Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

311–320 of 326 posts

Re: LastPass users warned their master passwords are compromised

#311

Post by tialaramex »

gruez wrote: post #308
tialaramex wrote: post #292

Earlier quoted context omitted.

To complete enrollment you need to know the corresponding private key, live. The relying party says "I am some.example and I want to enroll a Security Key, but, not ones which recognise these huge random-looking IDs that are already enrolled: 12345678, 34561234. I also picked this random nonsense XYZXYZXYZ. Go for it" and your browser talks to your Security Keys until it finds one that isn't already enrolled, gets th…

>you need to know the corresponding private key, live. This seems like the main blocker. Why is that required? In theory all the site needs is a public key to verify against.

If you have questions about why the WebAuthn protocol works the way it does, it seems like you'd want to first read the protocol in detail and then if you still have questions ask its maintainers.

Re: LastPass users warned their master passwords are compromised

#312

Post by bugstomper »

LastPass posted on their blog on Dec 28 that they identified a problem causing those emails to be incorrectly triggered:

https://blog.lastpass.com/2021/12/unusual-attempted-login-ac...

"However, out of an abundance of caution, we continued to investigate in an effort to determine what was causing the automated security alert emails to be triggered from our systems. Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved."

Re: LastPass users warned their master passwords are compromised

#313

Post by eksployted »

johtso wrote: post #238
gregsadetsky wrote: post #204

Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen. The most egregious and hard-to-understand related cases (now 3!): https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday [Dec 27] and then someone just tried it again a few hours ago after I ch…

It still seems that the most likely answer might be that lastpass are incorrectly alerting that someone's correct passphrase had been used, and that the email is being triggered by a bug, or something like a login attempt using the wrong password from a suspicious IP. The fact that lastpass support says that it means that the correct password was used doesn't mean it's true, the support staff might just be mistaken.

That's what I was hoping, but I tested it.

Used a VPN endpoint in a country that would surely get blocked. Attempted to login with wrong password, did not receive email. Logged in with correct passphrase, received email. Both scenarios looked the same on the login screen, so there wasn't any indication that I logged in with the correct password if I were the attacker

edit: last night they released something that says they sent some of those emails in error. I hope that is the case, but it's still not very re-assuring. I went through and changed all of my financial/critical accounts yesterday in precaution, today my bank account was locked out from brute force. Could be a coincidence, but that is the first time it's ever happened with that account

Re: LastPass users warned their master passwords are compromised

#315

Post by OOPMan »

bennysomething wrote: post #291
phs318u wrote: post #187

Earlier quoted context omitted.

I recommend this every time a similar news item gets posted. Password Safe (designed by Bruce Schneier). I use the iOS and Linux apps and keep them synced via DropBox. Been around for years (I've been using it almost as long). Still getting updates. Still works. https://pwsafe.org

I've been doing this for years too. I recently bought two yubi keys and now don't rely on a master password for it. However now I'm scared I could lose my yubi keys. Not sure what I can do about that.

Buy more keys, configure them as dupes and store somewhere secure but accessible given a day or so?

Re: LastPass users warned their master passwords are compromised

#316

Post by Schiendelman »

gregsadetsky wrote: post #204

Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen. The most egregious and hard-to-understand related cases (now 3!): https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday [Dec 27] and then someone just tried it again a few hours ago after I ch…

Given these experiences, especially the same message after changing the password, makes me think that LastPass’ message is wrong - that it claims someone used your password, but the attacker is not actually doing so.

This would explain all the data I’ve seen so far, including LastPass’ reaction.

Speculation: LastPass might use this message even if someone tries an old password? Does that fit the data so far?

Re: LastPass users warned their master passwords are compromised

#317

Post by jjav »

CamelRocketFish wrote: post #290
jjav wrote: post #158

Earlier quoted context omitted.

While this is a good approach at a high level, it's also worth pointing out that the usage should not be based on trust. You should evaluate if you're comfortable using this or that password manager even if they were aquired by the most evil company you can think of. If the design is solid, it shouldn't matter since the evil company shouldn't be able to compromise anything. If it does matter, then you shouldn't be us…

The problem is we don’t have access to the design as it’s closed source?

That is certainly a factor to consider in the decision!

I, for one, wouldn't use any security-critical software where the client isn't open source.

(The server side doesn't matter for security for the same reason trust in the company shouldn't matter. No secrets should leak to the server.)

Re: LastPass users warned their master passwords are compromised

#318

Post by postalrat »

tatersolid wrote: post #277
postalrat wrote: post #255

Earlier quoted context omitted.

Some encrypted data is worthless. Some isn't. Depends on what value it has when down the road the encryption is broken.

If AES being broken is in your personal threat model, you have far more to worry about than passwords.

What if its broken in 10 years? Or in 50 years? Eventually it will be.

Re: LastPass users warned their master passwords are compromised

#319

Post by gregsadetsky »

Schiendelman wrote: post #316
gregsadetsky wrote: post #204

Hey, I'm the OP from yesterday's story. A few people and I are trying to chase down which software in common could have resulted in our passwords being stolen. The most egregious and hard-to-understand related cases (now 3!): https://twitter.com/Valcristerra/status/1475734357805572098 "Someone tried my @LastPass master password earlier yesterday [Dec 27] and then someone just tried it again a few hours ago after I ch…

Given these experiences, especially the same message after changing the password, makes me think that LastPass’ message is wrong - that it claims someone used your password, but the attacker is not actually doing so. This would explain all the data I’ve seen so far, including LastPass’ reaction. Speculation: LastPass might use this message even if someone tries an old password? Does that fit the data so far?

That's an interesting new avenue -- that older passwords are/were recognized too.

I just tried my old password and the error message only says to check the password -- there are no emails sent saying that someone attempted to log into my account with my password.

LastPass did change their systems, supposedly correcting for the issue that we all saw. So the test I just did also isn't really indicative of how their systems were working 2 days ago.

There are still remaining questions:

- the use of "some" and "likely" in LastPass' new announcement -- https://www.bleepingcomputer.com/news/security/lastpass-user...

- an explanation on how the false positives happened. What made the system think those attempts were using the correct master passwords?

- an assurance that no correct master passwords were used during the attack -- that they were all false positives (i.e. this attack was strictly credentials stuffing i.e. someone tried a bunch of passwords they obtained from other sources)

- finally, an explanation for the 3 independent cases where people changed their passwords and then received an email again saying someone had attempted to login using their passwords. Those emails may have been false positives as well, but we would have to know.

Re: LastPass users warned their master passwords are compromised

#320

Post by mbordenet »

denton-scratch wrote: post #310
gruez wrote: post #52

Earlier quoted context omitted.

Seems like the lesson there is to use a standalone password manager, rather than one that's a browser extension?

I'm not inclined to run anything that's remotely related to password security in a browser extension (I do use the Firefox built-in password manager to simplify logging in to sites like this one, where I have no money at stake and nothing much to lose but my pride). For high-value logins, I use Passwordsafe. It's annoying; the scroll behaviour is annoying, and it's Windows-only, which is sad. But it's resolutely loca…

Assuming you're talking about pwsafe 3, it's not Windows-only. I am actively using a Java implementation on MacOS and rely on my Android app for frequent use. Password file is synced across devices via a cloud drive provider. Works great, and I'm in control. (I also rotate my password file + master password every few months.)
Post reply on HN