Earlier quoted context omitted.
I want an alternative, got a good one?
I've been using Pass for several months and I love it. https://www.passwordstore.org/
Within Pass is there a best practice for sharing passwords with another person or team?
LastPass autofill exploit
221–230 of 443 posts
Re: LastPass autofill exploit
#222[deleted]
Re: LastPass autofill exploit
#223Earlier quoted context omitted.
Work on your memory, it's very hard to hack.
That's a very bad recommendation. Very few people are capable of remembering unique 10-character passwords for each site. I have like 100 passwords and accounts for various systems and I'm certainly not able to remember each of them. So either I start reusing passwords or I use a password manager.
You can vary the password based on the domain name with a predictable algorithm that only you know.
Re: LastPass autofill exploit
#224Earlier quoted context omitted.
Consider https://salty.pw/ The idea is good, just not sure about SHA-256...
How do you deal with sites that don't accept the passwords generated by salty?
Good point. Perhaps a modification can be made that is restricted to generally safe characters, then you can add your own stuff as the website demands. Which then leaves you to remember which stuff you need to add, on every site - so not that great.
Or there could be several modes and a database of websites that automatically picks a mode based on the website. Which leaves you remembering modes in the worst case scenario, or trying a few of them out.
I think an acceptable solution can be made by analysing the password requirements of the top N websites, then coming up with a good scheme that works on most, and an alternate scheme that works on the rest. One mistake is usually allowed everywhere.
Re: LastPass autofill exploit
#225https://en.wikipedia.org/wiki/Single_point_of_failure
the elephant in the room,yes : with these master-password schemes, why does this get so little comment
Re: LastPass autofill exploit
#226Earlier quoted context omitted.
Normally I like bike shedding about bug bounty payouts just about as much as complaints about paywalls. If you are going to go poking around someone's code for fun or profit, the terms of the bounty program are readily available [1] so you can't complain after the fact for earning the maximum payout. LastPass isn't Facebook, and they never claimed they would pay more than $1,000 even for a full compromise or RCE. On…
"On the other hand, using regexp to parse the URL when it's such an obviously security critical code path... just, why?!" Why not? URIs are at least able to be tokenized perfectly well by a regular expression. You have to do it right, but there's little guarantee that your non-regexp code will do it right either. I glanced at that regexp and immediately recognized several potential problems with it... will I be able…
> using regexp to parse the URL
A while back I whipped this up: https://gist.github.com/pmarreck/2956396
which seemed to work well (although it was a bit slower, I probably didn't know about exponential backtracking at the time and that could probably be revisited). It won't gather multiple name/value pairs though, but it will cut out and name basically every other part of the URL.
Re: LastPass autofill exploit
#227Earlier quoted context omitted.
Where do you write yours down?
I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else). It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated…
I use a method like that, but the result of that step then goes through PwdHash (whose code is small enough to inspect for naughtiness) so that multiple web sites wouldn't expose the scheme.
Re: LastPass autofill exploit
#228Earlier quoted context omitted.
No, you pay people to bother looking in the first place. Criminals will always be looking, but the odds of finding vulns against a company that pays decent bounties should be far lower than against one paying a pittance, since more people should be looking due to the greater potential reward. Also, in this case, I think that the amount of damage the company has avoided due to the vuln leaking through non-responsible…
And somebody looked, so clearly the bounty worked! But the cost to find a bug has practically nothing to do with the impact of the bug. The incentive is to find bugs, not a particular world ending bug.
How do you know it hasn't already been found and actively exploited?
Regardless, if a company isn't willing to demonstrate they value security to my satisfaction I won't be a customer.
Re: LastPass autofill exploit
#229Earlier quoted context omitted.
So you don't believe there are blackhats out there? Because somebody has to be breaching online services and it's rather unlikely it's a godly entity doing that. Felonies exist and people still commit them. Should they? God no. But people with a lower moral code exist and they can be flipped to do "good work" if there's enough money for them (and I think you should get more money in general for your important work an…
The people who are not the majority of researchers would be... Wait for it... A minority of researchers.
So... a minority of people aren't capable of causing trouble? I don't see your point.
Re: LastPass autofill exploit
#230The autofill feature starts sounding like the benefit isn't worth the risk. It's kind of odd when thinking about it, that my passwords can be decrypted without me explicitly asking for them. I hope there aren't other mechanisms aside from autofill that allow that. While we're here - is there a way to disable autofill in LastPass entirely?