Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

191–200 of 326 posts

Re: LastPass users warned their master passwords are compromised

#191

Post by civilized »

Latty wrote: post #174
civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

Inherently less secure than an extension that fills the passwords, as it relies on you checking the URL correctly, while an extension will only fill it when the origin is correct, which means you are less likely to be phished (although a security key is even better for that).

Meh... you're just looking at one threat, and one that isn't remotely likely in my reckoning. I don't think I've ever been phished. It's very easy to spot.

Re: LastPass users warned their master passwords are compromised

#192

Post by deadbunny »

mNovak wrote: post #42
bryan0 wrote: post #7

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. Must be a compromised browser extension at this point. > To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after c…

Just tried deleting my account--got exactly that error. That's not reassuring

I had the same when deleting my account 3 years ago. LastPass is hot garbage and LogMeIm are the perfect home for it being a dumpster fire of a company.

Re: LastPass users warned their master passwords are compromised

#193

Post by perlpimp »

40four wrote: post #162
benbristow wrote: post #141

Earlier quoted context omitted.

To be fair to LastPass/LogMeIn, they're a company handling a lot of valuable information (passwords/form-fill data/card numbers/notes etc.) - and they're one of the biggest out there. You'd expect them to be one of the more targeted companies just because of the 'treasure' they hold - hence the more security breaches.

An “Ask HN” was just trending about this yesterday ( https://news.ycombinator.com/item?id=29705957 ). Sounds like a good reason not to trust any third party service with my password database to me. I’ve always taken the route of managing my own local Keepass DB & key files. Sure it’s more cumbersome, but it prevents me from having to decide whether or not to trust some third party vendor or not. I know 100% that I’m…

Still using 1password6 not trusting the cloud store.

Re: LastPass users warned their master passwords are compromised

#194

Post by symlinkk »

foxfluff wrote: post #186
tyingq wrote: post #72

Earlier quoted context omitted.

>Must be a compromised browser extension at this point Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit. Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility. Edit #2: Some of the larger js files do have a fair amount o…

> Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping .. total of 25MB of javascript. For (a totally bogus but hey) comparison, I'm shipping products which include the Linux kernel, userland (busybox plus a pile of scripts and some daemons & other utilities), "the application" (two-three hundred thousand lines of C maybe?) plus deps (including sqlite, crypto libs,…

Does your product have any images or localized text that could balloon the size?

Re: LastPass users warned their master passwords are compromised

#195

Post by foxfluff »

symlinkk wrote: post #194
foxfluff wrote: post #186

Earlier quoted context omitted.

> Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping .. total of 25MB of javascript. For (a totally bogus but hey) comparison, I'm shipping products which include the Linux kernel, userland (busybox plus a pile of scripts and some daemons & other utilities), "the application" (two-three hundred thousand lines of C maybe?) plus deps (including sqlite, crypto libs,…

Does your product have any images or localized text that could balloon the size?

Nope.

Re: LastPass users warned their master passwords are compromised

#197

Post by renata »

phs318u wrote: post #187
40four wrote: post #162

Earlier quoted context omitted.

An “Ask HN” was just trending about this yesterday ( https://news.ycombinator.com/item?id=29705957 ). Sounds like a good reason not to trust any third party service with my password database to me. I’ve always taken the route of managing my own local Keepass DB & key files. Sure it’s more cumbersome, but it prevents me from having to decide whether or not to trust some third party vendor or not. I know 100% that I’m…

I recommend this every time a similar news item gets posted. Password Safe (designed by Bruce Schneier). I use the iOS and Linux apps and keep them synced via DropBox. Been around for years (I've been using it almost as long). Still getting updates. Still works. https://pwsafe.org

Also my password manager of choice. There's an Android app as well: https://play.google.com/store/apps/details?id=com.jefftharri....

Re: LastPass users warned their master passwords are compromised

#198

Post by srcreigh »

foxfluff wrote: post #103
gkoberger wrote: post #35

This is framed so negatively toward LastPass, which is unfortunate. They stopped all usage of correct passwords they believed were compromised, which is exactly what I'd want them to do in this situation. Them warning users their master passwords are compromised is a good thing! Yet it's framed as though they're admitting to something. "However, users receiving these warnings have stated that their passwords are uniq…

It's negative because something's up and they haven't given a good explanation. > They stopped all usage of correct passwords they believed were compromised Immediate question: how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? From the information provided, the only thing they have is the IP & geolocation data, which isn't going to be reliable when the attacker(s) a…

Login attempts from unusual locations

Re: LastPass users warned their master passwords are compromised

#199

Post by dgudkov »

CyberRage wrote: post #171
2OEH8eoCRo0 wrote: post #121

Earlier quoted context omitted.

Confession: I write them down. My threat model is 100% aimed at remote attacks/hackers. I could not care less about law enforcement. I also use a hardware backed second factor.

That's still an issue. humanly generated passwords tend to be predictable, repetitive and not very long. A computer will always do a better job at generating\remembering passwords. hardware 2FA is definitely a good idea.

>humanly generated passwords tend to be predictable, repetitive and not very long.

Not necessarily. See https://xkcd.com/936/

Re: LastPass users warned their master passwords are compromised

#200

Post by willis936 »

argestes wrote: post #82
DougN7 wrote: post #71

Earlier quoted context omitted.

I’ve decided that besides a password manager, all of my passwords will also have a number at the end, like 8 (simple, easy to append manually in a password field. Now the password manager has to get defeated AND my own small personal salt value will have to be known.

Now we know

Now you know that there is some sort of salt. That isn't helpful to an attacker trying to cryptographically crack a password if they already have the password database.
Post reply on HN