Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

251–260 of 311 posts

Re: LastPass Security Notice

#251

Post by asquabventured »

andrewaylett wrote: post #171
asquabventured wrote: post #115

Earlier quoted context omitted.

A solution I have found that (I think) is relatively secure. Setup a keepass database that requires the use of an unlock password and key file. Sync the database to Google Drive but never sync the key file! Only store the keyfile on a locally ecrypted thumb drive or only stored locally on the devices (preferably encrypted) that you need to access keepass from. In random time/day intervals reset your key file and keep…

I'm concerned (but not qualified to judge) that changing your password and keyfile may not be as beneficial as it appears. A password for an encryption key is very different to a password for a server. Once you change your password on a server, there's little harm in publishing it -- it can't be used any more. But the key is a file that may still exist (see also Wikileaks' key being published by David Leigh). Conside…

The key it seems to me is by using both a master password and a key file. If a site gets cracked and they find your site specific password that won't help them determine your keepass database master password &/or generated key file that you only store offline and never sync to the cloud.

In order to open the database you need both the correct master password and the correct keyfile. If the attacker doesn't have both, they should not be able to get into the database.

Re: LastPass Security Notice

#252

Post by asquabventured »

jcline wrote: post #233
andrewaylett wrote: post #171

Earlier quoted context omitted.

I'm concerned (but not qualified to judge) that changing your password and keyfile may not be as beneficial as it appears. A password for an encryption key is very different to a password for a server. Once you change your password on a server, there's little harm in publishing it -- it can't be used any more. But the key is a file that may still exist (see also Wikileaks' key being published by David Leigh). Conside…

I'm also no qualified to judge, but I would say it's important that in addition to rotating the password and key file used to encrypt the password database, one also rotates the all the passwords in the database regularly. This way, if someone obtains a copy of your database, they have a limited time before all the passwords in the database become useless.

This is true, as well as enable 2-factor authentication for sites that support it.

Re: LastPass Security Notice

#253

Post by kr4 »

tbabb wrote: post #166
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

My compromise has been to come up with a password permutation scheme-- I have a long, secure, high-entropy password which I can modify/salt in a way that's predictable (to me) across sites, such that each site's credentials are unique. Obviously this works across all devices, because the scheme is in my head, and it's simple enough to remember. I don't use any password manager, because like OP, that seems like too mu…

I use the same scheme but on top of it I hash it so even if site saves my password in plain text, it doesn't reveal my scheme. I use a portion of hash for sites which have maxlength constraint otherwise full hash.

Re: LastPass Security Notice

#254

Post by pseudonym »

bradknowles wrote: post #249
ernsheong wrote: post #202

Earlier quoted context omitted.

Unfortunately I can't use 1Password at work because it doesn't have a browser client, and I can't install anything I like on my computer (corporate). Sticking to Dashlane for now.

1Password has integration with Firefox, Safari, Chrome, and presumably also IE. They don't build their own browser into which their tool is built, no. They don't provide you a browser-only solution like LastPass, no. But they do fully integrate with most of the common browsers.

Doesn't help in this situation-- you need to be able to install the base executable for the browser extensions to function.

Re: LastPass Security Notice

#255

Post by sk5t »

llimllib wrote: post #54
walterbell wrote: post #19

Earlier quoted context omitted.

STRIP ( https://www.zetetic.net/strip/ ) is a mature offline password manager that has been around since the late 1990s, available on iOS, Android, Windows and OSX. It uses the open-source encryption extension to SQLite, https://github.com/sqlcipher/sqlcipher , developed by the same company. STRIP supports mobile-desktop synchronization over local wifi or remote cloud (Dropbox & Gdrive).

> STRIP supports mobile-desktop synchronization over local wifi or remote cloud (Dropbox & Gdrive). Right, but the threat model here is exactly the same! Except you're trusting Dropbox and Google instead of LastPass.

Only if you want to use that approach for syncing; you can also sync strip with local files, then delegating cross-device accessibility to network share, btsync, or something else.

Re: LastPass Security Notice

#256

Post by sosborn »

dzhiurgis wrote: post #235
archinal wrote: post #206

Earlier quoted context omitted.

But if your password for foo.com is 10,000 rounds of PBKDF2-SHA256(foo-hunter2-XYZ) and so on, this is extremely effective.

Yeah that would be nice. I actually think browsers should have this as a feature. But the problem is that not all websites accept long passwords. My bank wouldn't take longer than 8 characters and doesn't even have a second factor auth. Office 365 wouldn't accept more than 16 characters. I think it was Paypal who wouldn't take more than 10.

> My bank wouldn't take longer than 8 characters

Ugh, that is seriously infuriating. Of all the websites I have accounts with, that's the top of my "Shit I care about" list.

Re: LastPass Security Notice

#257

Post by jmcphers »

asquabventured wrote: post #115
jjarmoc wrote: post #30

Earlier quoted context omitted.

> Maybe there are people out there who will accept much more inconvenience in exchange for avoiding the risk associated with a cloud-based service. But, for me, the inconvenience is simply too much. Sure, it's a balance everyone has to find for themselves. As you note earlier, a cloud password manager is better than shared passwords. I'm certainly happy to accept a bit more inconvenience than most. I only do banking…

A solution I have found that (I think) is relatively secure. Setup a keepass database that requires the use of an unlock password and key file. Sync the database to Google Drive but never sync the key file! Only store the keyfile on a locally ecrypted thumb drive or only stored locally on the devices (preferably encrypted) that you need to access keepass from. In random time/day intervals reset your key file and keep…

I do something very similar to this, but I sync the key file to a second service (both services have 2FA logins). Keeping it off "the cloud" entirely is indeed safer from a security perspective, but think about how many copies of your key file you have, and what would have to happen to destroy all of them. If you've just got the key file locally on e.g. your laptop and maybe a smartphone, it doesn't take much more than a petty theft to cause you to lose access to every service in the database (in which situation of course you'd paradoxically want access to those services right away!).

Re: LastPass Security Notice

#258

Post by corvus_sapiens »

throwaway562167 wrote: post #238
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

Here's my solution: 1. Think of a 'stock phrase' that is simple for me to remember but likely to be unique, such as "angry dogs never jump for joy". 2. Write a simple program to generate 4 words at random, so it might generate "led show joke via" or "dean rock ranch ocean". 3. Generate a password by concatenating first letters of the stock phrase, the first two letters of the site name and the 4 random words. So the…

I do something similar in concept. I start off with a base password with numbers, letters, and symbols (to fit most website requirements). Then, I generate 2 random words based on the website name (based on the syllables). For instance, Gmail -> GM -> Green Mollusk or Amazon -> AM -> Aromatic Mitten. I find that it helps with remembering them naturally since the random words form a mnemonic on their own. The solution space is still large enough that knowing the rule should still be secure in real-world applications.

Re: LastPass Security Notice

#259

Post by aptwebapps »

harshreality wrote: post #150
tptacek wrote: post #43

Earlier quoted context omitted.

I find this design kind of baffling. Why go through the trouble of storing data encrypted only to snatch defeat from the jaws of victory by demanding that the client provide a secret derived from the encryption key just to log in?

I suppose they need to ensure that the person logging into the site, or interacting with the site via the browser extension, actually created the encrypted archive. Without a passphrase-derived authentication token (which they say is something like pbkdf2(encryption_key + passphrase), where encryption_key itself is pbkdf2(email + passphrase)), how could they ensure that? Without that connection, if they had a totally…

That's true, but you have a local copy by default. I'm not sure what happens if the local and the server copy get radically out of sync - I don't know if it would purge your local copy or not.

Re: LastPass Security Notice

#260

Post by fredsted »

benjarrell wrote: post #8
fredsted wrote: post #6

I've always had the feeling that LastPass was held together by sticks and duct tape, especially the frontend.

Behind the scenes, most software is.

Bad software is.

LastPass' user interface is really badly designed. There's lots of bugs and weird behavior. Experienced web developers can tell it's made without care. You don't want a password manager where the company doesn't care about its product.

There were other weird bugs, like assigning users to teams was finicky. Shared passwords didn't show up.

All this doesn't come as a surprise. The LastPass team didn't know what they were doing.

Post reply on HN