Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

221–230 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#221

Post by smegger001 »

pigsty wrote: post #36
ddejohn wrote: post #5

For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

>It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

ehh. I store my passwords online but its on a file I encrypted offline with strong password (over 20+ characters) and key. I use keepass which is a locally encrypted and stored password manger, and I store the DB on Dropbox and download it to any of my computers/devices were it is decrypted locally when needed. I don't trust password wallet services ass they all seem to want to do the enryption server side with a reset-able password which really means they have the master password not you, but my set up seems secure enough to me.

Re: The situation at LastPass may be worse than they are letting on

#222

Post by heavyset_go »

ddejohn wrote: post #5

For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…

And Bitwarden can be self-hosted for those that are weary about using SaaS password managers.

Re: The situation at LastPass may be worse than they are letting on

#223

Post by KneePassXC »

newman314 wrote: post #179
cmsj wrote: post #125

Earlier quoted context omitted.

They still require that your vault be hosted by them though. Terrible policy.

Yup. Still pissed that 1Password removed the standalone option.

The standalone option is called KeePassXC; it's a perfect password-manager man.

Not a single other tool is better than it. /HappyCustomer.

Re: The situation at LastPass may be worse than they are letting on

#224

Post by encryptluks2 »

scarab92 wrote: post #141
encryptluks2 wrote: post #107

Earlier quoted context omitted.

Doesn't that make your passwords predictable? If you use the same secret for every domain and now if an attacker figures out your one secret then they would be able to find out all your passwords.

How is that different from any other scheme which uses a master password?

A master password is at least generating random passwords though and encrypting the passwords themselves. Let's say your master password gets compromised, but not the password database itself... then attackers would still have no way to access your other passwords. With the method being described, simply obtaining the "secret" makes other passwords known without even needing access to the password database itself.

Re: The situation at LastPass may be worse than they are letting on

#225

Post by FooHentai »

wlesieutre wrote: post #212
wepple wrote: post #190

Earlier quoted context omitted.

And likewise “military grade encryption” usually means “win2k Visual Basic backend”

Your data is automatically translated into Navajo

That’s a great reference, thank you for the laugh.

Re: The situation at LastPass may be worse than they are letting on

#227

Post by fanso99 »

lolinder wrote: post #159
fanso99 wrote: post #87

Please stop commenting whether you are a LastPass user or not. Some of your profiles on HN have an email address and in general all your comments are public so can be mined, plus "rich techies" could be prime targets for more direct and elaborate phishing campaigns.

Aren't we assuming at this point that the attackers have the complete customer list? I imagine that it would be way easier for them to have a script query that list directly and search for names and emails to find high value targets, rather than reading through HN hoping for a hit.

This is news to me. Was the customer list also stolen? Specifically, customer records linked to individual vaults?

My concern with anyone identifying themselves as being affected by this breach is that a 3rd party would be able to collect a lot of information about the user for a very targeted social engineering attack. Conversations here often disclose personal information such as approximate age, location, past experiences, hobbies, etc. It's a gold mine for social engineering.

Re: The situation at LastPass may be worse than they are letting on

#228

Post by [deleted] »

pigsty wrote: post #36
ddejohn wrote: post #5

For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

[deleted]

Re: The situation at LastPass may be worse than they are letting on

#229

Post by dymk »

faitswulff wrote: post #70
rtp4me wrote: post #60

Earlier quoted context omitted.

Switched from LastPass to Bitwarden some time ago. The only issue I had thus far was exporting the contents out of LastPass. Some of the special characters in some passwords did not export properly. I had to add those items by hand. As for Bitwarden, I like the UI (iPad, Mac, iPhone) but routinely forget how to generate a new password - the function is buried inside one of the menu options. Other than that, I really…

Quick tip: if you have Bitwarden's browser extension installed, you can use Cmd + Shift + 9 (I'm assuming it's Ctrl + Shift + 9 for Windows) to load your clipboard with a randomly generated password: h4!E49vFcGEE%c#$HZ%z*3^5B

Thanks! Would you mind generating a few more for me, though?

Re: The situation at LastPass may be worse than they are letting on

#230

Post by TheDong »

msravi wrote: post #160

Best to just use pass ( https://www.passwordstore.org/ ) with your own gpg key rather than rely on any 3rd party service. Then set up a git repository on a (free) google cloud instance, (or even use github/gitlab), and you're set to sync your passwords to all your devices.

This is less secure than using keepassxc, 1password, or another application with a 1st party well maintained browser extension.

With keepassxc, 1password, or even chrome's password manager, if a phisher links you to "gmail.scammersite.info", even if it looks exactly like the real gmail login page, browser-integration will not fill in the password field.

With pass, the default flow is to copy the password to your clipboard, and paste it into the password field manually. That allows the above phishing attack to succeed.

For that reason, I would not rely on password store. If you want to control your own database, use keepassxc, and sync the kdbx file with either git, dropbox, or anything else you like.

I am aware password-store technically has browser extensions, but few people use them in practice, and since password-store doesn't have an idiomatic "URI" field for a password, it doesn't actually auto-fill by default in a way that stops the above attack.

As a bonus reason, password-store also leaks filenames (entry names), while keepassxc and most other options do not leak the entry name.

As another bonus reason, using gpg is a fraught pain in the ass, and it's such a sharp and difficult to use tool that it's actually harder to securely make disaster recovery plans.

Post reply on HN