Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

211–220 of 443 posts

Re: LastPass autofill exploit

#211

Post by EGreg »

I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password.

In fact, I'd go further and say that you can do this with your login name. So for example:

myemail+by@gmail.com for eBaY

This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your info and even stealing your account:

https://medium.com/@espringe/amazon-s-customer-service-backd...

If you are hosting with AWS you should really consider doing that

http://www.techinsider.io/hacker-social-engineer-2016-2

Re: LastPass autofill exploit

#212

Post by lyonlim »

ctulek wrote: post #199
cyberpanther wrote: post #197

I'm a LastPass user but not really in love with it. If I were to switch, which is best and WHY? I need it to support chrome and Android.

I like 1Password. They were expensive and required separate licenses for desktop and mobile when I bought. I don't know the current pricing model. They have a good product, nice blog articles explaining various technical decisions they made, and a fast customer support in terms of listening feedback.

Same here. I researched quite a bit before settling on 1Password. I bought separate licenses for all my devices across Mac and Windows, Android and iOS.

Beware though..their Android app does not support multiple vaults. And their Windows client is really ugly. Their iOS and Mac apps are very refined though..and I know the founder is trying to close this feature gap across platforms.

They seem to be moving towards subscription licenses with Teams and Family though...which do not require separate licenses for different platforms.

Re: LastPass autofill exploit

#213

Post by e40 »

Xylakant wrote: post #80
gourou wrote: post #67

Earlier quoted context omitted.

Work on your memory, it's very hard to hack.

That's a very bad recommendation. Very few people are capable of remembering unique 10-character passwords for each site. I have like 100 passwords and accounts for various systems and I'm certainly not able to remember each of them. So either I start reusing passwords or I use a password manager.

For work and home I have nearly 500. The GP recommendation is absolutely terrible advice.

Re: LastPass autofill exploit

#215

Post by svenfaw »

embik wrote: post #151
oslavonik wrote: post #117

Earlier quoted context omitted.

I've been amazed by Pass, but couldn't find a thorough review between Pass and KeePass(x). Is one safer than the other?

pass is as safe as your gpg installation and your gpg key because that's the encprytion it uses.

That's a dangerous oversimplification. By that logic "LastPass is as safe as AES as that's what it uses" which is obviously not the case.

A system is as secure as its weakest component.

Re: LastPass autofill exploit

#216

Post by pmarreck »

mcs wrote: post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

He could have basically killed LastPass, the company, if he didn't go white-hat. And caused all sorts of other mayhem that would also have been far more profitable for him.

It does seem like an extremely low bounty for a security bug that severe.

I mean, in a 100% libertarian world, this hole would have been put up for auction to the highest bidder and LastPass would have had to ensure they were the highest bidder in order to close up the hole and basically save their business.

Re: LastPass autofill exploit

#217

Post by pwenzel »

mabcat wrote: post #71
SaturateDK wrote: post #61

Earlier quoted context omitted.

I want an alternative, got a good one?

I switched to 1Password after Lastpass got acquired. I obviously have no special knowledge how secure it is but it's serving me well. OSX browser integration excellent, iOS integration mediocre.

I have been using 1Password since version 3 and highly recommend it. I personally am quite happy with the iOS support, synchronization, and mobile Safari extension.

Re: LastPass autofill exploit

#218

Post by haasn »

oslavonik wrote: post #117
Alpacalex wrote: post #75

Earlier quoted context omitted.

If you're using a *nix system: https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)

I've been amazed by Pass, but couldn't find a thorough review between Pass and KeePass(x). Is one safer than the other?

`pass` is based on well-established cryptography implementations: GnuPG. GnuPG is recommended by many security experts and used widely by journalists dealing with sensitive disclosures, e.g. the edward snowden documents.

It also doesn't try to NIH some complicated database format or syncing technology but instead uses well-established software (git, plain directory structure and gpg-encrypted text files) which makes it robust, flexible and future-proof, and also responsive to changes in cryptography as it benefits from upstream GnuPG updates. You can use any PGP key structure you want, or even hardware PGP devices like the YubiKey.

KeePass on the other hand seems to be based on mostly homegrown techniques written by people with no or limited understanding of cryptography. (see e.g. [0]) That said, I don't know how much KeePassX continues this trend - but it's based on the same file format so it presumably has to reimplement at least some of KeePass's homegrown crypto.

I don't know how much more convincing you need, but personally I wouldn't even dare consider using anything other than `pass`.

[0] https://news.ycombinator.com/item?id=9727297

Re: LastPass autofill exploit

#219

Post by cyberpanther »

lyonlim wrote: post #212
ctulek wrote: post #199

Earlier quoted context omitted.

I like 1Password. They were expensive and required separate licenses for desktop and mobile when I bought. I don't know the current pricing model. They have a good product, nice blog articles explaining various technical decisions they made, and a fast customer support in terms of listening feedback.

Same here. I researched quite a bit before settling on 1Password. I bought separate licenses for all my devices across Mac and Windows, Android and iOS. Beware though..their Android app does not support multiple vaults. And their Windows client is really ugly. Their iOS and Mac apps are very refined though..and I know the founder is trying to close this feature gap across platforms. They seem to be moving towards sub…

I really like they have family pricing, even if I just get my wife on the subscription.

Re: LastPass autofill exploit

#220

Post by mordocai »

koolba wrote: post #82
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

> 1. I can go to any computer with chrome and get access to all my passwords, so don't have to carry my passwords with me everywhere. Maybe a computer you can trust but I wouldn't say any computer. I consider the shared PC you'd find in a hotel business center to be the digital equivalent of a diseased hooker. I'd be impressed if it didn't have a key logger installed. > 2. Don't have to worry about storing passwords…

> Maybe a computer you can trust but I wouldn't say any computer. I consider the shared PC you'd find in a hotel business center to be the digital equivalent of a diseased hooker. I'd be impressed if it didn't have a key logger installed.

I think you'll be impressed in a lot of cases than. I would be surprised if more than 15% of shared PCs have keyloggers active on them.

Still doesn't mean i'm going to login to anything on them though.

Post reply on HN