The situation at LastPass may be worse than they are letting on • Hacker News Board

Re: The situation at LastPass may be worse than they are letting on

#381

Post by anonym29 » Sat, Dec 24, 2022, 4:20 PM UTC

tester457 wrote: post #370

anonym29 wrote: post #171

This is ultimately a predictable outcome for any password manager that stores your credentials on someone else's server. Just like they say in crypto "not your keys, not your crypto" - it applies here too. Not your storage, not your passwords. KeePass on an airgapped box, or an encrypted hardware password manager with no network interfaces is best, though frankly, I'd even be more comfortable writing down passwords o…

> KeePass on an airgapped box Sounds inconvenient for password retrieval when not home, how does this work in practice? How about an airgapped phone with GrapheneOS and Keepass?

Sounds like you just solved the inconvenience problem.

Re: The situation at LastPass may be worse than they are letting on

#382

Post by t3pfaff » Sat, Dec 24, 2022, 4:21 PM UTC

layman51 wrote: post #236

I'm very interested in how this breach was pulled off. Could it be some sort of state actor?

It was phishing and or extortion of a developer that for some reason had unilateral access to production databases and keys without any higher approval.

Re: The situation at LastPass may be worse than they are letting on

#383

Post by smt88 » Sat, Dec 24, 2022, 4:35 PM UTC

eternityforest wrote: post #204

smt88 wrote: post #79

Earlier quoted context omitted.

I used to use KeePass and synced the database (but not the keys or password) with Dropbox. Very secure and mostly convenient.

Doesn't KeePass use a single database file with no conflict resolution? I looked at using them but ultimately decided against them, a conflict overwriting a password scares me more than even just using chrome sync and calling it a day.

I use 1Password now, but KeePass has conflict resolution and also a full history of all secrets.

Re: The situation at LastPass may be worse than they are letting on

#384

Post by dzikimarian » Sat, Dec 24, 2022, 4:45 PM UTC

lolinder wrote: post #367

dzikimarian wrote: post #334

Earlier quoted context omitted.

Their software does see your master password. It may process it locally, it may not. If it's run in web client inside browser, that may change at any second. This may happen due to attack, their mistake, their dependency vulnerability or plain lie on their part. Fundamentally you need to trust them. In case of keepass and independent sync(doesn't have to be Dropbox), software that sees master password doesn't need ac…

> Their software does see your master password. It may process it locally, it may not. If it's run in web client inside browser, that may change at any second. This may happen due to attack, their mistake, their dependency vulnerability or plain lie on their part. Fundamentally you need to trust them. All of this applies to KeePass, minus the browser extension bit (which is trivial to avoid by not using the browser e…

Still - cloud password managers are built to upload your data to the network and it's much easier to smuggle something, when keepass apart from maybe update check doesn't have any network activity. Someone would spot it pretty fast and that would be instant death for the project. On cloud solutions it may take years to be found, as demonstrated here: https://arstechnica.com/information-technology/2022/06/mega-...

That being said - bitwarden is pretty transparent in what they do, compared to the competition and I'm seriously considering giving it a try (but with self hosted backend).

Re: The situation at LastPass may be worse than they are letting on

#385

Post by shkkmo » Sat, Dec 24, 2022, 4:54 PM UTC

tinco wrote: post #374

shkkmo wrote: post #372

Earlier quoted context omitted.

> What would you have the people who are using LastPass do, stop using it? Yes. After their last major breach I exported all my data and deleted all my credentials and account with LastPass. Seeing the details of this breach, I'm super happy I did.

I eh.. was not up to date, I blame our office Christmas party. I guess I'm moving our organization over next year..

I meant the major breach before this one, I believe that was the one that gave attackers access to their dev environment, which they used to steal the developer credentials they used to make this attack.

Re: The situation at LastPass may be worse than they are letting on

#386

Post by xwowsersx » Sat, Dec 24, 2022, 4:54 PM UTC

snowwrestler wrote: post #216

xwowsersx wrote: post #54

I've been using LastPass for years. Looks like I'm going to have to export everything from my LP vault and import it into Bitwarden. Any downsides to Bitwarden that anyone knows of? I'm asking more about convenience, i.e. how well the browser extensions and Android app work and less about security.

If you want to improve your security, don't export from LastPass. Instead, authenticate into each service with the creds in LastPass, change your password in the service, then save the new password into Bitwarden. In general, one should avoid exporting/importing credentials. Instead reset them and save the new creds into the new place.

I'll do that, thanks!

Re: The situation at LastPass may be worse than they are letting on

#387

Post by TedDoesntTalk » Sat, Dec 24, 2022, 5:03 PM UTC

endisneigh wrote: post #354

danparsonson wrote: post #195

Earlier quoted context omitted.

Sure, that's slightly better, but you're putting in quite a lot of effort for minimal reward - there still isn't much entropy here compared to the size of the password, and you're relying on security through obscurity (that no-one will work out your method). Password crackers on modern GPUs can chew through many millions of guesses per second so having such a significant leg up would likely make your strategy trivial…

the main goal for myself is to be able to have complicated passwords and remember them without a computer. the problem with all password managers is ultimately it must be possible to get them in plain text by design, so if someone gets that they get all of your passwords.

I’m confused how you worked 2022 into the password. Trying to deduce your algorithm.

Re: The situation at LastPass may be worse than they are letting on

#388

Post by TedDoesntTalk » Sat, Dec 24, 2022, 5:06 PM UTC

int_19h wrote: post #192

endisneigh wrote: post #30

Earlier quoted context omitted.

e.g. password to facebook would be: facebook.com$293MyPasswordYouKnowIt!!123 password to gmail would be mail.google.com$113MyPasswordYouKnowIt!!123 only annoying thing is that the passwords are long. I guess it's secure, though. edit: see child post for clarification. I do something above for spammy sites, but for something like gmail I probably wouldn't do that.

This scheme as described is not secure, but with one more step it can be. Luckily, that step has already been automated: https://www.lesspass.com/

Prior art: http://PasswordMaker.org also with apps, browser extensions, command line tools, and many forks.

Re: The situation at LastPass may be worse than they are letting on

#389

Post by pqs » Sat, Dec 24, 2022, 5:09 PM UTC

shkkmo wrote: post #372

tinco wrote: post #283

Earlier quoted context omitted.

It's like a novice programmer blaming the compiler for a bug in their application. It's very unlikely to be true. What would you have the people who are using LastPass do, stop using it? Because some crypto dude stored their highly valuable keys in a system that literally copies their keys to any system they log into, to systems that are notorious for having very leaky abstractions and vast vulnerability surfaces?

> What would you have the people who are using LastPass do, stop using it? Yes. After their last major breach I exported all my data and deleted all my credentials and account with LastPass. Seeing the details of this breach, I'm super happy I did.

But you don't know if they deleted all the backups. You'll never be sure you are safe.

Re: The situation at LastPass may be worse than they are letting on

#390

Post by justsomeadvice0 » Sat, Dec 24, 2022, 5:41 PM UTC

dmix wrote: post #373

darawk wrote: post #270

Earlier quoted context omitted.

Why not? I have a security background. I see nothing wrong with that statement. Although what he actually said was: "Initially I imagined I was targeted by a 0day or rootkit" which actually does not make sense, because it implies he thinks those two things are fungible. He's obviously not a security expert, but he's also obviously not totally technically incompetent.

To explain your comment a bit: It should be 0 day AND a rootkit, not OR. Plus the rootkit is not always needed or possible. Also the people talking about “burning zero days”… every time you use an exploit (ignoring the exact meaning of 0 days) it doesn’t become burned by the first person. The hacker could use it on hundreds of people before it’s discovered and patched by whatever software it targets. That could take…

It can certainly be "or": rootkits can come from your machine's supply chain, and lie mostly dormant for many months or years before activation. Rootkits can get installed after a non-zero-day-entrypoint vector e.g. simply tricking the user into running downloaded malware. etc.