Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

271–280 of 326 posts

Re: LastPass users warned their master passwords are compromised

#271

Post by barbs »

civilized wrote: post #125
onlyrealcuzzo wrote: post #107

Earlier quoted context omitted.

You could just use KeePass: https://keepass.info/ It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely. And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

Thanks for the tip! I will look into it. I am curious to find out how it syncs without servers. (I assume this is not an incredibly hard problem but we are just not used to doing things without "the cloud" these days)

Personally, I keep my file on Google Drive and download it wherever it's needed. It does require a bit of manual tracking to ensure I've got the latest file, but I've only got about a handful of devices that I need it for, and even if I don't have the latest version of the file, it just means I might be missing a password for a particular service, and I can quickly download the latest anyway.

Obviously it's not as nice as having a cloud service, but it's open-source and doesn't require trusting a third party, which I like.

Re: LastPass users warned their master passwords are compromised

#272

Post by barbs »

onlyrealcuzzo wrote: post #107
civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

You could just use KeePass: https://keepass.info/ It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely. And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

I found that KeepassXC is a nicer, multi-platform client https://keepassxc.org/

Re: LastPass users warned their master passwords are compromised

#273

Post by brendoelfrendo »

Just a heads up: the article mentions that people were reporting a "Something went wrong: A" error after trying to delete their account. I got that error but my email address no longer works to log in to LastPass, so I think the account deletion went through anyway. I haven't used LastPass in several years, anyway, so no loss.

For what it's worth, I got an unidentified login email today with an IP in Canada. I didn't see that login attempt in my LastPass access logs, however, so I don't know for sure if they used the correct master password. I did check, and it said that my master password was last set in 2015, so it's possible I was impacted in an older breach.

Re: LastPass users warned their master passwords are compromised

#274

Post by albedoa »

feoren wrote: post #181
hetspookjee wrote: post #99

Earlier quoted context omitted.

I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.

Nitpick: "orthogonal" would mean "independent of"; that is, a high dependency count has no effect on exposure. I think you might have meant "antithetical", meaning "in opposition to".

Here it means "perpendicular". A high dependency count is perpendicular to the goal of reducing exposure as much as possible.

Re: LastPass users warned their master passwords are compromised

#275

Post by gruez »

tialaramex wrote: post #253
gruez wrote: post #118

Earlier quoted context omitted.

>Because each hardware key is unique, this is not a feature currently available nor likely to become available. You don't necessarily have to do it crypto wallet style and have the private key be exportable. Just adding a public key export (on the security token side) and a way to enroll a token by its public key (on the browser/website side) would allow you to enable 2fa without having to make a trip to the safe dep…

For FIDO (and thus WebAuthn, and thus to make this actually practical beyond a toy that only works for some particular Yubico product) the keys are random per enrollment. This is intentional because it means that you can't be tracked, since "your" key on Facebook and "your" key on GitHub are no more related to each other than "my" key on Facebook is to "your" key on GitHub. Google have apparently some plans to addres…

>This is intentional because it means that you can't be tracked, since "your" key on Facebook and "your" key on GitHub are no more related to each other than "my" key on Facebook is to "your" key on GitHub.

I get the motivation behind it, but the mechanism I proposed in the last comment still preserves those properties? Each site would still get its own derived ECDSA public key. The master ECDSA public key would only be shown to the user and is to be kept within the browser. If a user wants to enroll a not-present security token, the browser will take the ECDSA public key and derive a public key to present to the site, so the site still can't track users using security tokens.

Re: LastPass users warned their master passwords are compromised

#276

Post by irrational »

kevinslashslash wrote: post #261
gregsadetsky wrote: post #204

Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen. The most egregious and hard-to-understand related cases (now 3!): https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday [Dec 27] and then someone just tried it again a few hours ago after I ch…

I'm one of the people that replied yesterday. I haven't used LastPass since, at the latest, 2017. I had actually deleted all my passwords from my LastPass vault, but originally kept the account because of LastPass's password sharing feature, though I stopped using that as well. I believe I had the LastPass extension installed on both Chrome and Firefox, on both Mac and Ubuntu. I primarily used Chrome on Mac. I did ha…

I’m a LastPass user. I change my master password every 6 months. I received the attempted login from Asia email also. So… it isn’t just some exploit from 2017.

Re: LastPass users warned their master passwords are compromised

#277

Post by tatersolid »

postalrat wrote: post #255
throw10920 wrote: post #108

Earlier quoted context omitted.

> Your master passwords aren't stored on their servers. Neither is your key information. ...and, those are the only things that really matter for an attacker. Encrypted data (assuming reasonably strong encryption) is useless without the key.

Some encrypted data is worthless. Some isn't. Depends on what value it has when down the road the encryption is broken.

If AES being broken is in your personal threat model, you have far more to worry about than passwords.

Re: LastPass users warned their master passwords are compromised

#278

Post by 3np »

vorpalhex wrote: post #49
gkoberger wrote: post #35

This is framed so negatively toward LastPass, which is unfortunate. They stopped all usage of correct passwords they believed were compromised, which is exactly what I'd want them to do in this situation. Them warning users their master passwords are compromised is a good thing! Yet it's framed as though they're admitting to something. "However, users receiving these warnings have stated that their passwords are uniq…

LastPass has had enough other security issues that I am doubtful of them to this day. https://www.mcafee.com/blogs/enterprise/cloud-security/lastp... Unfortunately the only password solutions I would recommend at this point are 1Password for something turn key, and BitWarden if you want to self host.

password-store aka GNU Pass, couple with your file-sync software of choice (your choice if you want to self-host or cloud).

Re: LastPass users warned their master passwords are compromised

#279

Post by cshepher »

dylan604 wrote: post #160
FearlessNebula wrote: post #61

Earlier quoted context omitted.

How do you sync your passwords across all of your machines? Do you self host your passwords on your own server? Do you manually sync?

1Pass has the ability to sync via WiFi, Dropbox, iCloud, etc. I only use the WiFi as the other options are still cloud platforms I don't trust.

These have all been removed in 1password 8. It is cloud-only, subscription-only.

Re: LastPass users warned their master passwords are compromised

#280

Post by errcorrectcode »

KeePass or PasswordSafe, and some means of synchronization.

None of these opaque, closed-source "cloud" password managers. Because if you don't control your secrets, then you don't have anything. I don't care if it's a zero-knowledge construction approved by Big Name Cryptography Guy or best intentioned founders since depending on a single service that could potentially hold your secrets hostage, expose them, or forget them would be insane.

The end.

Post reply on HN