Live data from Hacker News

LastPass: design flaw in communication to privileged components

bugs.chromium.org

41–45 of 45 posts

Re: LastPass: design flaw in communication to privileged components

#41
post #14
post #6

Earlier quoted context omitted.

I thought the point of a password manager is to allow you to have separate passwords for numerous services which are protected by centralizing those passwords somewhere (preferably somewhere you control, such as your own phone) and protecting the result with one password. Your model of them seems to involve them replacing a password locally, which I don't think anyone would recommend.

I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password. In fact, I'd go further and say that you can do this with your login name. So for example: myemail+by@gmail.com for eBaY This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your i…

This assumes that your password is never leaked, changed, or reset. What happens if Ebay's password database were exfiltrated? You now have the following problems:

1) If your password is cracked, a hacker seeing it might deduce your algorithm and then deduce that your Amazon password would be 'myemail+mo', etc. Now your scheme is out the window.

2) Even assuming your password is salted and hashed securely such that it can't be decrypted, Ebay would probably reset it as a precaution. So now you've got to change this password. Maybe you decide to do the 3rd and 5th letters of the domain name instead. So now your scheme is 2nd-and-5th for all but Ebay, and you've got to remember that the Ebay one is unique. For now. As more leaks or resets occur down the line, however, you'll have more exceptions, to the point that you'll be forced to maintain a list of what KIND of passwords each site uses. In which case, why not just use a password manager?

Re: LastPass: design flaw in communication to privileged components

#42
post #17

Earlier quoted context omitted.

This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.

99.999% of users will never experience a "well-planned targeted attack." Making us jump through the same security hoops that can protect high-value targets is annoying.

Anyone could become a target anytime. An attacker would just have to attack one person at a time.

Re: LastPass: design flaw in communication to privileged components

#43
post #42

Earlier quoted context omitted.

99.999% of users will never experience a "well-planned targeted attack." Making us jump through the same security hoops that can protect high-value targets is annoying.

Anyone could become a target anytime. An attacker would just have to attack one person at a time.

[deleted]

Re: LastPass: design flaw in communication to privileged components

#44

Earlier quoted context omitted.

What are "reasonable security practices" for maintaining strong, unique passwords over several hundred sites?

Randomly generate a password for every site. Store said passwords in a password manager protected with one master password which you remember (taking the number of passwords you would have to remember from hundreds (impossible) to one (very possible)). Even using the built-in password saving feature of your browser is fine for this if you can't be bothered to use anything else. Chrome even has an option to generate r…

That's what I thought, but it's also exactly what LastPass and other password managers do, so I'm still unclear why kevin_thibedeau thinks password managers aren't " reasonable security practices."

Re: LastPass: design flaw in communication to privileged components

#45
post #3

Earlier quoted context omitted.

They have a history of trying to explain away their security problems as not really their fault. That alone should give any LastPass user pause.

That's unfair. LastPass has always been transparent about their problems, much more so than other companies like Dropbox. And there's nothing in their response that tries shifting the blame: https://blog.lastpass.com/2016/07/lastpass-security-updates....

> Beware of phishing attacks. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies.

This was not necessary for this attack to be successful on the default configuration of the tool. That's what I take issue with.

Post reply on HN