Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

331–340 of 587 posts

Re: Lastpass Security Incident

#331

Post by ohdannyboy »

matthewwolfe wrote: post #249
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

I'm currently doing interviews for a senior firmware dev position and was stunned by this. Today I talked to a guy who couldn't tell me what an interrupt was in any technical detail. His coding was worse than a first year college students. 5 of the 6 people I've talked to so far bombed the coding portion.

Re: Lastpass Security Incident

#332

Post by Springtime »

cwkoss wrote: post #74

If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts

As a workaround one can log in offline via the browser extension to export one's database (by default at least).

Edit: hadn't considered that addons also autoupdate by default when back online.

Re: Lastpass Security Incident

#333

Post by moron4hire »

My company uses LastPass, but I found it too much of a hassle compared to the browsers own, built-in password management, so I don't use it.

But I do keep it installed, because their poorly developed browser extension hijacks way too much on any page with any elements on it. I need to keep it around to be able to test my own work to make sure LastPass isn't fucking things up for my coworkers.

It's something to do with how they inject their UI into the page. It's particularly bad if you're trying to make a responsive grid layout. I've seen several incidences of the LastPass extension completely obliterating an otherwise very well-behaved page, on both my project and other websites. And because it's happening in extension code, it's not immediately obvious what is going on. All you see is a blank page, or a page with the intended UI all smashed into the bottom rows of the grid layout. It's also a bit of a Heisenbug, as the LassPass code races your own to inject the UI.

Re: Lastpass Security Incident

#334

Post by system2 »

bmitc wrote: post #311
kilolima wrote: post #287

Earlier quoted context omitted.

You can share password stores locally across multiple machines using a USB drive. Or Syncthing.

Why? And why is that more secure?

Because it is not exposed to the internet and not under control of incompetent companies like lastpass.

Re: Lastpass Security Incident

#335

Post by bboygravity »

joe_guy wrote: post #278
nordsieck wrote: post #271

Earlier quoted context omitted.

> But shouldn't a blacksmith be able to make a nail before he makes me a suit of armor? Yes. But I think there's a reasonable upper limit to the amount of time a company can expect someone to spend on a job opportunity. If they're burning an appreciable amount of that time on a trivial coding exercise, that's not great.

It's 60 minutes as a very high estimate. You might spend a life time together.

55 minutes to install the tool-chain and libs and 5 minutes to do the coding?

Re: Lastpass Security Incident

#336

Post by [deleted] »

hedora wrote: post #285
ocdtrekkie wrote: post #18

Earlier quoted context omitted.

Post-It notes are a safer option than password managers. And it's absolutely outrageous to say this: But not every single account you have needs a unique password. Just ones which can actually allow someone to impersonate you meaningfully, cost you money, or gather sensitive data about you. Response to @palata because of rate-limiting: The problem is people tend not to only put unimportant accounts in their password…

Where do you store your TOTP tokens, then? Post It note?

[deleted]

Re: Lastpass Security Incident

#337

Post by AlfeG »

matthewwolfe wrote: post #249
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

And very low ability to do any improvisation. Without specifying every detail of implementation task will not be completed. Even in areas that don't require very specific solutions, and need to just work.

Re: Lastpass Security Incident

#338

Post by theamk »

kamranjon wrote: post #264
matthewwolfe wrote: post #249

Earlier quoted context omitted.

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

I have a different perspective. I feel that specific coding task tells me absolutely nothing about the seniority of the person performing the task and tells me very little about their qualifications.

And it does not have to, that's what the later stages are for.

This task is just a pre-filter, something to weed out surpirsingly high number of people who claim to be able to code but actually can't.

Re: Lastpass Security Incident

#339

Post by meow_mix »

cwkoss wrote: post #74

If you're a lastpass user, might be wise to avoid logging into lastpass until they update with a resolution - if the attackers got into the build server they could craft attacks that would exfiltrate passwords after user decrypts

Wouldn't the devs know if a malicious LoC had been built into the client and distributed to take master passwords from the browser? Idk much about browser extensions, but I think they would have been able to figure out if something malicious went out to last pass clients, no?

Re: Lastpass Security Incident

#340

Post by pakl »

MetaWhirledPeas wrote: post #268

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSD…

The Precursor should tick your boxes, and with an FPGA-based SOC.

https://www.crowdsupply.com/sutajio-kosagi/precursor/updates...

Post reply on HN