Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did LastPass master passwords get compromised?

palant.info

Post reply on HN
Print view View original

181–189 of 189 posts

Re: How did LastPass master passwords get compromised?

#181

Post by fulafel »

mgraczyk wrote: post #34
willis936 wrote: post #28

Earlier quoted context omitted.

Which is exactly what you say when facing an existential crisis. If you have a master password leak you either: 1. lie about it and the truth never comes to light 2. lie about it and get caught and the consequences are the same as if you came clean If LP suffered a master password leak then there is no benefit to telling the truth.

One advantage of telling the truth is that you don't go to prison for fraud. When evaluating this kind of conspiracy theory, it's important to consider the number of people who would have to remain silent for the conspiracy to survive, and to consider how much it would cost to keep that many people silent. In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very lo…

Are there examples of jail time for fraud happening for beingdishonest about sw product flaws?

Re: How did LastPass master passwords get compromised?

#182

Post by palant »

lycalopex wrote: post #176
palant wrote: post #77

Earlier quoted context omitted.

I’ve written about their security story a while ago here, not much has changed since AFAIK: https://security.stackexchange.com/questions/45170/how-safe-... The trouble is that the majority of their competitors isn’t great either. I used to recommend 1Password, but another knowledgeable security researcher isn’t really fond of them.

Just curious if you had any information on the security concerns of 1Password from that researcher?

It’s rarely actual security concerns, mostly how they deal with security issues when they are reported to them. I’ve never had to deal with 1Password in this way, the code I’ve seen was pretty solid. This researcher made some rather bad experiences however.

Re: How did LastPass master passwords get compromised?

#183

Post by palant »

buck4roo wrote: post #177
palant wrote: post #2

I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.

I haven't seen any mentions discussing HTTP request smuggling try. This could cause LP's internal or external load balancers to misdirect requests/responses. Thoughts on this as a possible root cause?

I’ve given this some thought, but I think that this scenario still requires someone to attempt a login with correct credentials. It cannot be the legitimate owner however if the account hasn’t been touched for a year.

Re: How did LastPass master passwords get compromised?

#184

Post by palant »

stingraycharles wrote: post #23
SloopJon wrote: post #12

The article suggests that hashing (PBKDF2) is done client-side only, and that LastPass stores this hash directly. If true, this is very bad. However, LastPass claims that PBKDF2 is also used server side: > We then take that value, and use a salt (a random string per user) and do another 100,000 rounds of hashing, and compare that to what is in our database. https://blog.lastpass.com/2015/06/lastpass-security-notice/…

Which to me begs the question: then why hash client-side at all? What are the threats it protects against?

The client-side hashing is actually the part that keeps your master password a secret, from everyone including LastPass yourself. This makes sure that LastPass cannot decrypt your passwords despite them being stored there. The server-side part on the other hand is severely misimplemented and not much good to anyone. This is one of the issues I’ve written about here: https://palant.info/2018/07/09/is-your-lastpass-data-really-...

Re: How did LastPass master passwords get compromised?

#185

Post by t0astbread »

jimmydorry wrote: post #180
t0astbread wrote: post #164

Earlier quoted context omitted.

What about an offline password manager? Like pass[1] or one that supports the KeePass format. Then you could use your regular file synchronization tool to synchronize the database files. You could also use a P2P sync tool like Syncthing. (Of course this makes more sense if you already have some kind of file sync setup.) [1] https://www.passwordstore.org/

That would be roughly equivalent to lastpass then.

How so? The password database is still encrypted with a master password which is completely independent of the file sync mechanism. So the master password is not involved in anything network-facing.

Re: How did LastPass master passwords get compromised?

#186

Post by GekkePrutser »

md_ wrote: post #37
_aavaa_ wrote: post #27

Earlier quoted context omitted.

That statement is too squirrelly for me to trust if my passwords were stored with them. “SOME of these security alerts” “were LIKELY triggered” “HAS BEEN solved” (Emphasis mine) How can the issue be definitely solved if you aren’t sure that they were actually triggered in error, if they were in error then it’s only some of them.

It's easy for me to imagine how you get here. - Eng are still writing the postmortem - Marketing want to put out a statement - Eng know or suspect a bug exists that can trigger spurious notifications, but don't have sufficient logs to be able to reconstruct if that bug was in fact in play in production - Legal advises not to say anything definitive that they can't stand behind later I don't see any of that as particu…

You don't take into account that support told some of the customers that there was indeed a login attempt with valid password. I'm that sense it does sound a bit like backtracking. Now it's supposed to have only been a reporting error.

Re: How did LastPass master passwords get compromised?

#187

Post by tuwtuwtuwtuw »

ohyeshedid wrote: post #149
tuwtuwtuwtuw wrote: post #144

Earlier quoted context omitted.

> it's either a complicated bug or there's more to the story. I showed you pseudo-code which could trigger this issue. It was trivial code which could cause it in practice. Yet you claim it must be complicated or more to the story. I have no idea why you feel that classifying a request in a certain way must be caused by a complicated bug - very strange. I think you're into FUD-mode now because even after being shown…

Your example would've caused a much larger response, no? By most accounts, it didn't trigger for most users, so a simple flub like that should've triggered on more accounts. I'm viewing this through the lens of multiple days of differing social groups poking at this, and the crowdsourced information that's yielded. > ...shown wrong, you continue to spread misinformation. You haven't shown anything wrong: neither of u…

> Is there some reason you're so accusatory?

I thought that was obvious given the context. You are spreading BS that this must be caused by some complex bug yet having nothing to back it up except for anecdotes. You have already said you don't know the feature set and you haven't used it in 10 years, yet you are making such a claim.

Why wouldn't I accuse you of spreading misinformation if you make claims without knowing what you're talking about?

Re: How did LastPass master passwords get compromised?

#188

Post by jimmydorry »

t0astbread wrote: post #185
jimmydorry wrote: post #180

Earlier quoted context omitted.

That would be roughly equivalent to lastpass then.

How so? The password database is still encrypted with a master password which is completely independent of the file sync mechanism. So the master password is not involved in anything network-facing.

Lastpass simply downloads your password database as an encrypted blob which you unlock locally with your master password. The fact that this unlocking is somewhat automated does not change the fact that it acts identically to your proposed solution.

Re: How did LastPass master passwords get compromised?

#189

Post by t0astbread »

jimmydorry wrote: post #188
t0astbread wrote: post #185

Earlier quoted context omitted.

How so? The password database is still encrypted with a master password which is completely independent of the file sync mechanism. So the master password is not involved in anything network-facing.

Lastpass simply downloads your password database as an encrypted blob which you unlock locally with your master password. The fact that this unlocking is somewhat automated does not change the fact that it acts identically to your proposed solution.

Okay, I don't wanna go into a fight over Lastpass because I don't know its tech deep enough to make a judgement (and HN reply limit would prevent it anyways). My point is, there are still some general differences between an online password manager and an offline password manager + file sync combination:

- There's no way a flaw in an authentication protocol could compromise a master password (because the file sync software is completely detached from the password manager).

- Someone who compromised your master password can't get your passwords without first obtaining your database files.

That being said, I don't think online password managers are inherently insecure or anything like that.

Post reply on HN