Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

241–250 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#241

Post by tmpfs »

aryonoco wrote: post #176
tmpfs wrote: post #158

Earlier quoted context omitted.

Please try our solution[1] It's truly local first and will work fine in an airgapped situation. It's also designed to be self-hostable[2], is open source [3] and the API is well documented[4]. [1] https://saveoursecrets.com/ [2] https://saveoursecrets.com/docs/cli/self-hosting/ [3] https://github.com/saveoursecrets/sdk [4] https://docs.rs/sos-sdk/latest/sos_sdk/

The likelihood that someone would be able to do this in 50 years time, without your company still around? Close to zero. Passwords, even ssh keys and passkeys, are little pieces of plain text. If you think needing a specialised sdk or cli to retrieve plain text is a good software architecture, I think we see the world quite differently.

That's the exact reason it's open source, so it would still be possible to access your data in such an event.

We clearly see things differently but I think using computers to make our lives easier is worthwhile and storing/managing our secrets securely, effectively and conveniently is better managed by software than some ad-hoc setup.

Nitpick, passkeys are not text, they are binary blobs.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#242

Post by makeitdouble »

noAnswer wrote: post #230
makeitdouble wrote: post #224

Earlier quoted context omitted.

We're holding it wrong ? The whole point of a password manager is to be reliable when shit hits the fan. If my phone dies I want every changes to be available to the other synced devices, especially when it has been away from home for a while (losing newly created accounts or passwords during a trip is just miserable)

We're holding it differently. My phone doesn't have my main password safe. I don't trust that thing. If a stupid app decides to log me out, I can't login until I'm back home. I never created an account "on the go", but I had to do a password reset once. I will use a standard password until I'm back and change it to a randomly created one. I can't even login to my bank without a special token device. I don't have that…

Understandable.

I'm in a area where my phone might suddenly outlive my house, so we have very different life choices indeed.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#243

Post by commandersaki »

jongjong wrote: post #237
gblargg wrote: post #121

Earlier quoted context omitted.

What if you used a password service, but modified the password it puts in manually (and didn't let it update when you log in)? Would an attacker try variations, or just move on when your password manager-provided login doesn't work?

This would probably help a little bit in terms of security but you would still depend fully on your password manager for access to various services. Personally, I don't like the dependency aspect of password managers. I hate having to log into my password manager first before I can log into the service... And I don't like having to adhere to the whims of the password manager about things like changing my password eve…

Sounds like you don't understand how a password manager works and what it is trying to solve.

Also how is remembering a master password any different to remembering a secret heuristic.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#244

Post by Rury »

commandersaki wrote: post #243
jongjong wrote: post #237

Earlier quoted context omitted.

This would probably help a little bit in terms of security but you would still depend fully on your password manager for access to various services. Personally, I don't like the dependency aspect of password managers. I hate having to log into my password manager first before I can log into the service... And I don't like having to adhere to the whims of the password manager about things like changing my password eve…

Sounds like you don't understand how a password manager works and what it is trying to solve. Also how is remembering a master password any different to remembering a secret heuristic.

A master password (e.g. to access a password manager) needs to be both remembered and stored somewhere (ie the password manager, not your brain). A secret heuristic doesn't and so is more secure by simply not also being stored somewhere outside your brain.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#245

Post by commandersaki »

Rury wrote: post #244
commandersaki wrote: post #243

Earlier quoted context omitted.

Sounds like you don't understand how a password manager works and what it is trying to solve. Also how is remembering a master password any different to remembering a secret heuristic.

A master password (e.g. to access a password manager) needs to be both remembered and stored somewhere (ie the password manager, not your brain). A secret heuristic doesn't and so is more secure by simply not also being stored somewhere outside your brain.

Depends on the implementation. For example with 1Password it is not stored anywhere unencrypted, it is derived with a slow password hash and mixed with a secret key (this part is stored) to unlock your vaults. You can't access your vault without both.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#246

Post by Rury »

commandersaki wrote: post #245
Rury wrote: post #244

Earlier quoted context omitted.

A master password (e.g. to access a password manager) needs to be both remembered and stored somewhere (ie the password manager, not your brain). A secret heuristic doesn't and so is more secure by simply not also being stored somewhere outside your brain.

Depends on the implementation. For example with 1Password it is not stored anywhere unencrypted, it is derived with a slow password hash and mixed with a secret key (this part is stored) to unlock your vaults. You can't access your vault without both.

You asked what the difference was. Simply put, you can't hack what does not exist. LastPass also stores passwords encrypted and was hacked.

In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#247

Post by commandersaki »

Rury wrote: post #246
commandersaki wrote: post #245

Earlier quoted context omitted.

Depends on the implementation. For example with 1Password it is not stored anywhere unencrypted, it is derived with a slow password hash and mixed with a secret key (this part is stored) to unlock your vaults. You can't access your vault without both.

You asked what the difference was. Simply put, you can't hack what does not exist. LastPass also stores passwords encrypted and was hacked. In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic.

LastPass didn't properly implement E2EE and because they used a weak password hash which affected low entropy passwords.

> In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic.

When I say 1P stores your master password encrypted, it usually does it as an item in the vault. You can easily remove it from the vault and therefore doesn't store it anymore, and you can have the same security as your secret heuristic. Storing it in your vault is of negligible concern.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#248

Post by Rury »

commandersaki wrote: post #247
Rury wrote: post #246

Earlier quoted context omitted.

You asked what the difference was. Simply put, you can't hack what does not exist. LastPass also stores passwords encrypted and was hacked. In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic.

LastPass didn't properly implement E2EE and because they used a weak password hash which affected low entropy passwords. > In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic. When I say 1P stores your…

You clearly are not a software expert.

If your master password is not stored anywhere, there is no way for 1P to know what your master password is - and so no way to validate what the correct password is to access your vault. Even if 1P doesn't store the master password on local disk, their servers, on a hard device, encrypted, unencrypted, or does it completely algorithmically or whatever... it is in fact stored somewhere outside your brain, and therefore more hackable than something that isn't stored anywhere other than your brain.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#249

Post by commandersaki »

Rury wrote: post #248
commandersaki wrote: post #247

Earlier quoted context omitted.

LastPass didn't properly implement E2EE and because they used a weak password hash which affected low entropy passwords. > In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic. When I say 1P stores your…

You clearly are not a software expert. If your master password is not stored anywhere, there is no way for 1P to know what your master password is - and so no way to validate what the correct password is to access your vault. Even if 1P doesn't store the master password on local disk, their servers, on a hard device, encrypted, unencrypted, or does it completely algorithmically or whatever... it is in fact stored som…

It is used ephemerally to unlock your vaults. It isn't stored anywhere. You're really clutching at straws here.

Given a sample set of passwords derived from a secret heuristic, it could be reversed. The secret heuristic isn't completely safe either. Moreover because it lives in your brain the algorithm is inherently low entropy and the resulting passwords will be as well. Furthermore the old adage applies, don’t roll your own crypto.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#250

Post by XorNot »

nonninz wrote: post #234
XorNot wrote: post #39

Earlier quoted context omitted.

I just have KeePass in a syncthing folder with a trigger to sync on open. Technically I think I could drop the trigger if the desktop app would open by making a temporary file copy and syncing back (ironically Keepass2Android is very good at this).

Can you expand why the trigger is necessary?

I have the folder which is synced, and then the device local copy which is what I open.

This is because AFAIK desktop syncthing doesn't like it if the file gets replaced out underneath it. This might've changed.

Post reply on HN