Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

391–400 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#391

Post by shkkmo »

pqs wrote: post #389
shkkmo wrote: post #372

Earlier quoted context omitted.

> What would you have the people who are using LastPass do, stop using it? Yes. After their last major breach I exported all my data and deleted all my credentials and account with LastPass. Seeing the details of this breach, I'm super happy I did.

But you don't know if they deleted all the backups. You'll never be sure you are safe.

It's a solid point, you really need to rotate all the credentials to be safe. I did that for the important accounts and don't share passwords between accounts. I'm sure there are still a few accounts here amd there that might be at risk.l, especially since it was specifically the backups that were compromised.

Re: The situation at LastPass may be worse than they are letting on

#392

Post by camtarn »

g_p wrote: post #363
rwmj wrote: post #359

Being completely ignorant about how this works, why would a LastPass compromise result in passwords being exposed? Surely they themselves don't store unencrypted passwords, but instead the passwords are encrypted by the user's key? Or is this a compromise of the locally installed software?

The passwords are encrypted by a per-user key. That per-user key is derived from a password through a password based key derivation function (PBKDF). In essence, an iterative hashing function. Many users don't use "good" passwords, so you use a high number of iterations on the KDF, to make it harder to brute-force an account's password. Lastpass initially used 5000 rounds of KDF for old accounts. That's not a lot, es…

Just checked on my own account, which I set up in 2012. Mine was configured with only 500 rounds of KDF - eep.

Re: The situation at LastPass may be worse than they are letting on

#393

Post by Fire-Dragon-DoL »

DethNinja wrote: post #9

Is there any reason to use these cloud based solutions when open source alternatives like KeepassXC is available?

People keep asking: if you have family and you need partial sharing and full sharing as well as write capabilities on multiple devices at same time without messing up, keepass is insufficient.

Re: The situation at LastPass may be worse than they are letting on

#394

Post by nine_k »

chank wrote: post #188
nine_k wrote: post #182

Earlier quoted context omitted.

But you do not have the keys and passwords on that server. Only their encrypted forms. And the master password never leaves your machine(s), the sensitive bits are only decrypted locally. This is reasonably safe, as long as you're careful with your master password, no different form GPG.

I'd still rather not let anyone have the encrypted versions of my keys/passwords. If the software is compromised then it's reasonable to consider the encrypted data can be brute forced with some time. I'm not here to argue the merits of encryption. I understand it very well. I'm only considering my own levels of comfort and need to trust a 3rd party as well as pay a recurring fee to store my keys/passwords.

Encryption that can't be brute-forced within centuries, even with a quantum computer, exists for some time, and is not really expensive to apply, especially on such small scales as a password database.

Re: The situation at LastPass may be worse than they are letting on

#395

Post by tinco »

shkkmo wrote: post #385
tinco wrote: post #374

Earlier quoted context omitted.

I eh.. was not up to date, I blame our office Christmas party. I guess I'm moving our organization over next year..

I meant the major breach before this one, I believe that was the one that gave attackers access to their dev environment, which they used to steal the developer credentials they used to make this attack.

I don't agree that was enough of a reason to drop them. An attacker getting access to your dev environment, even if you're one of the largest security focus endeavours, is pretty much an inevitability. Someone's gonna get access to one of your engineers macbooks, no matter what.

The thing that's bad, is that apparently their developers have access to (backups off) production data. That implies that their security infrastructure is not different from regular startups at all so all of their marketing is just bullshit. They didn't sacrifice developer productivity for security on this point, so they can't be trusted to have sacrificed anything for security at any point.

Re: The situation at LastPass may be worse than they are letting on

#396

Post by lalopalota »

isthisthingon99 wrote: post #304
tadfisher wrote: post #244

Earlier quoted context omitted.

There is a really good browser extension for pass, called BrowserPass. It has auto fill with phishing protection. There is also a good Android app, called Android Password Store, which does the same for all of my apps. Both use GPG keys stored on my Yubikey.

how do you use yubikey with android?

NFC or USB-OTG adapter.

Re: The situation at LastPass may be worse than they are letting on

#397

Post by WesolyKubeczek »

dmix wrote: post #376
WesolyKubeczek wrote: post #343

Earlier quoted context omitted.

I can read the sentence with both versions and it still makes sense…

It should be “weary of” not “weary about”

Yes.

But “wary of” and “weary of” both work. :-)

English is my third or fourth language, so I guess I’m less sensitive to mistakes like that.

Re: The situation at LastPass may be worse than they are letting on

#398

Post by g_p »

camtarn wrote: post #392
g_p wrote: post #363

Earlier quoted context omitted.

The passwords are encrypted by a per-user key. That per-user key is derived from a password through a password based key derivation function (PBKDF). In essence, an iterative hashing function. Many users don't use "good" passwords, so you use a high number of iterations on the KDF, to make it harder to brute-force an account's password. Lastpass initially used 5000 rounds of KDF for old accounts. That's not a lot, es…

Just checked on my own account, which I set up in 2012. Mine was configured with only 500 rounds of KDF - eep.

Eek. It is quite incredible they didn't have any kind of KDF upgrade system built into the login process, under the guise of "log in again please". And presumably no prominent permanent notification of your 500 rounds of KDF (!!)

Edit:

https://web.archive.org/web/20120320015133/https://helpdesk.... confirms that the default was indeed 500.

According to https://www.infosecblog.org/2012/06/lastpass-and-pbkdf2/, there are even some old accounts with a single round of sha256 (!)

Re: The situation at LastPass may be worse than they are letting on

#399

Post by irrational »

eternityforest wrote: post #318
irrational wrote: post #249

Earlier quoted context omitted.

What do you mean by Google? I looked at the Wikipedia article, but didn’t see Google listed.

They're not listed, but Chrome and Android can manage passwords

Oh, I see. Well, I don’t use Chrome or Android, so I’ll look at BitWarden.

Re: The situation at LastPass may be worse than they are letting on

#400

Post by thelopa »

diarrhea wrote: post #261
fruit2020 wrote: post #251

Earlier quoted context omitted.

Do you expose your server to the internet or is it ok to sync devices only when you’re at home? Is every device a replica, if you lose your server can you redeploy it from the data on your device?

Not the parent, but I have been hosting a Vaultwarden instance on the public internet for about two years now. After learning about certificate transparency logs, I moved the app from a raw subdomain behind a secret URL path. Think “hello.domain.com/correcthorsebatterystaple”. Is it security by obscurity? You bet. Does it work? Yes. I regularly evaluate the JSON logs emitted by Caddy in a pandas script and so far, no…

I had a at-home-only version once. Then I failed to unlock my vault on my iPhone (FaceID issue or something) and it refused to allow me to enter the master key without first passing the 2FA check with the server (did it delete the local vault or something?!). I had to go home to fix it.

I’d recommend ensuring you have some sort of VPN solution so that you can access your vault away from home, too.

Personally, I just decided to use the 1st party server. I realized that reliable access to my vault is a service I really don’t want to be without due to technical issues in my setup.

Post reply on HN