Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

391–400 of 587 posts

Re: Lastpass Security Incident

#391

Post by mosquitobiten »

mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

This type of self-referencing and self-congratulatory comment is what makes this website worse and worse little by little. You don't add any meaningful information or knowledge and it is something shallow a kid would say to look cool in front of his friends. I am not attacking you, you can do better.

Re: Lastpass Security Incident

#392

Post by EugeneOZ »

bnmathm wrote: post #10

> We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. Sure sounds like they found passwords or keys in the development environment breach back in August, and nobody bothered to change those after kn…

The most shocking thing for me. The real stopper for anyone who is still trying to keep their trust in LastPass.

Re: Lastpass Security Incident

#393

Post by rjbwork »

caminante wrote: post #262
matthewwolfe wrote: post #249

Earlier quoted context omitted.

You laugh at that coding assignment for a senior position but you'd be surprised how many "senior" people interview that would struggle with that and be unable to complete it.

FizzBuzz interview questions are fair game[0] , especially if you're not networking in via referrals and are 1/5000 online applicants like the parent. [0] https://www.joelonsoftware.com/2006/10/25/the-guerrilla-guid...

Pretty much. I hold the record for our coding question in my company - 3 minutes and 54 seconds. Granted, I'm one of the two people that put the question together, but still.

We've had candidates with "20 years of experience" completely unable to do what amounts to "call a web service, deserialize some json, write a couple for loops and if statements, and post back some json to a web service" in over an hour, or in a take home scenario.

It will never cease to amaze me that there are people employed in this field that just. can. not. program.

Re: Lastpass Security Incident

#394

Post by marginalia_nu »

gorgoiler wrote: post #341
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…

Yeah I'd model it as something like this maybe?

  public enum Color {
    RED, BLACK
  }

  public enum Suit {
    Diamonds(RED, '♦'),
    Hearts(RED, '♥'),
    Clubs(BLACK, '♣'),
    Spades(BLACK, '♠');

    Color color;
    char symbol;

    public Suit(Color color, char symbol) { this.color = color; this.symbol = symbol; }
  }

  public enum Rank {
    Ace('A'),
    Two('2'),
    //...
  }

  public record Card(Suit suit, Rank rank) {
     // ... 
  }
The question is fundamentally broken because data objects shouldn't be inheriting anything. That's in almost all cases bad design that demonstrates only that you have no clue how to write sensible object-oriented code.

You wouldn't want to check whether a poker hand has a pair by using a bunch of instanceof's or getClass()-shenanigans. You also don't want to encode knowledge about poker into into the card object. That's just data.

Re: Lastpass Security Incident

#395

Post by sofixa »

sidewndr46 wrote: post #21
bombcar wrote: post #20

Someday one of these password managers is going to be hacked wide open and it is NOT going to be pretty.

I don't use them, but my conclusion is that at least one major cloud password manager has been hacked already without any disclosure. If they disclose it, the company should logically be dead. Thus, the incentive would just be to cover it up.

Thanks to the GDPR a coverup is no longer an option.

Re: Lastpass Security Incident

#398

Post by fullmoon »

mosquitobiten wrote: post #391
mfcl wrote: post #226

I once started an interview process as a senior developer at Goto, the company behind LastPass. The contact was a first phone call where someone simply asked the number of experience I had in software development, Java programming, etc. I thought it was weird that basically all they got from the phone call was a bunch of numbers. The weirdest part tho what that they asked how many years of experience I had in... open…

This type of self-referencing and self-congratulatory comment is what makes this website worse and worse little by little. You don't add any meaningful information or knowledge and it is something shallow a kid would say to look cool in front of his friends. I am not attacking you, you can do better.

Reflect on the reasons why you’ve just written this very comment.

You might be surprised.

Re: Lastpass Security Incident

#399

Post by donkeyd »

roydivision wrote: post #396

Related general question - does anyone do a regular export of their password database? I'm thinking this would be a good idea, but I'm wondering what the best practice is, obs the export needs to be secured.

I have an encrypted USB stick for things like this. It has a keyboard, so encryption is built into the device and it wipes after 10 tries (not ideal for back-up).

Re: Lastpass Security Incident

#400

Post by temptemptemp111 »

fullmoon wrote: post #398
mosquitobiten wrote: post #391

Earlier quoted context omitted.

This type of self-referencing and self-congratulatory comment is what makes this website worse and worse little by little. You don't add any meaningful information or knowledge and it is something shallow a kid would say to look cool in front of his friends. I am not attacking you, you can do better.

Reflect on the reasons why you’ve just written this very comment. You might be surprised.

No post body was provided.
Post reply on HN