Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

Post reply on HN
Print view View original

41–50 of 443 posts

Re: LastPass autofill exploit

#41

Post by techdragon »

avolcano wrote: post #5

I'm generally very sympathetic to regex bugs (especially in a language like JavaScript where you don't get nice expanded multiline regexes with comments), but I am wondering why they went with a regex in the first place. Did they decide `document.location.host` was too brittle for some reason?

I'd agree if there wasn't an extremely good solution to this problem.

Verbal Expressions - It's an extremely good higher level interface to the underlying regular expressions tools, in MANY languages.

Including:

JavaScript - https://github.com/VerbalExpressions/JSVerbalExpressions

ActionScript 3 - https://github.com/VerbalExpressions/AS3VerbalExpressions

Clojure - https://github.com/VerbalExpressions/ClojureVerbalExpression...

C++ - https://github.com/VerbalExpressions/CppVerbalExpressions

C# - https://github.com/VerbalExpressions/CSharpVerbalExpressions

Dart - https://github.com/VerbalExpressions/DartVerbalExpressions

Elixir - https://github.com/VerbalExpressions/ElixirVerbalExpressions

Elm - https://github.com/VerbalExpressions/elm-verbal-expressions

Erlang - https://github.com/VerbalExpressions/ErlangVerbalExpressions

FreeBasic - https://github.com/VerbalExpressions/FreeBasicVerbalExpressi...

F# - https://github.com/VerbalExpressions/FSharpVerbalExpressions

Go - https://github.com/VerbalExpressions/GoVerbalExpressions

Groovy - https://github.com/VerbalExpressions/GroovyVerbalExpressions

Haskell - https://github.com/VerbalExpressions/HaskellVerbalExpression...

Haxe - https://github.com/VerbalExpressions/HaxeVerbalExpressions

Java - https://github.com/VerbalExpressions/JavaVerbalExpressions

Lua - https://github.com/VerbalExpressions/LuaVerbalExpressions

Objective C - https://github.com/VerbalExpressions/ObjectiveCVerbalExpress...

Perl - https://github.com/VerbalExpressions/PerlVerbalExpressions

PHP - https://github.com/VerbalExpressions/PHPVerbalExpressions

PowerShell - https://github.com/VerbalExpressions/PowerShellVerbalExpress...

PureScript - https://github.com/VerbalExpressions/purescript-verbal-expre...

Python - https://github.com/VerbalExpressions/PythonVerbalExpressions

Racket - https://github.com/VerbalExpressions/RacketVerbalExpressions

Ruby - https://github.com/VerbalExpressions/RubyVerbalExpressions

Rust - https://github.com/VerbalExpressions/RustVerbalExpressions

Scala - https://github.com/VerbalExpressions/ScalaVerbalExpressions

Swift - https://github.com/VerbalExpressions/SwiftVerbalExpressions

Vala - https://github.com/VerbalExpressions/ValaVerbalExpressions

And probably more, but that's just the "official" implementations.

Re: LastPass autofill exploit

#43

Post by gpvos »

lucideer wrote: post #21
zouhair wrote: post #11

People trusting a third party for their passwords boggles my mind.

Perhaps, but this particular exploit doesn't target the fact your passwords are stored in the cloud. It targets the local autofill functionality in the browser, so it could conceivably have occurred in any password manager with browser/autofill integration. Including those that use a local password store.

Do you mean it could happen with, say, Firefox's built-in password manager?

Re: LastPass autofill exploit

#44

Post by ktta »

0xmohit wrote: post #36

One should really consider using open source tools for such things. The good thing is that those are battle-tested real well and are, usually, more secure than the commercial offerings. An example is Vault [0]. Encryptr [1] is another alternative: it claims that "all of your data will be saved in encrypted format in our Zero Knowledge [2] cloud". [0] https://github.com/hashicorp/vault [1] https://spideroak.com/soluti…

Please correct me if I'm wrong, but lastpass uses the same 'zero-knowledge' method that spideroak uses, other than spider oak uses that term everywhere including their cloud backup offering.

Zero knowledge is merely the fact that spider oak only holds encrypted backups of your files and it has no way of seeing them. LastPass tells us the same thing.

Re: LastPass autofill exploit

#45

Post by ktta »

littleweep wrote: post #40
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

I use Lastpass for work and can't stand it. I use 1Password for personal stuff (and some private work stuff now that I think of it) and highly recommend it. It's got a Chrome browser extension, mobile app, and like someone else mentioned below you can sync the encrypted db to a cloud service (iCloud, Dropbox, etc) so you can access it from all of your devices.

>I use Lastpass for work and can't stand it

I don't mean to be the advice bird, but maybe you can point all the points you made to your superiors and make them re-evaluate their choice. If they're a huge enterprise, then I understand

Re: LastPass autofill exploit

#46

Post by IshKebab »

crummy wrote: post #15
zouhair wrote: post #11

People trusting a third party for their passwords boggles my mind.

Where do you write yours down?

I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else).

It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated attacker) to work out my algorithm.

For example, my 'insecure' fixed part might be 'Tenk5$' (I recommend including uppercase, lowercase, a number and a symbol in that part to get around idiotic password requirements). Then my algorithm could be 'the last 5 letters backwards, skip the first vowel'. In which case my password for HN would be 'Tenk5$rtani'.

Re: LastPass autofill exploit

#47

Post by progx »

IshKebab wrote: post #46
crummy wrote: post #15

Earlier quoted context omitted.

Where do you write yours down?

I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else). It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated…

Problem is, that not all sites use the same style of passwort.

Some need Lower-/Uppercase, some with numbers, some with special Chars, some restrict to minimum of x chars, some use a maximum.

Your system works not for all things, i use a similar system, but store a bunch of passwords with last pass. Only really important passwords are in my head.

Re: LastPass autofill exploit

#48

Post by mattmanser »

gpvos wrote: post #43
lucideer wrote: post #21

Earlier quoted context omitted.

Perhaps, but this particular exploit doesn't target the fact your passwords are stored in the cloud. It targets the local autofill functionality in the browser, so it could conceivably have occurred in any password manager with browser/autofill integration. Including those that use a local password store.

Do you mean it could happen with, say, Firefox's built-in password manager?

Yes, it's exactly the equivalent of someone finding a bug with the auto-password fill functionality in Chrome or Firefox or IE to trick the browser into filling in a password on an unrelated site.

Re: LastPass autofill exploit

#49

Post by Freak_NL »

bimmer44 wrote: post #16
crummy wrote: post #15

Earlier quoted context omitted.

Where do you write yours down?

I'd recommend Pass [1]. It stores your data locally, is suprisingly easy to use and relies on battle tested GPG. From the website: "The community has even produced a cross-platform GUI client, an Android app, an iOS app, a Firefox plugin, a Windows client, a pretty Python QML app, a nice Go GUI app, an interactive console UI, Alfred integration (1) (2) (3), a dmenu script, OS X integration, git credential integration…

If safety is your primary concern though, stick with just the command line client, which is a Bash script most HN-readers will be able to follow to the letter. It in turn uses GnuPG.

The lack of integration then with the rest of the OS is actually a security benefit.

Re: LastPass autofill exploit

#50

Post by curiousgal »

littleweep wrote: post #40
ktta wrote: post #13

I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…

I use Lastpass for work and can't stand it. I use 1Password for personal stuff (and some private work stuff now that I think of it) and highly recommend it. It's got a Chrome browser extension, mobile app, and like someone else mentioned below you can sync the encrypted db to a cloud service (iCloud, Dropbox, etc) so you can access it from all of your devices.

It even runs on Linux with Wine with browser integration.
Post reply on HN