Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

351–360 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#351

Post by ltbarcly3 »

d_burfoot wrote: post #348

I use my own hand-rolled password management system. Everyone told me: "don't roll your own password manager!!" Here's the thing: yes, my tool is probably less secure than a professional tool, by an order of magnitude. But it's also a far less attractive target for hackers. If you spend an hour to crack my tool, you get one guy's data. If you spend 1000 hours to crack LastPass, you get millions of users' data. The co…

Right, security advice is always given as though everyone will follow it and it has to work for really useless dummies that don't understand anything about it.

They also say not to roll your own encryption, but if you encrypt your data and then use ssl it does increase security. When there is some bug meaning your ssh key was easily guessable (happened with dsa keys) having that obfuscation will prevent bulk collection from doing things like keyword matching against your data. Doesn't work if everyone does it, but it does work.

Most of the time you gain the most not from state-level impossible to break security, because most of the time you aren't trying to defeat a room full of geniuses all working full time with you as a target.

Re: The situation at LastPass may be worse than they are letting on

#352

Post by taylodl »

d_burfoot wrote: post #348

I use my own hand-rolled password management system. Everyone told me: "don't roll your own password manager!!" Here's the thing: yes, my tool is probably less secure than a professional tool, by an order of magnitude. But it's also a far less attractive target for hackers. If you spend an hour to crack my tool, you get one guy's data. If you spend 1000 hours to crack LastPass, you get millions of users' data. The co…

Not only that but there are security best practices you can follow when rolling your own that can keep your data reasonably secure. Enough so that the cost::payoff ratio is even worse and you're that much less likely to be hacked.

Re: The situation at LastPass may be worse than they are letting on

#353

Post by uuvs8 »

darawk wrote: post #270
_cenw wrote: post #265

Earlier quoted context omitted.

> someone who has some idea what they're talking about "I suspected someone used a 0day on me" is not exactly inspiring confidence

Why not? I have a security background. I see nothing wrong with that statement. Although what he actually said was: "Initially I imagined I was targeted by a 0day or rootkit" which actually does not make sense, because it implies he thinks those two things are fungible. He's obviously not a security expert, but he's also obviously not totally technically incompetent.

If you have a security background then you know that 0days go for 6-7 figures and it's unlikely somebody would burn one of those on some random dude.

Way to make yourself feel important. It's not that you made some terrible choices yourself, like using a known-insecure password manager SaaS, or putting real money into crypto. Nono, somebody pulled a 0day on me, what can ya do? Shrugs

Re: The situation at LastPass may be worse than they are letting on

#354

Post by endisneigh »

danparsonson wrote: post #195
endisneigh wrote: post #72

Earlier quoted context omitted.

you're right - i have clarified what I actually do. however I do something similar with a different password for sites I deem unsafe, or spammy.

Sure, that's slightly better, but you're putting in quite a lot of effort for minimal reward - there still isn't much entropy here compared to the size of the password, and you're relying on security through obscurity (that no-one will work out your method). Password crackers on modern GPUs can chew through many millions of guesses per second so having such a significant leg up would likely make your strategy trivial…

the main goal for myself is to be able to have complicated passwords and remember them without a computer. the problem with all password managers is ultimately it must be possible to get them in plain text by design, so if someone gets that they get all of your passwords.

Re: The situation at LastPass may be worse than they are letting on

#355

Post by YoshiRulz »

irrational wrote: post #139

Is there a site or something where you can put in all the devices you own (e.g., iPhone, Mac laptop, tablet, chromebook, etc) and what features you want (e.g., adding a password on one device syncs it automatically to all other devices, offline useage, auto fill of browser form fields, auto saves now username/passwords, etc.) and it will tell you what password manager best meets your needs?

AlternativeTo can almost do that with OS + use-case tags https://alternativeto.net/software/lastpass/

Re: The situation at LastPass may be worse than they are letting on

#356

Post by pmontra »

d_burfoot wrote: post #348

I use my own hand-rolled password management system. Everyone told me: "don't roll your own password manager!!" Here's the thing: yes, my tool is probably less secure than a professional tool, by an order of magnitude. But it's also a far less attractive target for hackers. If you spend an hour to crack my tool, you get one guy's data. If you spend 1000 hours to crack LastPass, you get millions of users' data. The co…

You can use one of the several password managers of the keepass family. They are local, you can share the encrypted password database with your other devices and maybe it has more features that one's own password manager. But by going DIY you probably learned more about passwords management than the average person.

Re: The situation at LastPass may be worse than they are letting on

#357

Post by cma »

ltbarcly3 wrote: post #351
d_burfoot wrote: post #348

I use my own hand-rolled password management system. Everyone told me: "don't roll your own password manager!!" Here's the thing: yes, my tool is probably less secure than a professional tool, by an order of magnitude. But it's also a far less attractive target for hackers. If you spend an hour to crack my tool, you get one guy's data. If you spend 1000 hours to crack LastPass, you get millions of users' data. The co…

Right, security advice is always given as though everyone will follow it and it has to work for really useless dummies that don't understand anything about it. They also say not to roll your own encryption, but if you encrypt your data and then use ssl it does increase security. When there is some bug meaning your ssh key was easily guessable (happened with dsa keys) having that obfuscation will prevent bulk collecti…

On the other hand you see things like people xor'ing with the same random number stream twice, causing things to be encrypted to plaintext.

Re: The situation at LastPass may be worse than they are letting on

#358

Post by running101 »

d_burfoot wrote: post #348

I use my own hand-rolled password management system. Everyone told me: "don't roll your own password manager!!" Here's the thing: yes, my tool is probably less secure than a professional tool, by an order of magnitude. But it's also a far less attractive target for hackers. If you spend an hour to crack my tool, you get one guy's data. If you spend 1000 hours to crack LastPass, you get millions of users' data. The co…

I use keypassxc xc with the browser plug-in. Also have a very long master password on my yubikey which I long press to enter the master password. The I use one of the cloud drives to sync it. I never liked the idea of entering my passwords into a service like lastpass.

Re: The situation at LastPass may be worse than they are letting on

#359

Post by rwmj »

Being completely ignorant about how this works, why would a LastPass compromise result in passwords being exposed? Surely they themselves don't store unencrypted passwords, but instead the passwords are encrypted by the user's key? Or is this a compromise of the locally installed software?
Post reply on HN