Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

301–310 of 311 posts

Re: LastPass Security Notice

#301

Post by PuffinBlue »

hawkes wrote: post #293
PuffinBlue wrote: post #282

Earlier quoted context omitted.

I use LastPass and KeePass extensively in the setup you outline. Why do people use LastPass? Convenience, and you aren't really gaining any extra security (except through obscurity) when using those other services. LastPass encrypts and decrypts client side, their cloud only synchronises the encrypted blob. This is what is happening in the KeePass + Cloud service scenario too. You gain a little security through obscu…

My problem with LastPass is that the Android app is not for free (ok to me) but I find the price too high (I haven't compared with others and Spain economy is right now pure shit, just my situation). That's the only reason I'm gradually moving to localy stored Keeper.

The Android app is actually free.

The use of LastPass on mobile is part of the Premium suite which is $12 a year. I'm just a normal user (though I seem to be commenting a lot on this particular story I know!) and I think it's a fair offering.

Re: LastPass Security Notice

#302

Post by rkeene2 »

JadeNB wrote: post #57
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

> (Though if you've found a good option, that will allow me to easily sync across my home desktop, laptop, office pc, tablet, and smartphone, without using the cloud, I would absolutely love to hear about it! Maybe something Bluetooth based?) I don't know if it meets but your needs, but I love PasswordMaker ( http://passwordmaker.org ). There is no need for sync'ing, because the password is generated from a master pa…

I wrote WebPass ( http://webpass.rkeene.org/ ) for a similar reason. It's extensible with domains having password requirements and does syncing (of parameters for passwords, never actual passwords -- since they are generated). The UI is bare, but it's open source (and aside from the syncing, done entirely client side).

The sync'ing is done with a FIFO, two clients connect with the same key and they each get what the other one POST'd, no data is logged on my side.

Re: LastPass Security Notice

#303

Post by andreyf »

ernsheong wrote: post #202
klue07 wrote: post #160

Earlier quoted context omitted.

1Password can sync your passwords through WiFi [1] without going through some cloud service like Dropbox. This is the main reason I use 1Password, and it so far has met my needs. Caveat is apparently it can only sync with a single computer. [1] https://support.1password.com/guides/mac/sync-wi-fi.html

Unfortunately I can't use 1Password at work because it doesn't have a browser client, and I can't install anything I like on my computer (corporate). Sticking to Dashlane for now.

So get your IT guys to install it for you? Seems like a reasonable request...

Re: LastPass Security Notice

#304

Post by jasonsync »

hawkes wrote: post #292

I've learnt a lot reading this thread. Thank you all. But I can't believe almost everyone here, talking about security, is talking about Dropbox even as a hypothetical cloud option for storing password related info. - Dropbox (and most of the other cloud storage services) do not encrypt your data, or if they do now as they claim, with SHA256, I'd say they must be able to decrypt it whenever they want to, as they give…

sync.com

Re: LastPass Security Notice

#305

Post by jjarmoc »

developer1 wrote: post #266
jjarmoc wrote: post #34

Earlier quoted context omitted.

I would also appreciate more detail, but that shouldn't be their first priority. They note that they discovered the breach on 'Friday' so I imagine they have an ongoing Incident Response right now. They may not have or be ready to share this information at this time, and that's fine. They might be working with law enforcement, further hardening systems, and continuing to confirm their findings to date to ensure they'…

Another pain point is the delay from Friday's discovery to Monday's disclosure. While it's better than the sometimes weeks other companies have taken, it screams of the discovery happening at 4pm on a Friday, and everybody then saying "bah fuck it, go home for the weekend, we'll work on it Monday". A security compromise like this should have been made known by Saturday at the latest, and worked on over the weekend. 3…

I feel like that's a reasonable timeframe from 'hmm, something is odd' to 'we're pretty sure we fully understand the impact, time to notify users.'

There's a balance between early notification and misstating the impact.

Re: LastPass Security Notice

#306

Post by rickyc091 »

mynameisvlad wrote: post #298
dzhiurgis wrote: post #235

Earlier quoted context omitted.

Yeah that would be nice. I actually think browsers should have this as a feature. But the problem is that not all websites accept long passwords. My bank wouldn't take longer than 8 characters and doesn't even have a second factor auth. Office 365 wouldn't accept more than 16 characters. I think it was Paypal who wouldn't take more than 10.

Be happy, one of my banks has a 6-digit numeric PIN (I shit you not) as their "security".

Banks also lock the accounts after 3 failed attempts though. The short passwords are to avoid having to deal with phone calls that go something like, "Hello, I forgot my password."

Re: LastPass Security Notice

#307

Post by ntlve »

pdabbadabba wrote: post #22
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

I use a password manager along with Syncthing[0] which seems to be the compromise you are looking for. This setup works well as long as your devices are decently often on a wifi that allows local device discovery (since syncthing needs either that or static IPs) and it also keeps your password vault offline (i.e no cloud involved).

0: https://syncthing.net/

Re: LastPass Security Notice

#308

Post by dzhiurgis »

rickyc091 wrote: post #306
mynameisvlad wrote: post #298

Earlier quoted context omitted.

Be happy, one of my banks has a 6-digit numeric PIN (I shit you not) as their "security".

Banks also lock the accounts after 3 failed attempts though. The short passwords are to avoid having to deal with phone calls that go something like, "Hello, I forgot my password."

Overlooking 6 characters vs 20 over a shoulder is must easier though.

Re: LastPass Security Notice

#309

Post by socceroos »

PuffinBlue wrote: post #281
socceroos wrote: post #269

Earlier quoted context omitted.

Encryption is as good as it's independent proofs. Even then, the proofs are only as good as the attention it gets from qualified, quality cryptographers. And again, only when used in a library that can independently prove it's algorithm and implementation is sound - open source. For everything important, there is OTP.

You're stating truisms really. And you trust OTP (quite rightly) - ergo you trust encryption. My personal trust point is properly implemented AES-256 with a slow hashing function.

Correct. I wanted to qualify that you can't just 'trust encryption'. You must know what you're trusting, top to bottom; otherwise I would say that the trust is misplaced.

Re: LastPass Security Notice

#310

Post by pckspcks »

_pcdx wrote: post #288
pckspcks wrote: post #283

Earlier quoted context omitted.

I like Bruce. I trust Bruce. However, as far as I can tell, this is a black box. There is no documentation on formats, protocols, and similar. I have no reason to trust the security of this system. The closest I could come would be to read the source code.

Sorry, should have mentioned a bit about that. The Password Safe format is public, open, and available here [1]. There's also plenty of code/libraries you can use to write your own clients, e.g. Javascript [2], Java [3], Python [4]. For what it's worth the core data encryption is done using the Twofish cipher. Hope that helps. [1]: http://sourceforge.net/p/passwordsafe/git-code/ci/master/tre... [2]: https://github.co…

That both does and doesn't help. There is the format, which looks sensible. There are the protocols around it, key generation, salt generation, overall design, etc. which are not.

What actually scares me about the design is if my machine is compromised, an attacker can grab my Password Safe file (plus keylogs or whatever) and has access to all of my passwords. The design seems not very robust at a designs+protocols level.

(In contrast, right now, if a machine is compromised, it only compromises the passwords I've used from that machine).

Post reply on HN