Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

201–210 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#201

Post by accrual »

_0w8t wrote: post #61
pigsty wrote: post #36

Earlier quoted context omitted.

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

It all depends on how the data are encrypted. With a sensible design capturing the encrypted storage will only reveal the number of encrypted records, rough estimates on their size, and time stamps.

Ideally it would be an opaque blob with no information about the number of records or their size, just the total size and maybe a last modified or accessed time.

Re: The situation at LastPass may be worse than they are letting on

#202

Post by Dylan16807 »

lolinder wrote: post #115
aborsy wrote: post #98

Earlier quoted context omitted.

No. When you login to LastPass, your password can be taken if LastPass is compromised. You have to trust that LastPass will not do it. If you login to Dropbox, the master password to your keepass database cannot be stolen. You don’t need to trust Dropbox. But what you said is also an additional benefit.

In theory, the master password is never supposed to leave your device even with the cloud-based password managers. So, yes, you're trusting that their clients do what they say they do, and I suppose an attacker could hijack the client and offload your password. That said, the same risk applies to any client you use. Someone could have compromised the latest update of KeePassX as readily as they can compromise LastPas…

Having to compromise KeePassX rather than Dropbox, and specifically while you are updating, is not an insignificant difference.

Re: The situation at LastPass may be worse than they are letting on

#203

Post by zmmmmm »

eternityforest wrote: post #200
msravi wrote: post #160

Best to just use pass ( https://www.passwordstore.org/ ) with your own gpg key rather than rely on any 3rd party service. Then set up a git repository on a (free) google cloud instance, (or even use github/gitlab), and you're set to sync your passwords to all your devices.

That is way too much work. Doing work means stuff is happening and stuff means sidechannel attacks that someone else hasn't audited, because it's not an integrated product anyone would bother auditing. In particular, I don't see how 2FA is possible with this, so shoulder surfing is a bigger issue. I definitely trust Google or BitWarden more than a password I can memorize plus my own constant vigilance.

> In particular, I don't see how 2FA is possible with this

You can use anything that integrates with GPG ... eg: you can do it with a Yubikey [0]

[0] https://support.yubico.com/hc/en-us/articles/360013790259-Us...

Re: The situation at LastPass may be worse than they are letting on

#204

Post by eternityforest »

smt88 wrote: post #79
chank wrote: post #64

Having all your keys/passwords on a 3rd party server is something that I've never been willing to accept from a security standpoint. That's what always kept me from using a `hosted` solution. I do get the allure from a multi-user management aspect though.

I used to use KeePass and synced the database (but not the keys or password) with Dropbox. Very secure and mostly convenient.

Doesn't KeePass use a single database file with no conflict resolution?

I looked at using them but ultimately decided against them, a conflict overwriting a password scares me more than even just using chrome sync and calling it a day.

Re: The situation at LastPass may be worse than they are letting on

#205

Post by five82 »

StanislavPetrov wrote: post #147
wruza wrote: post #106

Earlier quoted context omitted.

And so does sending your passwords to a phone or a home/work pc via chats or email, or using a single password everywhere, or maybe a couple of them with trivial variations. Cloud password managers wouldn’t even exist if people didn’t do much more stupid things to enter their passwords on a different device than the cloud could ever think of.

>And so does sending your passwords to a phone or a home/work pc via chats or email, or using a single password everywhere, or maybe a couple of them with trivial variations. Cloud password managers wouldn’t even exist if people didn’t do much more stupid things to enter their passwords on a different device than the cloud could ever think of. "You should do something stupid because most people do things that are eve…

May I ask how you accomplish this without any sort of burden? Because from my perspective, managing strong unique passwords for hundreds of accounts across desktop, mobile, servers, and other devices is a major pain and I’m tired of dealing with it.

It’s human nature to take shortcuts and develop bad habits when you’re dealing with a flawed system and poor tools that puts the burden on the end user to manage everything. And if I’m struggling with four decades of experience, how is the average non tech user expected to do it properly?

Re: The situation at LastPass may be worse than they are letting on

#206

Post by heywoodlh »

So is there any way to verify what this person is saying? I mean, from the way LastPass is evolving it doesn't seem unlikely to me -- but why is this tweet on HN? Is there any supporting evidence aside from an anecdote, does this Twitter account have a strong reputation of being credible, etc.?

Without context, I just don't understand why this anecdotal thread should be considered credible.

Disclaimer: I use FOSS password managers for everything possible but have to use LastPass for some non-personal stuff and I very much dislike it

Re: The situation at LastPass may be worse than they are letting on

#207

Post by zmmmmm »

chank wrote: post #64

Having all your keys/passwords on a 3rd party server is something that I've never been willing to accept from a security standpoint. That's what always kept me from using a `hosted` solution. I do get the allure from a multi-user management aspect though.

I kind of agree with you, but on the other hand, they are storing everything you give them using strong cryptography. If you fundamentally don't trust cryptography then none of those passwords you are worried about are worth protecting in the first place. So I'm not sure it's logically consistent to say that such a service should / should never exist on that basis.

Where I do think it resonates is fundamentally it's just a bad idea to centralize things like this. It may be a necessary to construct a commercial business around this, but centralising massive amounts of trust across unrelated entities into ANY party is just a fundamental compromise that shouldn't have to be made. We would all be better off with genuine decentralised infrastructure to make all this work.

What does irritate me is that all these companies are full of "zero trust" marketing spiel but their products always actually end up coming back to placing 100% trust in them in the end.

Re: The situation at LastPass may be worse than they are letting on

#208

Post by eternityforest »

irrational wrote: post #139

Is there a site or something where you can put in all the devices you own (e.g., iPhone, Mac laptop, tablet, chromebook, etc) and what features you want (e.g., adding a password on one device syncs it automatically to all other devices, offline useage, auto fill of browser form fields, auto saves now username/passwords, etc.) and it will tell you what password manager best meets your needs?

https://en.m.wikipedia.org/wiki/List_of_password_managers

As far as I can tell BitWarden and Google are the two good ones. I use BitWarden.

My reasoning is anything new and experimental is scary, I want something with tons of users that's well established. If the community isn't all over it, it's probably not reviewed enough.

Open source makes stuff a little more trustworthy, but by itself isn't enough.

I also don't want to pay a lot for it, and many are paid.

The two big FOSS ones everyone knows are KeePass and BitWarden.

Keepass uses some single file database last I checked. Terrible for sync as the sync engine won't be able to automatically merge conflicts and you might get hassles.

That just leaves BitWarden, or just using Chrome because it's there, it's easy, and Google seems to be good at protecting you from everyone but them.

Re: The situation at LastPass may be worse than they are letting on

#209

Post by chank »

zmmmmm wrote: post #207
chank wrote: post #64

Having all your keys/passwords on a 3rd party server is something that I've never been willing to accept from a security standpoint. That's what always kept me from using a `hosted` solution. I do get the allure from a multi-user management aspect though.

I kind of agree with you, but on the other hand, they are storing everything you give them using strong cryptography. If you fundamentally don't trust cryptography then none of those passwords you are worried about are worth protecting in the first place. So I'm not sure it's logically consistent to say that such a service should / should never exist on that basis. Where I do think it resonates is fundamentally it's…

It's not the cryptography that I don't trust. It's the e2e implementation. I mean we wouldn't be having this conversation if it was just about the cryptography. Also, subscription fees are a turn off.

Re: The situation at LastPass may be worse than they are letting on

#210

Post by zmmmmm »

The inference that the LastPass leak is responsible is being made purely on the basis that this particular person can't identify any other way the security of their wallet was broken. That seems a very weak basis (essentially, absence of evidence equating to evidence of absence) to make what is really a very strong assertion.
Post reply on HN