Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

341–350 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#341

Post by xurukefi »

heywoodlh wrote: post #206

So is there any way to verify what this person is saying? I mean, from the way LastPass is evolving it doesn't seem unlikely to me -- but why is this tweet on HN? Is there any supporting evidence aside from an anecdote, does this Twitter account have a strong reputation of being credible, etc.? Without context, I just don't understand why this anecdotal thread should be considered credible. Disclaimer: I use FOSS pas…

I would wait until more stories like this pop up before jumping to conclusions.

Re: The situation at LastPass may be worse than they are letting on

#342

Post by WesolyKubeczek »

_0w8t wrote: post #245
accrual wrote: post #201

Earlier quoted context omitted.

Ideally it would be an opaque blob with no information about the number of records or their size, just the total size and maybe a last modified or accessed time.

Password managers typically offer to store images like document scans. Without per record encryption one needs to send the whole encrypted blob on each modification.

Not necessarily. You can have a write-ahead log which also consists of opaque blobs and which other devices can pull and reconcile on their own. At some point, a whole reconciled version is uploaded.

Re: The situation at LastPass may be worse than they are letting on

#343

Post by WesolyKubeczek »

semi-extrinsic wrote: post #272
heavyset_go wrote: post #222

Earlier quoted context omitted.

And Bitwarden can be self-hosted for those that are weary about using SaaS password managers.

Nitpick: "weary" == "tired", "wary" == cautious

I can read the sentence with both versions and it still makes sense…

Re: The situation at LastPass may be worse than they are letting on

#344

Post by paulnpace »

croes wrote: post #338
paulnpace wrote: post #335

What if this tweet was provided as "evidence" of the opposite claim: > I think the situation at @LastPass may be better than they are letting on. > > On Sunday the 18th, four of my wallets were completely safe. There were no losses. > > Their seeds were kept, encrypted, in my lastpass vault, behind a 16 character password using all character types. IOW, the honesty and integrity of the user does not matter. What matt…

Because that's not how evidence work. There are fewer ways to get the data than reasons why the data has not (yet) been used. You can't prove there was no breach.

Being unable to prove there was not a breach is correct because you are unable to prove there was a breach, meaning there is no useful evidence in the post.

As I demonstrated in what might be called talking past the sale, there are other attacks that have nothing to do with the security of the technologies used.

I don't know the person who originally stated this, but as the popular refrain goes: "security is a process, not a technology."

Re: The situation at LastPass may be worse than they are letting on

#345

Post by nicce »

pedrovhb wrote: post #152
ddejohn wrote: post #5

For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…

Doesn't necessarily mean it's safe. Say there's passwords accidentally appearing in logs as part of a traceback - even if the passwords are kept encrypted, just having access to the logs is enough. Even if everything is encrypted client-side, it could appear as part of a client crash dump being sent by telemetry. Leaked plaintext databases aren't the only possibility.

Bitwarden caches Web urls as well on its browser extensions. Sometimes it knows that you have saved login for the specific web page before you have logged in. Certainly LastPass had urls unencrypted for this specific reason - to show users that you have saved login for this page, would you like to login? It is the endless usablity vs. security battle. Of course, there are better ways to implement this than LastPass has done.

Re: The situation at LastPass may be worse than they are letting on

#346

Post by user3939382 »

gsk22 wrote: post #238
organsnyder wrote: post #166

Earlier quoted context omitted.

Given the extent of the breach, it's prudent at this point to assume all passwords have been compromised.

Why is that so? Aren't the passwords encrypted?

Yes however https://en.wikipedia.org/wiki/Rainbow_table

Re: The situation at LastPass may be worse than they are letting on

#347

Post by raverbashing »

wepple wrote: post #190
technion wrote: post #121

Earlier quoted context omitted.

I definitely feel the opposing law works. When I see a project with a massive disclaimer about "this crypto is not audited, I'm a noob never deploy this anywhere" I'm likely to see better crypto than most of the commercial products I work with, including ones with sales people that talk about unbreakable crypto.

And likewise “military grade encryption” usually means “win2k Visual Basic backend”

There's a bit of actual truth in this

FIPS certified systems can actually be less secure (by design) than non-certified ones

Re: The situation at LastPass may be worse than they are letting on

#348

Post by d_burfoot »

I use my own hand-rolled password management system. Everyone told me: "don't roll your own password manager!!"

Here's the thing: yes, my tool is probably less secure than a professional tool, by an order of magnitude. But it's also a far less attractive target for hackers. If you spend an hour to crack my tool, you get one guy's data. If you spend 1000 hours to crack LastPass, you get millions of users' data. The cost::payoff ratio for hacking LastPass is far better.

Re: The situation at LastPass may be worse than they are letting on

#349

Post by themitigating »

rvnx wrote: post #327
themitigating wrote: post #314

Earlier quoted context omitted.

That exactly what flat earthers claim. 1. You don't know if this person has nothing to lose 2. Even if they have nothing to lose that doesn't mean they are being honest.

They are just being secretive about their business the same way you ask them to be secretive about your passwords.

Yes, so?

Re: The situation at LastPass may be worse than they are letting on

#350

Post by onphonenow »

jcpham2 wrote: post #288
onphonenow wrote: post #163

Earlier quoted context omitted.

I do passwordsafe on google drive. I feel google does a good job w security / main risk a computer I’m using getting compromised

Except or unless your google account gets locked. Any number of reasons and posts HN horror stories exist about other users getting locked out of their lives because of a user account or lack of access thereof

That’s a risk. I pay for my account to try and mitigate this risk so I’m the actual customer, not advertisers.

Google workspaces has a support assisted recovery option. I host dns separately from google as their admin level recovery may require some dns signaling.

Other steps include a yubikey etc . I’ve actually had the experience of losing all my Authenticator codes on an iPhone upgrade which at the time was how I did 2fa - so had to go through recovery for many providers. My top takeaway - if I was paying for service it was possible if sometimes a bit time consuming. If I wasn’t it was hit or miss.

Other tip? Google Authenticator may not backup to iCloud!! I had 20 codes in it including some really hard to fix ones.

Post reply on HN