Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

31–40 of 311 posts

Re: LastPass Security Notice

#31

Post by Someone1234 »

I just deleted, regenerated, and re-associated Google Authenticator and then altered the number of iterations from 10,000 to 10,001 (causing it to re-encrypt the database). None of this is really required but it has invalidated much of the information they could have stolen.

The thing that really bugs me about this, is the email address. I have a very low spam level on that account (sub-1 per day on average) and I want to keep it that way. Last thing I need is someone to dump this theft onto a Pirate Bay-like site and then to get spammed by everyone and the kitchen sink.

Re: LastPass Security Notice

#32

Post by jlward4th »

pdabbadabba wrote: post #22
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

The difference is that a password manager must be able to decrypt a password in order for it to be used, while ideally websites only store one-way hashed passwords which if stolen aren't always useful at gaining access to other sites.

Re: LastPass Security Notice

#33

Post by quonn »

jlev wrote: post #23
makeitsuckless wrote: post #17

Earlier quoted context omitted.

A centralized store is however unavoidable if you want to share and manage passwords inside an organization. Although I share you discomfort, looking at it rationally I prefer to trust a specialized service, who's very existence and reputation depends on it, more than the alternatives. The other alternative for sharing is stuff like 1Password over Dropbox, which is imho the worst of both worlds.

Why is 1Password over Dropbox the "worst of both worlds"? Seems like it's potentially safer, because it's encrypted with your passphrase and also your dropbox credentials. Sure, the NSA can probably get it, but J Random Hacker can't.

I'm not even convinced the NSA can get it. There are no side-channels to exploit here (which we know the NSA is good at) and cooperation from online services won't work either. The protocols used to encrypt this are fairly simple and well-understood and we should not assume that the NSA is capable of breaking the underlying (strong) primitives.

Re: LastPass Security Notice

#34

Post by jjarmoc »

wepple wrote: post #20
LawnGnome wrote: post #5

I don't use LastPass, but one thing that impresses me about their blog post: they didn't hide behind "your passwords are hashed" or something equally weaselly, but instead said exactly and clearly how passwords are hashed. Every online company should take note.

I would however appreciate more detail on the breach. This would at least give an indication of their general security posture. I'm reading this as an embarrassing security lapse in general security, so they misdirect by talking in depth about password hashing.

I would also appreciate more detail, but that shouldn't be their first priority.

They note that they discovered the breach on 'Friday' so I imagine they have an ongoing Incident Response right now. They may not have or be ready to share this information at this time, and that's fine. They might be working with law enforcement, further hardening systems, and continuing to confirm their findings to date to ensure they've mitigated the full impacts.

What's important now is conveying how users are impacted and what steps they should take to protect themselves; hopefully the rest comes in time.

Re: LastPass Security Notice

#35

Post by redwards510 »

If you are using LastPass without 2FA (YubiKey, etc), people attacking LastPass itself is really the least of your problems. I'd be much more concerned about keyloggers grabbing your password. BeEF can pop up a LastPass phishing prompt if you just happen to load the wrong javascript file.

Using just one string of characters to protect ALL of your passwords is insane.

Re: LastPass Security Notice

#36

Post by quonn »

TheSwordsman wrote: post #29
jlev wrote: post #23

Earlier quoted context omitted.

Why is 1Password over Dropbox the "worst of both worlds"? Seems like it's potentially safer, because it's encrypted with your passphrase and also your dropbox credentials. Sure, the NSA can probably get it, but J Random Hacker can't.

Dropbox doesn't encrypt files, AFAIK.

I think Dropbox encrypts data before storing it with 3rd-party providers (Amazon). At least I think they used to.

Re: LastPass Security Notice

#38

Post by jnevill »

Tomte wrote: post #3

Oh great, just the day before yesterday I finally jumped to LastPass (because obviously WinKee is not compatible to my new Lumia phone), using my best password (long, no real syllables, memorized). It sounds like the password is still safe enough, but it's a very unfortunate, inconvenient timing indeed.

I've been using them for over a year. Their UI's are just the worst. They look like they've been designed by someone who has only seen Window's 95 software. Other than that, though, the service and underlying software seems pretty solid.

I have it generate passwords on new sites and any site where I need to change a password due to breaches and whatnot. I haven't known my facebook password for over 12 months. It's some random bunch of characters, and that makes me feel good.

I've enabled 2FA with Google Authenticator and it sounds like, after this breach, any new device that tries to get on my lastpass account has to be authorized over email.

They really appear to take security seriously. I guess they should since that's really their only game.

Re: LastPass Security Notice

#39

Post by Someone1234 »

quonn wrote: post #26
makeitsuckless wrote: post #17

Earlier quoted context omitted.

A centralized store is however unavoidable if you want to share and manage passwords inside an organization. Although I share you discomfort, looking at it rationally I prefer to trust a specialized service, who's very existence and reputation depends on it, more than the alternatives. The other alternative for sharing is stuff like 1Password over Dropbox, which is imho the worst of both worlds.

1Password only stores encrypted files in Dropbox. The encryption is done offline. Assuming the encryption is done properly, it is difficult to conceive of a way to attack it even assuming that Dropbox is compromised.

Actually that's how LastPass works (they move around an AES-256 encrypted database, and decrypt it on the client/browser).

The problem LastPass has, is that they re-use the same master password for two distinct things:

- Authenticating to login to your account.

- Encrypt your password database.

So in situations like this the loss of the authentication hash is relevant. I'd prefer to have a different password for the account than the database, but they don't offer that as far as I know.

In general I am broadly happy with LastPass's security. But it could be a little better for power users.

Re: LastPass Security Notice

#40

Post by sarciszewski »

The LastPass blog won't let me post any comment that mentions KeePassX, so I'm mentioning it here.

Other security folks might recommend other password managers that they prefer (e.g. 'tptacek likes 1Password). Generally, you should listen to them over me.

KeePassX is open source and NOT cloud based, so if those are two points on your mental checklist, it's worth checking out.

Post reply on HN