Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

251–260 of 443 posts

Re: LastPass autofill exploit

#251

Post by tedmiston »

matt_wulfeck wrote: post #236
kordless wrote: post #232

Earlier quoted context omitted.

What you are really "asking" is logically equivalent to this blaming statement: "I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass." Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population…

Or maybe he's just curious if this type of url regex fail is more widespread among similar software.

While this is something I'm generally curious of, especially with regex vulnerabilities being such a hot topic in software right now. See, for example, the regex issue last week that caused Stack Overflow to go down [0]. That aside, my concern stems solely from being a 1Password customer.

[0]: Stack Overflow Outage Postmortem https://news.ycombinator.com/item?id=12131909

Re: LastPass autofill exploit

#252

Post by DonHopkins »

0xmohit wrote: post #52
ktta wrote: post #44

Earlier quoted context omitted.

Please correct me if I'm wrong, but lastpass uses the same 'zero-knowledge' method that spideroak uses, other than spider oak uses that term everywhere including their cloud backup offering. Zero knowledge is merely the fact that spider oak only holds encrypted backups of your files and it has no way of seeing them. LastPass tells us the same thing.

Maybe I shouldn't have mentioned Encryptr. There are fair number of open source alternatives that allow you to store secrets in the cloud: vault: https://github.com/hashicorp/vault blackbox: https://github.com/StackExchange/blackbox git-crypt: https://www.agwa.name/projects/git-crypt/ Pass: http://www.zx2c4.com/projects/password-store/ Transcrypt: https://github.com/elasticdog/transcrypt Keyringer: https://keyringer.…

The missing penultimate pre-rhotic "e" in the name is a pretty good clue that you shouldn't have mentioned Encryptr.

Re: LastPass autofill exploit

#253

Post by nchelluri »

giuscri wrote: post #181
edent wrote: post #110

Earlier quoted context omitted.

Very simply, I have a password stored for "login.example.com". LastPass knows that companies like to change URLs - so next week it might be "userlogin.example.com" or "secure.example.com/login" or "www2.uk.vpn1.example.com" etc. Essentially, LastPass made the mistake of writing code which said "If you see `example.com` anywhere in the URL - assume that you're on the right site. LastPass will allow you to automaticall…

Ok, when is ever used a @ in the middle of url? I've never seen it. Also, what's the return value of the funcion?, and why are there 2 variable named URL?

http://user:password@example.com is valid syntax to supply u/p. Also, I suspect uri is first used up above in code we're not shown.

Re: LastPass autofill exploit

#255

Post by tedunangst »

estefan wrote: post #229
tedunangst wrote: post #198

Earlier quoted context omitted.

The people who are not the majority of researchers would be... Wait for it... A minority of researchers.

So... a minority of people aren't capable of causing trouble? I don't see your point.

Nothing in tptacek's comment implied that blackhats don't exist.

Re: LastPass autofill exploit

#256

Post by webXL »

kordless wrote: post #232
tedmiston wrote: post #189

Earlier quoted context omitted.

While you are here, can you confirm whether a similar regex vulnerability does not affect 1Password?

What you are really "asking" is logically equivalent to this blaming statement: "I see you are posting about LastPass' vulnerability, but you work for 1Password. Please confirm there exists a regex vulnerability in 1Password which is similar in nature to the one that occurred with LastPass." Put this way, the insanity of the statement is obvious. In questions, it becomes less obvious to the majority of the population…

I was about to downvote after reading your edit, but part of me likes that attitude. That you're so passionate about your objection actually helped me arrive at the same conclusion. That and my own thought: Why would a developer come on here to suggest a fix if they weren't aware of this potential security flaw?

There are appropriate channels to ask questions like that and appropriate times to downvote. But, hey, I'm not here to offend the hivemind. Please have mercy ;)

Re: LastPass autofill exploit

#257

Post by Springtime »

PeterWhittaker wrote: post #174

From TFA: Note: This issue has been already been resolved and pushed to the Lastpass users . The open questions are a) how long the flaw existed prior to being fixed and b) whether attackers were able to exploit the flaw.

There's also the issue of users being stuck on older versions of the addon.

Update: Looks like LastPass has made a blog regarding the exploit and have stated v3 of the addon is not affected [1]. Would be nice to have further clarification of the differences between v3 and v4 with regard to this.

[1] https://blog.lastpass.com/2016/07/lastpass-security-updates....

Re: LastPass autofill exploit

#258

Post by oslavonik »

haasn wrote: post #218
oslavonik wrote: post #117

Earlier quoted context omitted.

I've been amazed by Pass, but couldn't find a thorough review between Pass and KeePass(x). Is one safer than the other?

`pass` is based on well-established cryptography implementations: GnuPG. GnuPG is recommended by many security experts and used widely by journalists dealing with sensitive disclosures, e.g. the edward snowden documents. It also doesn't try to NIH some complicated database format or syncing technology but instead uses well-established software (git, plain directory structure and gpg-encrypted text files) which makes…

Thanks! I'll definitely migrate to pass soon.

Re: LastPass autofill exploit

#259

Post by IshKebab »

progx wrote: post #47
IshKebab wrote: post #46

Earlier quoted context omitted.

I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else). It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated…

Problem is, that not all sites use the same style of passwort. Some need Lower-/Uppercase, some with numbers, some with special Chars, some restrict to minimum of x chars, some use a maximum. Your system works not for all things, i use a similar system, but store a bunch of passwords with last pass. Only really important passwords are in my head.

Yes, occasionally sites don't allow it, but I've found if you use at least one of: uppercase, lowercase, numbers and symbols, and have a length of around 10, then it will go through virtually all sites.

I keep meaning to collate idiotic password rules so you can see for sure which patterns work in all of them, but I've never got around to it.

Re: LastPass autofill exploit

#260

Post by IshKebab »

agentgt wrote: post #56
IshKebab wrote: post #46

Earlier quoted context omitted.

I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else). It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated…

I do a vaguely similar thing but I don't share it with the world :)

That's not the actual system I use obviously.
Post reply on HN