPass users warned their master passwords are compromised

#189

Post by howdydoo »

SCLeo wrote: post #149
howdydoo wrote: post #142

Earlier quoted context omitted.

Google is an advertising company. In the coming years, they'll continue to erode the privacy of Chrome users. I've long since reached the breaking point and switched to firefox. You may not be there yet, but when the time comes, you should make it as easy to switch for yourself as possible.

Alright google hater. I have edited my question to also include Firefox's password manager. EDIT: Also, if you don't know, Chrome also supports passwords export/import, so it not any more vendor-lock-in than any other password managers.

The browser built-in options are too limited. I want to do these things:

- Use multiple browsers

- Sync even if screws you over and terminates your account

- Store things other than passwords. Credit card numbers, PGP keys, SSH keypairs, etc

- Backup the database to my own storage

Export/import is not enough. If I use Chrome, then import to FF, then add a password in FF; now Chrome is missing some data. You need to be able to sync, not just import.

Re: LastPass users warned their master passwords are compromised

#190

Post by 2OEH8eoCRo0 »

CyberRage wrote: post #171
2OEH8eoCRo0 wrote: post #121

Earlier quoted context omitted.

Confession: I write them down. My threat model is 100% aimed at remote attacks/hackers. I could not care less about law enforcement. I also use a hardware backed second factor.

That's still an issue. humanly generated passwords tend to be predictable, repetitive and not very long. A computer will always do a better job at generating\remembering passwords. hardware 2FA is definitely a good idea.

They aren't human generated. I generate them programmatically and don't store them on silicon but on paper.
Post reply on HN