Live data from Hacker News

I Lost All Faith in LastPass

infosec.exchange

301–310 of 322 posts

Re: I Lost All Faith in LastPass

#301
post #300
post #283

Earlier quoted context omitted.

> But I don't think it follows that we need to accept every axiom someone proposes, such as what counts as a good enough authority. Nobody's saying we do, and I think there's a good middle ground we all actually inhabit where the director of the CDC, for example, is an authority on diseases when speaking in an official capacity, but we don't give a damn what they think about the latest movies. This isn't a difficult…

I agree about the problem —- I might quibble with the psychology, but close enough. But that’s exactly why the distinction I’m trying to draw is so important. If we keep in mind the difference between what we can rigorously establish and what we’re fundamentally taking on faith (however well-founded), then at least we can talk to people on the other side: clarify core disagreements, examine evidence, and occasionally…

Here is where I think we part ways, philosophically speaking:

> If we keep in mind the difference between what we can rigorously establish and what we’re fundamentally taking on faith (however well-founded)

From my perspective, we're taking everything in the real world "on faith" (and there is a loaded phrase ripe to be deliberately misinterpreted) to a certain extent, and not just because of brain-in-a-vat arguments. For example, I sit in chairs thinking they're solid objects, but they're made of solid objects and might well collapse under me. In my experience, that doesn't happen to me, so my heuristic is that chairs are safe, but a heuristic isn't rigorous. It's "faith" if you want to phrase things that way.

Moving deeper, I trust that my senses provide me with accurate-enough reflections of reality I can use them to navigate my world safely, but I know enough about neurology to know that that isn't a given. Vision is reconstructed by the visual cortex from messy and incomplete nerve signals from the retinas, our sense of 3D space is reconstructed (based on low-level heuristics) from a pair of 2D images reconstructed from those messy retinal signals, and so on, from the bottom of the neurological hierarchy to the top of the conscious sense of self. The human machine lives off of best-guess reconstructions from incomplete and messy data.

This isn't mere acatalepsy, however: I think humans live in a physical world we're capable of perceiving accurately enough, and comprehending well enough, that we can accurately say we live in a real and comprehensible external Universe, and that some things don't go away even if you don't believe in them. Therefore, it's possible for our heuristic judgements to become more accurate at predicting reality over time, which is what separates knowledge from dogma.

Accepting that an authority is probably more likely to be right than wrong is a heuristic, and that heuristic can and should be improved, but all of our knowledge of reality is heuristic, so trying to treat reality like an axiom system is philosophically wrong-headed and incapable of dealing with the full complexity of reality as well.

Re: I Lost All Faith in LastPass

#302
post #260
post #259

Earlier quoted context omitted.

> I mean, crypographically we’ve had solutions to those exact problems for 30 years. My point exactly - 1password.com addresses those problems (e.g. by adding a random key to the master password, and via Secure Remote Password auth), while using just a master password (sans random key) in a dumbly file-hosted vault does not.

When you talk about “master key”, are you aware about multi-key cryptography? me and my friend can have private keys to a ”vault” (or, file) that are solely our keys, even if they decrypt the same secret. No need for a “master password” to unseal the vault. Here is the gpg docs for it: https://www.gnupg.org/gph/en/manual.html#AEN111 section 5.1 of RFC 2440 explains how it works: https://www.ietf.org/rfc/rfc2440.txt

If I got you right, then 1P does use this mechanism, and LP most likely too. The problem is - how do you store the private keys in a way that their loss is not catastrophic? Services like 1P and LP answer that question, with varying levels of sophistication.

With 1P, it works roughly like this:

- Every vault item is encrypted with the vault’s key (randomly generated number w/ 256 bit, AES)

- For every user that has access to the vault, the user‘s public key is used to encrypt the vault key. I think this is what you meant by multi-key? Adding a team member to a vault means encrypting the vault key with the member‘s public key.

- The user‘s private key in turn is encrypted with the „Account unlock key“, which is made up of: Master password + random secret [1] + salt. Neither of those is ever sent to the servers in plaintext, made possible by zero knowledge proofs.

If you stored your ciphertext on a dumb file hoster: Sure you can increase entropy in the master password to match 1P‘s random secret. Or just store your private key directly, as I think you suggested. But this is not memorable, so where do you back this key up in case your hard drive fails? Aren’t we entering recursion at this point, requiring yet another round of encryption? There’s no end to this. At some point you need to have either a password you can commit to memory, or one that’s stored in sthg like a secure enclave.

You could also print out the private key, like 1P is suggesting for its secret key. But exposure of the piece of paper is a total breach if it’s your private key, but not with 1P‘s secret key.

1: Random secret is stored on your device, and they ask you to print it out upon signup. It’s never shared in plaintext with the 1P server, same as the master password.

Re: I Lost All Faith in LastPass

#303
post #70

Earlier quoted context omitted.

iCloud Keychain syncing, strong password suggestions in Safari, and WebAuthn passkeys are all part of Apple's strategy. When they don't buy a third party and deeply integrate it, they tend to operate by insinuating themselves as the platform default. What would you have them add to that?

Their "password manager" on Mac is called Keychain Access. The UX is very bad, the interface is old and clunky and it doesn't sync with iOS (if for example you create a secure note there's no way to access it on iOS) - not to mention that most people don't even know it exists, it's kind of a hidden feature. Meanwhile, on iOS the password manager is hidden in the settings and again it has pretty bad UI/UX. I understan…

I agree that Keychain Access kinda sucks, but it's because Apple UI paradigm for it is different. For them, the Password Manager isn't a separate entity that's a source for copy-pasting passwords into arbitrary apps, instead it's a core Framework of the OS that apps integrate with. As such, it doesn't really have "its own UI" because each app provides the UI.

Of course, that does mean that it's less universally convenient like the other commercial apps.

As usual with Apple stuff, I guess they're not interested in making it a better separate app because their value proposition is "use our frameworks and get this feature 'for free' "

Re: I Lost All Faith in LastPass

#304
post #245

Earlier quoted context omitted.

Closed source requires a lot of trust in this case.

While source code access is certainly a concern for some, it is worth pointing out that Enpass supports database sync methods such as Dropbox, Google Drive, and a proprietary "wifi" sync. This means that you can have sync like Lastpass or 1Password but retain complete control over your own data. I can't speak to Enpass's security, but I have been a user for several years. It feels less polished than 1Password but is…

That is what I am using. I guess the Enpass attack would require either an attack on the client on my phone / pc or on the storage provider (if they are able to crack my passphrase). I had assumed lastpass and 1pssword were using the same approach

Re: I Lost All Faith in LastPass

#305

Earlier quoted context omitted.

Does bitwarden work well with autofill? Lastpass was awful with that and very finicky.

For the sites I normally visit, it works well. GitHub and some famous banks/credit card providers. Mfa code doesn't autofill, but it's just a click to copy.

Pretty sure you can set it to auto-copy the TOTP, so you technically don’t need to click anything

Re: I Lost All Faith in LastPass

#306

Earlier quoted context omitted.

Not sure about 1Password, but I am using Bitwarden free and there's no authenticator app. I just use Authy on Android, though, it works great

Does bitwarden work well with autofill? Lastpass was awful with that and very finicky.

They haven’t had the feature for a huge amount of time but it works alright, with some minor mistakes here and there. As with most managers, it struggles when there are more than two fields to populate

Re: I Lost All Faith in LastPass

#307

Thoughts on Bitwarden vs 1Password? I have seen them both suggested by users on this site.

Not sure about 1Password, but I am using Bitwarden free and there's no authenticator app. I just use Authy on Android, though, it works great

> there's no authenticator app

> I just use Authy

isn't Authy an authenticator app?

Re: I Lost All Faith in LastPass

#308
post #134

Earlier quoted context omitted.

Making it opensource is no guarantee at all(if there could be any), for instance it could be more dangerous: anyone could spot a security hole and take advantage of it without reporting it, there is no guarantee there would be a responsible disclosure.

Are you vouching for security through obscurity?

When systems and code are audited and pentested by third parties, I don't see any benefit of actually making anything public.

Re: I Lost All Faith in LastPass

#309

Earlier quoted context omitted.

> If you are worried, you can store the password in a byte array and zero that out. if it's a copying collector this is no guarantee of anything but the same is true of general memory allocated with the OS (swap/THP/...), unless you use something like mlock()

Fair point, but really one of those situations where if an attacker is in the position to look at a password stored in a tombstone, you've got bigger problems (for example, would be trivial in that scenario to simply intercept the password rather than looking for it in VM memory).

Could it still add some defense in depth for other scenarios?

Re: I Lost All Faith in LastPass

#310
post #53

Earlier quoted context omitted.

I wish more people would remember this.

But its incorrect, its literally the logical fallacy, argument from authority, if the person us not an authority then it cannot by definition be argument by authority. Experts must prove their views with evidence and not rely upon their reputation, that is the meaning of the fallacy. No wonder so many people cant reason well.

An argument from authority is not a fallacy in and of itself.

An appeal to false authority is always a fallacy, such as considering an authority's opinion on a topic on which they're not authoritative.

If the participants in a debate agree that an authority is legitimate, then an unchallenged appeal to their authority is not fallacious.

If an authority's opinion is contradicted by undisputed evidence, then an appeal to their authority is fallacious.

The whole point of the distinction is to admit authority as a valid source of information, in the absence of direct evidence, because we can't possibly reason from direct evidence in every single case.

Post reply on HN