Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

251–260 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#251

Post by 725686 »

joshstrange wrote: post #59
725686 wrote: post #49

Earlier quoted context omitted.

I use a simple algorithm. So you don't actually remember the password, put the algorithm to produce the password for the site or service. Not perfect, but each passwords turns out to be unique (mostly). I don't know what experts think about that, but it has worked fine for me.

The problems with this method are numerous: * If 1 to N password(s) leak the pattern may be obvious leading to your other accounts being compromised * Not all sites have the same password “rules” so there is no algorithm that works for all passwords without you being aware of the rules of the given site. Rules that only you only (may) have access to at signup time. * Typing passwords out manually sucks (slow and erro…

Yes! I'm totally aware, but, for the first point, attacks are generally automated. If someone tries to find the pattern, you are being personally targeted and you have bigger problems. As per number 2, it is true and it sucks big time. As per number 3, I don't really mind much. You don't generally have to use your password every time.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#252

Post by __MatrixMan__ »

gblargg wrote: post #120
tpurves wrote: post #23

Earlier quoted context omitted.

You know what every other online money transfer mechanism has? An ability to reverse transactions in the case or error or fraud. Because those things happen all of the time.

...in part because transactions can be reversed. The flip-side is that sellers get ripped off often by these reversals.

And also that it gets used as censorship. Paypal did it to Wikileaks.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#253

Post by Rury »

commandersaki wrote: post #249
Rury wrote: post #248

Earlier quoted context omitted.

You clearly are not a software expert. If your master password is not stored anywhere, there is no way for 1P to know what your master password is - and so no way to validate what the correct password is to access your vault. Even if 1P doesn't store the master password on local disk, their servers, on a hard device, encrypted, unencrypted, or does it completely algorithmically or whatever... it is in fact stored som…

It is used ephemerally to unlock your vaults. It isn't stored anywhere. You're really clutching at straws here. Given a sample set of passwords derived from a secret heuristic, it could be reversed. The secret heuristic isn't completely safe either. Moreover because it lives in your brain the algorithm is inherently low entropy and the resulting passwords will be as well. Furthermore the old adage applies, don’t roll…

Your the one that's grasping at straws and doesn't understand that 1P needs to store something in order to validate or generate your master password. The fact that this does happen, makes it less secure in comparison to not storing anything, as you can't hack something which does not exist.

> Given a sample set of passwords derived from a secret heuristic, it could be reversed. The secret heuristic isn't completely safe either.

Sure but this isn't the argument being made. As an analogy, not using any E2E is inherently less secure than using some E2E encryption, but using E2E encryption doesn't automatically mean you're more secure. Simply put, you had asked "What's the difference between a master password and a secret heuristic?" And that difference is a master password (or ways to generate it) must be stored outside your brain, and doing this is inherently less secure than not doing this.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#254

Post by commandersaki »

Rury wrote: post #253
commandersaki wrote: post #249

Earlier quoted context omitted.

It is used ephemerally to unlock your vaults. It isn't stored anywhere. You're really clutching at straws here. Given a sample set of passwords derived from a secret heuristic, it could be reversed. The secret heuristic isn't completely safe either. Moreover because it lives in your brain the algorithm is inherently low entropy and the resulting passwords will be as well. Furthermore the old adage applies, don’t roll…

Your the one that's grasping at straws and doesn't understand that 1P needs to store something in order to validate or generate your master password. The fact that this does happen, makes it less secure in comparison to not storing anything, as you can't hack something which does not exist. > Given a sample set of passwords derived from a secret heuristic, it could be reversed. The secret heuristic isn't completely s…

I already told you what it needs to store and it isn’t the master password. No master password needs to be “validated” even when authenticating to 1P servers. You clearly have a fundamental misunderstanding of cryptography. Anyways this is all explained in the 1Password security whitepaper.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#255

Post by Rury »

commandersaki wrote: post #254
Rury wrote: post #253

Earlier quoted context omitted.

Your the one that's grasping at straws and doesn't understand that 1P needs to store something in order to validate or generate your master password. The fact that this does happen, makes it less secure in comparison to not storing anything, as you can't hack something which does not exist. > Given a sample set of passwords derived from a secret heuristic, it could be reversed. The secret heuristic isn't completely s…

I already told you what it needs to store and it isn’t the master password. No master password needs to be “validated” even when authenticating to 1P servers. You clearly have a fundamental misunderstanding of cryptography. Anyways this is all explained in the 1Password security whitepaper.

No I understand dual key encryption, and like I said, there is still something stored (the key as well as the passwords in the vault). What you do not understand is how this is inherently less secure than not storing anything at all.

To give you a concrete example, 1Password doesn't guarantee you from say, being compromised by a keylogger, and someone stealing your master password (never mind the key which is in fact stored). A secret heuristic doesn't necessarily face such risks. Sure that doesn't automatically mean a secret heuristic guarantees you better security, but that's not the argument.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#256

Post by commandersaki »

Rury wrote: post #255
commandersaki wrote: post #254

Earlier quoted context omitted.

I already told you what it needs to store and it isn’t the master password. No master password needs to be “validated” even when authenticating to 1P servers. You clearly have a fundamental misunderstanding of cryptography. Anyways this is all explained in the 1Password security whitepaper.

No I understand dual key encryption, and like I said, there is still something stored (the key as well as the passwords in the vault). What you do not understand is how this is inherently less secure than not storing anything at all. To give you a concrete example, 1Password doesn't guarantee you from say, being compromised by a keylogger, and someone stealing your master password (never mind the key which is in fact…

Sure I’ll cede that storing nothing is safer. Yes an _authenticator_ is stored implicit in the MAC of the ciphertext holding the vault key, so in a way a key stretched version of the master password is validated. So with both a secret key and vault key wrapped ciphertext you can launch an offline attack.

But the keylogger or malware argument is a lazy one tbh, not only does it affect your secret heuristic as any input password is affected, basically no software can be guaranteed to be safe from malware or keylogger except maybe that running in something like a Secure Enclave or if your OS supports secure entry on certain fields (1P on Mac does this). If you’re in that position you got bigger things to worry about anyway.

But anyways it all depends on implementation as I said. 1P also supports passkey unlock eradicating the need for the master password (secret key stays), so you can still have the security you desire, particularly if you use a FIDO2 security key like a yubikey.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#257

Post by wraptile »

namaria wrote: post #160
er4hn wrote: post #100

Earlier quoted context omitted.

Truly, I will miss the days of goggling for tar commands when I can instead ask an llm.

Why use kilobytes of text and a handful of clock cycles when I can use terabytes of weights and thousands of teraflop-days of GPU farms to achieve the same result?

cache goes brrrr

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#258

Post by JadoJodo »

yard2010 wrote: post #132
JadoJodo wrote: post #60

I switched away from LastPass after the 2nd major security breach sometime around 2013. Wikipedia only shows 3 total incidents, but I know I've seen reporting on _at least_ 5 between 2010 and today. In that time, I've continued to run into its use at companies, and it's honestly surprised me each time. Something something fool me 5x…

How come this is legal? By now this is a business practice. Why would the government close down a restaurant after food poisoning but do nothing here?this is much worse, considering all this money goes to the axis countries?

I don't think there's anything illegal about being terrible at your job (information security), but I do think it's a tragedy that LastPass has somehow avoided the public shaming they so desperately deserve for their repeated ineptitude.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#259

Post by briHass »

loufe wrote: post #206
briHass wrote: post #62

Earlier quoted context omitted.

Passkeys tied to actual hardware, like the TPM-based solution in Windows Hello, whenever possible, Keepass where not. Keepass DB cloud synced, but the passkey file I use in conjunction with a p/w to open it never leaves the machine(s) it's on. Also, key file needs Admin rights to read, so KP is run privileged, which also protects its process memory space from user-land snooping.

Even better than the TPM in Windows is a hardway FIDO2 or OTP key, I'd imagine. Those cannot be comprimised by a virus on your PC in the same way, assuming you don't leave the key in at all times and you only tap the button when explicitly logging into something that would require it.

The TPM is resistant to attacks as well. It requires presence by entering the PIN.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#260

Post by trw55 »

guelo wrote: post #91
tharkun__ wrote: post #81

Earlier quoted context omitted.

Not their point tho. Me too, gpg, no problem. Heck I had the "'smuggled' out of the country as a book" pgp back when. My kids? I really am not so sure at all. Still too early to tell for sure but so far I don't think any will be as technically savvy as I am. I really doubt they'd know what GPG (or PGP) are and how to use it.

Presumably if you're leaving your kids an encrypted file with valuable stuff in it they won't be so illiterate that they can't figure out how to open it. Most people don't know gpg because they have no motivation to learn it not because they're incapable of learning it.

No motivation, sure. But do they even care? Most people just don't care about this stuff. You try to get them to care and they "say, yeah, okay, yeah, I know" as they roll their eyes and go back to scrolling Instagram or whatever.

The apathy is real and I don't see it getting better.

Post reply on HN