The situation at LastPass may be worse than they are letting on

Post by goku12 » Sat, Dec 24, 2022, 10:43 AM UTC

technion wrote: post #121

pigsty wrote: post #36

Earlier quoted context omitted.

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

I definitely feel the opposing law works. When I see a project with a massive disclaimer about "this crypto is not audited, I'm a noob never deploy this anywhere" I'm likely to see better crypto than most of the commercial products I work with, including ones with sales people that talk about unbreakable crypto.

Post by akira2501 » Sat, Dec 24, 2022, 10:45 AM UTC

ytygg775 wrote: post #276

heywoodlh wrote: post #206

So is there any way to verify what this person is saying? I mean, from the way LastPass is evolving it doesn't seem unlikely to me -- but why is this tweet on HN? Is there any supporting evidence aside from an anecdote, does this Twitter account have a strong reputation of being credible, etc.? Without context, I just don't understand why this anecdotal thread should be considered credible. Disclaimer: I use FOSS pas…

This. Why would we be critical of LastPass being secretive and/or wrong and then take a tweet at face value? From one of the tweets: > I did not download anything. My machines are clean, and I have physical 2fa on everything. None of the links or contracts I interacted with were malicious. Nobody else had physical access to my PC. Yeah sure. Sounds like my aunt when she messed up her PC and loudly claims "but I didn'…

Post by NilsIRL » Sat, Dec 24, 2022, 10:50 AM UTC

tadfisher wrote: post #244

TheDong wrote: post #230

Earlier quoted context omitted.

This is less secure than using keepassxc, 1password, or another application with a 1st party well maintained browser extension. With keepassxc, 1password, or even chrome's password manager, if a phisher links you to "gmail.scammersite.info", even if it looks exactly like the real gmail login page, browser-integration will not fill in the password field. With pass, the default flow is to copy the password to your clip…

There is a really good browser extension for pass, called BrowserPass. It has auto fill with phishing protection. There is also a good Android app, called Android Password Store, which does the same for all of my apps. Both use GPG keys stored on my Yubikey.

Post by themitigating » Sat, Dec 24, 2022, 10:52 AM UTC

darawk wrote: post #257

heywoodlh wrote: post #206

So is there any way to verify what this person is saying? I mean, from the way LastPass is evolving it doesn't seem unlikely to me -- but why is this tweet on HN? Is there any supporting evidence aside from an anecdote, does this Twitter account have a strong reputation of being credible, etc.? Without context, I just don't understand why this anecdotal thread should be considered credible. Disclaimer: I use FOSS pas…

It seems like a reasonably well written anecdote by someone who has some idea what they're talking about. It could obviously be false, but the consequences if he's right are potentially serious for a lot of HN users who might use LastPass. The consequences if he's wrong are a little extra reputational damage for LastPass, but that seems like a worthwhile tradeoff here. Not everything posted on HN has to be verified t…

Post by eternityforest » Sat, Dec 24, 2022, 11:06 AM UTC

msravi wrote: post #292

eternityforest wrote: post #200

Earlier quoted context omitted.

That is way too much work. Doing work means stuff is happening and stuff means sidechannel attacks that someone else hasn't audited, because it's not an integrated product anyone would bother auditing. In particular, I don't see how 2FA is possible with this, so shoulder surfing is a bigger issue. I definitely trust Google or BitWarden more than a password I can memorize plus my own constant vigilance.

> In particular, I don't see how 2FA is possible with this Umm, why not? First, you can use a different app (like aegis) to generate OTPs. Second, pass has an extension ( https://github.com/tadfisher/pass-otp ) that can be used to generate OTPs. Third, you can use something like oathtool to generate your otp using your totp secret oathtool -b --totp "your-totp-secret"