What I find concerning is PKDBF was used, even https://en.wikipedia.org/wiki/PBKDF2 quotes PKDBF1 and PKDBF2,and that is recommended to use PKDBF2. Is there any evidence to show that they indeed rolled their own encryption rather than use a de-facto standard AES algorithm? Or is there something that is missing.
The situation at LastPass may be worse than they are letting on
291–300 of 436 posts
Re: The situation at LastPass may be worse than they are letting on
#292Best to just use pass ( https://www.passwordstore.org/ ) with your own gpg key rather than rely on any 3rd party service. Then set up a git repository on a (free) google cloud instance, (or even use github/gitlab), and you're set to sync your passwords to all your devices.
That is way too much work. Doing work means stuff is happening and stuff means sidechannel attacks that someone else hasn't audited, because it's not an integrated product anyone would bother auditing. In particular, I don't see how 2FA is possible with this, so shoulder surfing is a bigger issue. I definitely trust Google or BitWarden more than a password I can memorize plus my own constant vigilance.
> In particular, I don't see how 2FA is possible with this
Umm, why not?
First, you can use a different app (like aegis) to generate OTPs.
Second, pass has an extension (https://github.com/tadfisher/pass-otp) that can be used to generate OTPs.
Third, you can use something like oathtool to generate your otp using your totp secret
oathtool -b --totp "your-totp-secret"
Re: The situation at LastPass may be worse than they are letting on
#293I so much wish Google would provide a password manager within Workspace. I'm yet to find a trustworthy frictionless product for my business.
Does https://passwords.google.com/ count?
Re: The situation at LastPass may be worse than they are letting on
#294Imagine storing all your sensible passwords in the cloud of a private company lol
Re: The situation at LastPass may be worse than they are letting on
#295Please stop commenting whether you are a LastPass user or not. Some of your profiles on HN have an email address and in general all your comments are public so can be mined, plus "rich techies" could be prime targets for more direct and elaborate phishing campaigns.
For all you know, they are bots or shills to encourage actual users to comment. Remember this? hey, if you type in your pw, it will show as stars ********* see! hunter2 doesnt look like stars to me ******* thats what I see oh, really? Absolutely you can go hunter2 my hunter2-ing hunter2 haha, does that look funny to you? lol, yes. See, when YOU type hunter2, it shows to us as ******* thats neat, I didnt know IRC did…
the ol' hunter2 ... haven't seen this irc dialogue in years, thanks for the laughs
Re: The situation at LastPass may be worse than they are letting on
#296And when I say that I will stop using 1password when the local vault no longer works, people look at me like I'm paranoid and crazy. I've looked at the white paper https://1passwordstatic.com/files/security/1password-white-p... , I think 1password has a decent security posture for their cloud offering but then there's always the risk of a breach where the attacker controls the site and can intercept your master passw…
There is always the risk of an attacker infiltrating the company to write vulnerabilities or a government forcing the cloud provider to write malicious code in order to degrade security. That's what the U.S. government almost succeeded at forcing Apple to do in the wake of the San Bernardino case. A local vault is better than a cloud vault, but if that local vault software is written by a commercial company there's s…
> A local vault is better than a cloud vault, but if that local vault software is written by a commercial company there's still that risk.
Depending on your device and platform there's still "that risk" even if its open source. If you're compromised, you're compromised.
Re: The situation at LastPass may be worse than they are letting on
#297Best to just use pass ( https://www.passwordstore.org/ ) with your own gpg key rather than rely on any 3rd party service. Then set up a git repository on a (free) google cloud instance, (or even use github/gitlab), and you're set to sync your passwords to all your devices.
This reintroduces phishing vulnerabilities that current password managers don't have, leaks metadata (which is exactly what's been verified to have happened with lastpass), requires separate management of your gpg keys, and lastly, hosting in git doesn't sync. If two devices change the same password file, you can't merge that.
Re: The situation at LastPass may be worse than they are letting on
#298Re: The situation at LastPass may be worse than they are letting on
#299For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…
Bitwarden, Keeper ($ but trusted at megacorps), and good ol' PasswordSafe are the safest solutions. I run BW with Yubikey 2FA and a local hosted sync server. KeePassX/C perhaps. Vault for secrets management. Never touched LastPass, 1Password or any of these other mickey-mouse commercial apps that invariably claim "military-grade encryption" or "unhackable" when their fundamental constructions are crap.
Curious to hear what 1Password is doing wrong?
Re: The situation at LastPass may be worse than they are letting on
#300Earlier quoted context omitted.
But if you had a ton of credentials from people, scanning for crypto credentials and trying to use those may be easier/faster/safer to turn into money than system credentials to some random company network.
They weren't really credentials, but keys. Pop those into any compatible wallet and you control the money now. If someone had put the key in the URL field (because there is no corresponding URL because it's not a credential), and the URL field was unencrypted, that could account for it.
I suspect people use secure notes to store crypto keys.