Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

271–280 of 311 posts

Re: LastPass Security Notice

#271

Post by eru »

tbabb wrote: post #245
jjoonathan wrote: post #239

Earlier quoted context omitted.

Just how long have you kept this up? When I gave it a go, the sites which didn't accept the base+permutation approach stacked up quickly. Some mandated a length which was too short, some mandated a length which was too long, some required certain special characters, others forbade the same, some required multiple separate passwords (i.e. security questions or pins), some just gave me a password and didn't let me chan…

I've found a length of password that covers probably 85-90 percent of my accounts, and is a good tradeoff between security and portability. Most sites accept special characters, and the ones that don't also tend to be the same ones that have retarded length restrictions. Ironically these tend to be banks, who should know better! The small subset of sites that don't fit into the scheme get one from a pool of fixed pas…

Actually, length restrictions of a few kiB are fine. Otherwise you open yourself to some forms of DoS attacks, I believe.

Re: LastPass Security Notice

#272

Post by newman314 »

x3n0ph3n3 wrote: post #242
newman314 wrote: post #198

Earlier quoted context omitted.

Dropbox is not the only option. While not officially supported, I sync 1Password just fine using BTSync in local mode (no tracker, no relay). Sure, it's kind of a pain (I can only sync on my home network) but worth the trade off to me. I mean how often do you have to sync passwords?

Consider using dynamic DNS for a central home server and predefined hosts in your mobile devices or laptops.

I think I did set this up but was not working for some reason. However, it's not a high priority item to debug.

Re: LastPass Security Notice

#273

Post by SpendBig »

"LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed."

I wouldn't mention that if your data has just been compromised. Although it makes is hard to handle that data, it is more info about how the data is encrypt.

Re: LastPass Security Notice

#274

Post by Freaky »

jlev wrote: post #23
makeitsuckless wrote: post #17

Earlier quoted context omitted.

A centralized store is however unavoidable if you want to share and manage passwords inside an organization. Although I share you discomfort, looking at it rationally I prefer to trust a specialized service, who's very existence and reputation depends on it, more than the alternatives. The other alternative for sharing is stuff like 1Password over Dropbox, which is imho the worst of both worlds.

Why is 1Password over Dropbox the "worst of both worlds"? Seems like it's potentially safer, because it's encrypted with your passphrase and also your dropbox credentials. Sure, the NSA can probably get it, but J Random Hacker can't.

Anyone else remember that time Dropbox accidentally turned off authentication and you could log in as anyone?

https://nakedsecurity.sophos.com/2011/06/21/dropbox-lets-any...

Re: LastPass Security Notice

#275

Post by tzs »

rwhitman wrote: post #133
AdmiralAsshat wrote: post #76

See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS. It also has a way better Firefox add-on than any of the others I've seen (which is my main browser), and the Android apps, if unofficial, aren't bad either [0]. Importantly, they feature the ability to either pull from a local Keepass DB or to get it from a connected Google Drive account. I've take…

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

According to other comments here, your LastPass master password is used both to encrypt your stored passwords and as the password to log into their cloud storage. So someone compromising the login processing would also get the keys to the password encryption for the compromised accounts.

With 1Password and Dropbox the 1Password master password and the Dropbox login password should be unrelated. My Dropbox password, in fact, is a long password generated by 1Password's password generator. If someone gets a hold of it by compromising Dropbox, they might then get a copy of my encrypted passwords, but they get no clue to my 1Password master password.

There is some unencrypted non-password data in 1Password's data, so I'd not be happy if Dropbox were compromised, but it would not be a disaster.

Re: LastPass Security Notice

#276

Post by dtech »

jjarmoc wrote: post #99
tptacek wrote: post #81

Earlier quoted context omitted.

But isn't it encrypted with a secret that is also used to log into their web site, or to log into their API to recover the vault?

This is one of the things that scares me. If an attacker had access to dump their credential digests, could they also have modified the site to silently log credentials upon entry? From their statements so far, it doesn't seem that happened, but it seems likely that it could.

It's a whole different cup of tea though, this compromise required the attacker(s) to go in, download data and get out. Your scenario would also require the attacker to have changed their site and go unnoticed for any significant amount of time.

If that was the case I'm sure Lastpass would've found out and reported as such.

Re: LastPass Security Notice

#277

Post by zaroth »

ocdtrekkie wrote: post #193
serf wrote: post #177

Earlier quoted context omitted.

Lastpass is a huge target, and while I believe they generally take reasonable security measures, for many the risk of compromise may be greater than an encrypted stand-alone password database. Couldn't you frame that same basic belief around any large 'nearly-monolithic' web service, like Google, Apple, or Facebook? I agree, passwords are a risky business (you're storing security tokens for other people for chrisakes…

Yes, and I'd consider Google, Apple, and Facebook huge targets with major compromise risk as well. People tell me Google security is absolutely without equal, but when it's hacked, I, for one, will be unsurprised. With cloud services hacks, there is no "if"s, only "when"s.

What do you mean "when"? Google was hacked quite thoroughly by China a few years past. Not to mention the NSA.

Re: LastPass Security Notice

#278

Post by ionised »

thom_nic wrote: post #58
scotu wrote: post #50

Earlier quoted context omitted.

>This is one area where I feel strongly that the conveniences of 'Cloud' are outweighed by the risks. I wish this was true, in fact with at least 3 devices I use daily, having an offline password manager means I need to type in manually "difficult" passwords on 2 (n-1) devices (at least that's assuming how password managers and username-password auth work today). Call me lazy but that's already above threshold for me…

I've taken to using Keepass which is an encrypted, open source offline password manager, plus Dropbox for sync between all of my devices. While I can't control the security of Dropbox, I can at least control the level of encryption on my Keepass database. Keypass lets you use a "key file" (in addition or instead of a password) which you could copy to each of your devices once, which would make for a very secure passw…

You can also use another encryption mechanism like GPG or something akin to TrueCrypt's (not sure how people feel about using TrueCrypt 7.1a these days) encrypted hidden containers to hold your KeePass database on your cloud storage, which itself would also be encrypted and need a key file.

This way you have three or four separate, strong barriers of entry to your KeePass database.

Re: LastPass Security Notice

#279

Post by andybak »

asavadatti wrote: post #103
eco wrote: post #66

Earlier quoted context omitted.

I tried to use something similar a long time ago (SuperGenPass). The problem I had with it was that often times the password would not meet the password requirements of the site. Sometimes it's too long, sometimes there weren't enough numbers or symbols. I couldn't use it if I'd have to remember that it didn't work for particular sites (after all, the whole point is not having to remember information for each site).…

I hate such site with a passion. Especially ones that say a 10 character password is too long.

I hate any website that imposes a specific password format on me. I have a fondness for vaguely pronounceable passwords and I tend to use all-lower case for anything I have to enter on a mobile device.

So - reject my 16-character all-lower case password because there's no numbers or punctuation in it and you know better than me? Grrrrrrrrr.

Re: LastPass Security Notice

#280

Post by mziulu »

pdabbadabba wrote: post #22
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

>> (Though if you've found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?)

I'd like to chime in with another suggestion for a storage solution that I haven't seen mentioned yet: syncthing ( https://syncthing.net/ ) makes for a very good alternative to Dropbox, letting you synchronize your data across your devices but without relying on a third party service to do so. I use it to sync my KeepassX database across Linux, Windows and Android devices.

Disclaimer: I'm not affiliated in any way with syncthing, I'm just a happy user.

Post reply on HN