What’s in a PR statement: LastPass breach explained • Hacker News Board

Re: What’s in a PR statement: LastPass breach explained

#201

Post by krsdcbl » Tue, Dec 27, 2022, 7:37 PM UTC

40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

I've actually ended up syncing my KeyPass db & sharing it with my team via our own gitlab instance.

I'll have to pull changes if anybody added entries but: - Db lies on our own encrypted servers instead of someone elses cloud - access within the team is easily managed via ssh - I'll have a commit stream telling me if anybody added sth and what - can't easily fuck anything up in those shared records, have to consciously commit changes - when we rotate master pw we clean the repo

Re: What’s in a PR statement: LastPass breach explained

#202

Post by bberrry » Tue, Dec 27, 2022, 7:37 PM UTC

My LastPass account literally had ONE iteration of pbkdf2 (https://i.imgur.com/34aIOzO.png) and it seems I'm not the only one: https://snabelen.no/@vegardlarsen/109575002998425618

Absolutely amateurish. I hope no one trusts LastPass ever again.. I know I won't.

My account was registered 2010 if anyone is interested.

Re: What’s in a PR statement: LastPass breach explained

#203

Post by fudgefactorfive » Tue, Dec 27, 2022, 7:38 PM UTC

nfca wrote: post #199

In the case of something as critical as a password-manager, quality of customer service, I believe, is a critical factor. When there is a problem, how helpful is the customer service? If not then a person stands to be locked out of critical aspects of their digital life

While having a Customer Service Rep tell you you're shit out of luck if you can't remember your master password may suck, it's pretty much the only way to actually be some semblance of safe.

The Mud-puddle test is to demonstrate that only you can access your services. If you can call and go "hey can I get back into my vault" so can anyone that convincingly can make the same call on your behalf.

Re: What’s in a PR statement: LastPass breach explained

#204

Post by tasuki » Tue, Dec 27, 2022, 7:38 PM UTC

Flimm wrote: post #193

hn_throwaway_99 wrote: post #190

Earlier quoted context omitted.

I think the whole LastPass fiasco just shows why everyone wants to get into the SaaS business so bad - subscription revenue is the gift that keeps on giving. LastPass has proven they have no business safekeeping anyone else's credentials. Anyone who cares a modicum about their security will have migrated off. But migrating off is a HUGE pain (people will need hours to update hundreds of passwords), and LastPass's ann…

Migrating from LastPass to another password manager is actually a pretty easy process. Many password managers can import passwords from LastPass.

Yes, sure that's easy. Also now there are twice as many places from which an attacker can get your passwords. Oops?

Re: What’s in a PR statement: LastPass breach explained

#205

Post by krsdcbl » Tue, Dec 27, 2022, 7:42 PM UTC

dgrin91 wrote: post #19

40four wrote: post #6

I know password manger services are super convenient, and probably worth the cost for most, especially non technical users. But my preference has always been to manually manage my own local KeyPass database. Sure it’s more cumbersome when it comes to syncing between devices, but it’s really not a big deal. One or twice a month I will combine my DBs from all my devices ok one machine, use the built in ‘merge’ function…

Here is my problem with KeyPass: its unclear to me how it deals with emergency family access. Last year my father unexpectedly passed away. All his stuff was on lastpass. Thankfully we had emergency access setup, and I was able to get into all his accounts 2 days later. It was an exceptionally important part of the transition phase, and without it we would have experienced significant financial harm. How would KeyPas…

With KeePass you'll have to manage said emergency access. Either by sharing that master pw directly or maybe if it concerns business matters by keeping those records in an own db and employ a notary to manage such emergency access.

Anyway even delegating it to a notary imho isn't near as much of a possible security issue than having an SaaS store all your auths online & them having a system in place to grant third party access.

Re: What’s in a PR statement: LastPass breach explained

#206

Post by drexlspivey » Tue, Dec 27, 2022, 7:42 PM UTC

robust-cactus wrote: post #169

ericmcer wrote: post #165

Can someone point out a big flaw in my password management system? I have always felt kinda dumb for not using a PW manager but my system has worked for the last ~10+ years and I have never had any issues. I memorized a small function that takes the product name as input and spits out a password. it achieves the goal of having a unique pw for every service without having to write anything down (in software or on pape…

This is pretty cool, and could even make a great "no storage" type product here. Hmm 1 problem could be forced password changes? I've noticed some sites at times require password changes.

It’s not, you can guess all his passwords if you know a couple of existing passwords (maybe even 1)

Re: What’s in a PR statement: LastPass breach explained

#207

Post by tsimionescu » Tue, Dec 27, 2022, 7:45 PM UTC

Flimm wrote: post #193

hn_throwaway_99 wrote: post #190

Earlier quoted context omitted.

I think the whole LastPass fiasco just shows why everyone wants to get into the SaaS business so bad - subscription revenue is the gift that keeps on giving. LastPass has proven they have no business safekeeping anyone else's credentials. Anyone who cares a modicum about their security will have migrated off. But migrating off is a HUGE pain (people will need hours to update hundreds of passwords), and LastPass's ann…

Migrating from LastPass to another password manager is actually a pretty easy process. Many password managers can import passwords from LastPass.

That's useless if you're migrating away because of security concerns. What you actually have to do is to go to all of the sites and change each of the passwords you have stored in LastPass.

Re: What’s in a PR statement: LastPass breach explained

#208

Post by drexlspivey » Tue, Dec 27, 2022, 7:45 PM UTC

grogenaut wrote: post #187

IncRnd wrote: post #181

Earlier quoted context omitted.

> Can someone point out a big flaw in my password management system? The issue is that your passwords have almost zero entropy in them. The only guard is that others don't know your secret function. Password crackers are already programmed to handle functional password composition. You might want to ask yourself why pw crackers are programmed that way.

Taken in isolation they might have a ton of entropy, just not taken across leaked password databases.

If my password is hunter2#gmaildotcom for gmail what could my reddit password be? It doesn’t take many leaks to crack the formula.

Re: What’s in a PR statement: LastPass breach explained

#209

Post by snotrockets » Tue, Dec 27, 2022, 7:48 PM UTC

ericmcer wrote: post #165

Can someone point out a big flaw in my password management system? I have always felt kinda dumb for not using a PW manager but my system has worked for the last ~10+ years and I have never had any issues. I memorized a small function that takes the product name as input and spits out a password. it achieves the goal of having a unique pw for every service without having to write anything down (in software or on pape…

I used to use a similar system (http://crypto.stanford.edu/PwdHash/pwdhash.pdf), until I realized it has a glaring issue when passwords need be rotated.

Assume a service you use was breached, and you have to replace your password there. You can work around it by having another input to your generator. Instead of (master password, service), you now have (master password, service, version). Maybe you append the version into one of the other arguments to keep the function the same; doesn't matter: now there's a new, per-service argument you have to track and remember.

Re: What’s in a PR statement: LastPass breach explained

#210

Post by danShumway » Tue, Dec 27, 2022, 7:49 PM UTC

bertman wrote: post #75

neonsunset wrote: post #67

Earlier quoted context omitted.

Have you checked the second link? (emphasis on "self-hosted friendly impl."). The first one is obviously not designed to serve as a primary self-hosted option but rather to scale for large number of users.

Oh, I'm sure Vaultwarden is much more resource-friendly, but even then: a user's password list is arguably the most important thing on the device. And I'm not sure you need a "web interface" to something that in the end is nothing more than an encrypted text file, which is why I always recommend pass[0] or using the browser's built-in pw manager for people that don't know ssh and git. [0] passwordstore.org

For whatever it's worth, I think people should be a little careful about using Pass. From their website:

> With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password.

This is the exact problem that LastPass just got hit with (okay, one of multiple problems) -- the vault doesn't encrypt the URLs of the sites you visit. Pass is really elegant, but it leaks a ton of metadata in pursuit of that elegance. Tracking password changes unencrypted in Git really seems like it's just asking for trouble.

Yeah, the actual passwords are encrypted and stay encrypted, and that's great -- but we've just seen with LastPass that it kind of matters that the entire vault be encrypted. I personally think there are better ways to get a CLI interface than exposing the site list.