Live data from Hacker News

Security Issues with LastPass on Android

abhyudaya.dev

21–30 of 64 posts

Re: Security Issues with LastPass on Android

#21
post #7

I personally have been using LastPass since it came out. I am much more secure than if I didn't use LastPass. A friend loved trying to break into my accounts for fun so I feel like I was a much more secure person just for stupid reasons. (It really was a game and nothing he did was nefarious) Companies that use password managers are infinitely better off with one then without. My co-workers would repeat their passwor…

> Companies that use password managers are infinitely better off with one then without.

I second that opinion. I've worked in really large companies and I was blown away by the number of people who had {CompanyName}{number} as their password, where number is the amount of times the system required them to change their password. In a company with 6000 employees, we are talking 15-20% of all employees, including senior staff, engineers and manager with access to personal information of tens possibly hundreds of millions of people. This often falls into the category of "Nah, it's fine, I'm safe". And while there are circumstances in which you can feel secure in regards to your personal security at home and everything, we are talking large corporations with endless amounts of internal and external projects many are absolutely unaware of. Example: https://rtb-dsg.companyname.com which uses the company-wide ldap for authentication. Most people inside and outside the company have no idea what rtb-dsg is and it's better to keep it that way. So it's best to avoid taking chances.

Re: Security Issues with LastPass on Android

#22
post #4

These aren't really novel security vulnerabilities or anything, just some common sense things to be aware of so you don't shoot yourself in the foot: generated pronounceable passwords might not strictly follow the length that you set, don't paste your passwords into the address bar of a web view, and don't set a weak master password.

Thats right, we should blame the victim for trusting the tool. Password managers are increasingly mandated by organisations, and Lastpass is a very common recommendation. Even in the minority of technical users that use this kind of tool I expect small mistakes - like accidentally pasting a password in a URL. A good tool doesn't let you shoot yourself in the foot by escalting that to a non-obvious leak. The password…

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC.

1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self use.

Re: Security Issues with LastPass on Android

#23
I'm more and more worried about a supply chain attack on LastPass/KeePass. To the point that I'm skittish about upgrading them.

It feels to me like we need someone with huge resources, like Microsoft/Gooogle/Apple... to buy them and apply their methods against this attack.

For example, where are the binaries built? Who controls the accounts used to upload the installers? Do they regularly pay security teams to try to find vulnerabilities?

To be clear, I'm not worried about the code, but I'm very worried about the downloadable binaries.

Re: Security Issues with LastPass on Android

#24

Earlier quoted context omitted.

Thats right, we should blame the victim for trusting the tool. Password managers are increasingly mandated by organisations, and Lastpass is a very common recommendation. Even in the minority of technical users that use this kind of tool I expect small mistakes - like accidentally pasting a password in a URL. A good tool doesn't let you shoot yourself in the foot by escalting that to a non-obvious leak. The password…

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

Do you think KeePassXC is better than original KeePass?

Re: Security Issues with LastPass on Android

#25
After lastpass's recent policy changes around free multi-device use, I finally decided to switch password management services. I don't really mind spending like $10/year for password management but lastpass was slow/buggy/frustrating enough that I didn't want to pay for it.

The whole process took probably three minutes front-to-back. Lastpass lets you export your passwords in a CSV, which you then upload to any other service which automatically imports them. Very easy. If you're frustrated with lastpass I recommend the switch. Personally I chose Bitwarden because it's open source.

Re: Security Issues with LastPass on Android

#26
post #25

After lastpass's recent policy changes around free multi-device use, I finally decided to switch password management services. I don't really mind spending like $10/year for password management but lastpass was slow/buggy/frustrating enough that I didn't want to pay for it. The whole process took probably three minutes front-to-back. Lastpass lets you export your passwords in a CSV, which you then upload to any other…

I also switched from LastPass to Bitwarden, and over the past couple years of using it I have had zero criticisms.

Re: Security Issues with LastPass on Android

#27
I'm not into infosec, but trusting a password generator blindly seems like a dangerous practice. I always make sure to double check LastPass generated passwords and make them as long as possible. I only expect LastPass to remember my secrets and it does that just fine.

Re: Security Issues with LastPass on Android

#28
post #12

Earlier quoted context omitted.

> I had been considering paying for a family account Your consideration doesn't pay for dev time. No one cares about pushing free users or 'considering' users off the platform at monetization time. Shit or get off the pot. That said, no one blames you for doing comparison shopping at monetization time either.

>Your consideration doesn't pay for dev time. But rather than asking users to pay for newly developed premium functionality, they asked long term users to pay for things that they already had and had always been provided for free. >Shit or get off the pot. In this metaphor, they started charging people for using a previously freely accessible pot while they were in mid-shit.

Economics change and companies change. IIRC the company has been sold twice and maybe the new company can't underwrite the ongoing maintenance or just refuses to?

Do users have a right to exist under legacy covenants when things at the company have changed?

Again, this is why I advocate for shopping at monetization time. The company has altered the deal, maybe you should alter it further?

Re: Security Issues with LastPass on Android

#29
post #4

These aren't really novel security vulnerabilities or anything, just some common sense things to be aware of so you don't shoot yourself in the foot: generated pronounceable passwords might not strictly follow the length that you set, don't paste your passwords into the address bar of a web view, and don't set a weak master password.

> might not strictly follow the length that you set

Why on earth not? It’s very easy for a computer to check the length of a string, and compare that to a number, there’s absolutely no reason and no excuse for deferring that to the user.

The end user should have every expectation that a generated password will conform to the minimum length setting, and other password settings that are exposed.

Failing to generate passwords that meet the promised criteria is a bug, and not something users should need to have “common sense awareness of”.

Post reply on HN