Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

261–270 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#261

Post by diarrhea »

fruit2020 wrote: post #251
hoistbypetard wrote: post #211

Earlier quoted context omitted.

> is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). You can see their server and client code here: https://github.com/bitwarden I choose to use their clients unmodified, along with an instance of the server formerly known as "bitwarden_rs" running in my basement as the sync backend. https://github.com/dani-garcia/v…

Do you expose your server to the internet or is it ok to sync devices only when you’re at home? Is every device a replica, if you lose your server can you redeploy it from the data on your device?

Not the parent, but I have been hosting a Vaultwarden instance on the public internet for about two years now.

After learning about certificate transparency logs, I moved the app from a raw subdomain behind a secret URL path. Think “hello.domain.com/correcthorsebatterystaple”.

Is it security by obscurity? You bet. Does it work? Yes. I regularly evaluate the JSON logs emitted by Caddy in a pandas script and so far, no foreign party has even hit that endpoint.

It’s like an extra username of sorts you’d have to know. I’ve always been unsure of where to draw the line when it comes to obscurity. People online are viciously against it, but isn’t a password also just obscurity, if you squint your eyes real good? It’s all secrets users would need to know.

All that being said, I’m thinking of hosting it at-home-only as well. Would be a huge win in security and barely any loss in convenience.

Re: The situation at LastPass may be worse than they are letting on

#263

Post by 12907835202 »

smegger001 wrote: post #221
pigsty wrote: post #36

Earlier quoted context omitted.

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

>It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak. ehh. I store my passwords online but its on a file I encrypted offline with strong password (over 20+ characters) and key. I use keepass which is a locally encrypted and stored password manger, and I store the DB on Dropbox and download it to any o…

How does this work with mobile chrome/Firefox etc. Does it sync?

Re: The situation at LastPass may be worse than they are letting on

#264

Post by konha »

smegger001 wrote: post #221
pigsty wrote: post #36

Earlier quoted context omitted.

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

>It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak. ehh. I store my passwords online but its on a file I encrypted offline with strong password (over 20+ characters) and key. I use keepass which is a locally encrypted and stored password manger, and I store the DB on Dropbox and download it to any o…

> I don't trust password wallet services ass they all seem to want to do the enryption server side with a reset-able password which really means they have the master password not you

None of the popular password managers work this way.

Re: The situation at LastPass may be worse than they are letting on

#265

Post by _cenw »

darawk wrote: post #257
heywoodlh wrote: post #206

So is there any way to verify what this person is saying? I mean, from the way LastPass is evolving it doesn't seem unlikely to me -- but why is this tweet on HN? Is there any supporting evidence aside from an anecdote, does this Twitter account have a strong reputation of being credible, etc.? Without context, I just don't understand why this anecdotal thread should be considered credible. Disclaimer: I use FOSS pas…

It seems like a reasonably well written anecdote by someone who has some idea what they're talking about. It could obviously be false, but the consequences if he's right are potentially serious for a lot of HN users who might use LastPass. The consequences if he's wrong are a little extra reputational damage for LastPass, but that seems like a worthwhile tradeoff here. Not everything posted on HN has to be verified t…

> someone who has some idea what they're talking about

"I suspected someone used a 0day on me" is not exactly inspiring confidence

Re: The situation at LastPass may be worse than they are letting on

#266

Post by mike_d »

tkanarsky wrote: post #194
bombcar wrote: post #177

Earlier quoted context omitted.

It’s basically what modern ddos protection does - the WASM computational calculation is a digital dew can.

Wait, so you're telling me that Cloudflare interstitial is running some PoW check on my client? I always thought that was just a way to let the user know they're being rate limited on Cloudflare's end.

Effectively yes. Not mining bitcoin, but modern bot detection works by asking your browser to do various tasks and comparing the results to a known good sample.

It could be a complex math problem, or another common trick is to purposely trigger bugs like a javascript engine not rounding numbers correctly in edge cases.

Re: The situation at LastPass may be worse than they are letting on

#267

Post by aborsy »

wlonkly wrote: post #154
aborsy wrote: post #124

This claim looks strange. A 16 characters password from all character types can’t be broken. How could hackers break the vault, with end to end encryption and such password?

A _random_ 16-character password from all character types can't be brute-forced. A password made from common dictionary words, with numbers substituted in with l33tsp3ak, and an exclamation mark on the end, is a different story. Passwords like that would be sitting in precomputed hash lists already.

Read the tweets, explaining how they generated their password.

Re: The situation at LastPass may be worse than they are letting on

#268

Post by [deleted] »

wepple wrote: post #190
technion wrote: post #121

Earlier quoted context omitted.

I definitely feel the opposing law works. When I see a project with a massive disclaimer about "this crypto is not audited, I'm a noob never deploy this anywhere" I'm likely to see better crypto than most of the commercial products I work with, including ones with sales people that talk about unbreakable crypto.

And likewise “military grade encryption” usually means “win2k Visual Basic backend”

[deleted]

Re: The situation at LastPass may be worse than they are letting on

#269

Post by whatshisface »

kodah wrote: post #232
wepple wrote: post #190

Earlier quoted context omitted.

And likewise “military grade encryption” usually means “win2k Visual Basic backend”

That's a silly term for that. Commercial businesses have the same access to NIST that the military does. Their guidance is even free! Military grade when we're talking about a screw is a little different. It means that the screw is made and QC'd to a very specific spec/standard. My next question might be, "Where can I find you on the FedRamp approved list?". To which, I'm sure they'd respond that anything outside the…

In electronics military grade means it works over a wide temperature range. That's about it.

Re: The situation at LastPass may be worse than they are letting on

#270

Post by darawk »

_cenw wrote: post #265
darawk wrote: post #257

Earlier quoted context omitted.

It seems like a reasonably well written anecdote by someone who has some idea what they're talking about. It could obviously be false, but the consequences if he's right are potentially serious for a lot of HN users who might use LastPass. The consequences if he's wrong are a little extra reputational damage for LastPass, but that seems like a worthwhile tradeoff here. Not everything posted on HN has to be verified t…

> someone who has some idea what they're talking about "I suspected someone used a 0day on me" is not exactly inspiring confidence

Why not? I have a security background. I see nothing wrong with that statement. Although what he actually said was:

"Initially I imagined I was targeted by a 0day or rootkit"

which actually does not make sense, because it implies he thinks those two things are fungible. He's obviously not a security expert, but he's also obviously not totally technically incompetent.

Post reply on HN