Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

281–290 of 326 posts

Re: LastPass users warned their master passwords are compromised

#281

Post by zaik »

Kwpolska wrote: post #39
sdan wrote: post #6

obligatory: I use passwordstore.org by Jason A. Donenfeld and its local, relatively easy to use, works with git, and free. Too niche for hackers to take interest I hope.

I used to use pass, and while it’s fine if you’re primarily a terminal user, it’s much less convenient if you’re dealing with Windows or mobile devices. Instead of fiddling with git and gpg (which is super painful on Android), I just use KeePassXC on desktop (Windows/Linux/Mac), Keepass2Android on Android, and sync my database via OneDrive. KeePass gives me search, storage of metadata and even attachments, simple cop…

If you're careful to not cause any merge conflicts (ie only pull never push) Password Store for Android [0] never caused me any problems.

[0] https://f-droid.org/packages/dev.msfjarvis.aps

Re: LastPass users warned their master passwords are compromised

#282

Post by SV_BubbleTime »

kobalsky wrote: post #85
nathancahill wrote: post #18

Earlier quoted context omitted.

Ah yes, the $5 wrench method.

The xkcd author did a disservice to online security with that comic. You can be forced to disclose your secrets but you will know they were compromised, that's encryption doing its job. There's a world of difference in knowing.

Same in the world of lock picking.

I can smash your door in, or simply break a window. The difference is you’ll definitely know I did it. But unless you in the routine of checking your lock pins for scratchmarks, you probably wouldn’t know if someone picked the locks.

Re: LastPass users warned their master passwords are compromised

#283

Post by SV_BubbleTime »

2OEH8eoCRo0 wrote: post #190
CyberRage wrote: post #171

Earlier quoted context omitted.

That's still an issue. humanly generated passwords tend to be predictable, repetitive and not very long. A computer will always do a better job at generating\remembering passwords. hardware 2FA is definitely a good idea.

They aren't human generated. I generate them programmatically and don't store them on silicon but on paper.

Secure paper is one of the best methods.

The issue is when you want to access that paper remotely or on the go. Then it becomes a really bad method.

Re: LastPass users warned their master passwords are compromised

#284

Post by SV_BubbleTime »

gruez wrote: post #84
pelorat wrote: post #63

Earlier quoted context omitted.

LastPass doesn't store passwords on their servers, so it's not some magical breach.

Right, but from an earlier HN thread people were saying their support forums prompted for their master password to log in?

How is this different from “enter your password and we’ll deliver your blob” and “enter your password and we’ll deliver you a login cookie”?

Neither way “must” they have stored your master password.

Re: LastPass users warned their master passwords are compromised

#286

Post by klabkam »

dqv wrote: post #207
foxfluff wrote: post #103

Earlier quoted context omitted.

It's negative because something's up and they haven't given a good explanation. > They stopped all usage of correct passwords they believed were compromised Immediate question: how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? From the information provided, the only thing they have is the IP & geolocation data, which isn't going to be reliable when the attacker(s) a…

I'm not here to defend LastPass, but there are some rational answers to the questions you're asking, a lot of them having to do with human psychology. First thing's first, and yes I am "victim blaming" when I say this: 60% of users reuse their passwords. [0,1] It's a widespread problem. Maybe that number is lower for a technical site like HN, but I have encountered technical people who do not practice what they preac…

Like the accidental VPN possibility: did anyone consider the recently released Apple iCloud private relay feature as a potential reason for receiving these notification? It may present a different IP/country to LastPass when actual users log in.

https://support.apple.com/en-us/HT212614

Re: LastPass users warned their master passwords are compromised

#287

Post by trajcek »

gregsadetsky wrote: post #204

Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen. The most egregious and hard-to-understand related cases (now 3!): https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday [Dec 27] and then someone just tried it again a few hours ago after I ch…

+1 on uBlock Origin, but I think that's just a too common of an extension rather than the cause.

Re: LastPass users warned their master passwords are compromised

#288

Post by CamelRocketFish »

gruez wrote: post #212
gregsadetsky wrote: post #204

Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen. The most egregious and hard-to-understand related cases (now 3!): https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday [Dec 27] and then someone just tried it again a few hours ago after I ch…

>I saw a few mentions of uBlock origin in yesterday's thread Statistically speaking it's probably because everyone has ublock origin installed, rather than it getting hacked. It's used by 5M+ users on firefox and "10,000,000+" on chrome. If ublock was really compromised you'd expect widespread reports of account compromise, rather than for only one password manager.

Curious to know why you shortened 5M but not 10,000,000

Re: LastPass users warned their master passwords are compromised

#289

Post by CamelRocketFish »

kryogen1c wrote: post #248
tyingq wrote: post #72

Earlier quoted context omitted.

>Must be a compromised browser extension at this point Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit. Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility. Edit #2: Some of the larger js files do have a fair amount o…

> The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. i wonder if any of that is log4j ( :

How could it be log4j if it’s JavaScript and not Java?

Re: LastPass users warned their master passwords are compromised

#290

Post by CamelRocketFish »

jjav wrote: post #158
jeffrallen wrote: post #48

Several years ago, I chose LastPass, bought it, and did all the set up. Then they were acquired by someone I didn't trust, so I immediately switched to 1Password, and never regretted it for a second. If 1Password sold out, I'd switch again, in a second.

While this is a good approach at a high level, it's also worth pointing out that the usage should not be based on trust. You should evaluate if you're comfortable using this or that password manager even if they were aquired by the most evil company you can think of. If the design is solid, it shouldn't matter since the evil company shouldn't be able to compromise anything. If it does matter, then you shouldn't be us…

The problem is we don’t have access to the design as it’s closed source?
Post reply on HN