Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did my LastPass master password get leaked?

news.ycombinator.com

Post reply on HN
Print view View original

361–370 of 529 posts

Re: Ask HN: How did my LastPass master password get leaked?

#361

Post by ksec »

mulmboy wrote: post #349

Same thing for me. I last changed my master password on Oct 4 2021. password never used elsewhere and stored only in my head, which makes me suspect a bad chrome extension. ``` Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look. Was this you? Account xxx@xxx.com Time Monday, December 27…

So they are using your "newer" password from Oct 2021? Because all the previous incident seems to relate to very old password usage dated back in 2017.

If so then it is big, very big. Could it be log4J?

Edit: 12 hours later still no update or response from LastPass.

Re: Ask HN: How did my LastPass master password get leaked?

#362

Post by captn3m0 »

lxgr wrote: post #250
tlrobinson wrote: post #96

Given we’re likely stuck with passwords for the foreseeable future, I’d like to see two things in a password manager (maybe these exist?) 1. “hardware wallet” level security, with good UX. Maybe a USB/Lightning dongle, but I really wish computers/phones had built-in capability to do hardware wallets. Apple TouchBar got close (I realize it wouldn’t considered be a dedicated hardware wallet). 2. a way to automatically…

> “hardware wallet” level security This is mutually exclusive with passwords: A hardware wallet never reveals its private key and allows you to review and approve private key operations through a well-defined and hardened interface. Passwords are bearer tokens, and there is no such option.

I use pass[0] against a Yubikey with a touch-policy that requires a touch to decrypt. I use passmenu, which types up the password (using xdotool) so clipboard stealing isn't as easy (probably adds a different attack vector though).

Not as good as webauthn etc, but still better than copy-pasting passwords, or a browser extension that keeps passwords decrypted in memory.

Re: Ask HN: How did my LastPass master password get leaked?

#363

Post by md_ »

politelemon wrote: post #351
gkoberger wrote: post #22

Earlier quoted context omitted.

There's a level of irony in complaining about LastPass's security, followed by suggestion people run their passwords through random third-party software that you wrote. Even if your code isn't malicious (which I believe), it opens up so many potential attack vectors. For anyone reading this, please use the official 1Password import functionality, not this: https://support.1password.com/import-lastpass/

There's a level of irony in complaining about malicious code, and still recommending a closed source password manager.

I can't parse this. Is your point that "closed source" is a synonym for "insecure"?

Re: Ask HN: How did my LastPass master password get leaked?

#364

Post by md_ »

Retric wrote: post #239
lillecarl wrote: post #35

Earlier quoted context omitted.

Cryptography means lastpass doesn't need the master password to verify the password.

If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password. It’s a combination of people being very bad at generating, remembering, and entering passwords plus generally being unwilling to wait minutes or even seconds to generate the hash on their local computer.

> If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password.

I mean, technically this is true, but it's also true if you have the ciphertext of the stored-password database, which is sort of LastPass's entire job. ;)

The only thing that might make it harder to brute force the master password with the latter than with a hashed password database is if the key derivation algorithm differs.

But I think your blanket statement is sort of misleading. In principle, if you trust someone with your encrypted password storage database, you should trust them with a hash of your master password; both serve as brute forcing oracles.

Re: Ask HN: How did my LastPass master password get leaked?

#365

Post by EVa5I7bHFq9mnYK »

Retric wrote: post #239
lillecarl wrote: post #35

Earlier quoted context omitted.

Cryptography means lastpass doesn't need the master password to verify the password.

If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password. It’s a combination of people being very bad at generating, remembering, and entering passwords plus generally being unwilling to wait minutes or even seconds to generate the hash on their local computer.

MD5 is long considered a broken, weak hash algorithm. Here is the MD5 hash of a password:

d9afca35a87a2af4168500640fcf2370

Password is 16 characters long, all lower case, no numbers, no special symbols.

Please tell me the password.

Re: Ask HN: How did my LastPass master password get leaked?

#366

Post by smileybarry »

scraft wrote: post #358

I used Keepass + Dropbox (to sync database). This set up was suggested to me when I joined a company that requires complex unique passwords for all sign ups. At the time I didn't think too much about it, but this thread has made me thankful I was guided in this direction. I don't have experience of any other password management software, so I certainly can't compare and contrast. But I will say Keepass + Dropbox has…

Netflix is a problem for every password manager, since they insist on using their own onscreen keyboard. Even if you’re on Android TV, you can’t switch to the remote app to copy & paste a password. Very annoying, but I’m starting to think they’re doing this to make password sharing more of a bother. (Even if it’s just one sign-in being more of a chore)

Re: Ask HN: How did my LastPass master password get leaked?

#367

Post by neop1x »

haberman wrote: post #330
claudiojulio wrote: post #106

Please stop using this service. Use reliable, open source and auditable services. https://www.privacyguides.org/software/passwords/

This page does not provide any information why the recommended solutions (Bitwarden, KeePassXC) are more secure than the products it warns against (1Password, LastPass, Roboform, and iCloud Keychain).

Because Bitwarden and KeePassX are open-source and auditable?

Re: Ask HN: How did my LastPass master password get leaked?

#369

Post by syshum »

nyolfen wrote: post #104
sofixa wrote: post #56

Earlier quoted context omitted.

There's an official self-host open source version as well ( the one you linked is unofficial), but it's rather heavy ( multiple .NET services, MS SQL) and not adapted for small scales.

yes, we don't talk about that one

Is the unofficial one Security Audited?

Re: Ask HN: How did my LastPass master password get leaked?

#370

Post by drakonka »

replete wrote: post #167
dpark wrote: post #155

Earlier quoted context omitted.

> I have no idea why anyone would use a hosted solution like LastPass. Convenience. I use Bitwarden. I get a lot of value from having my passwords synced across multiple PCs and my phone.

1Password allows you to use a local vault, encrypted with a master password, that can be synced across devices in multiple ways, for instance using Dropbox. There's no web logins going, no 'someone elses database' accessed over the web. I have used this solution for a number of years, and would _never_ go for a cloud option like lastpass, for important personal data.

Just a sidenote to clarify that the last version of 1Password to allow local vaults is 1Password 7. They are not supported in any 1Password versions going forward. Although from what I understand the company was gauging interest and open to eventually reintroducing this if enough people wanted it, based on this explanation: https://1password.community/discussion/comment/602340/#Comme...
Post reply on HN