Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass: Notice of Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

41–50 of 141 posts

Re: LastPass: Notice of Security Incident

#41

Post by schmichael »

shigawire wrote: post #22
jrm4 wrote: post #21

For all of its warts, at least crypto has managed to come up with a clever little motto that correctly states the issue, in the form of "not your keys, not your crypto." Putting your passwords in the hands of a third party drastically increases your threat surface and no amount of hand-wavy "but it's not as convenient" will change this fact. Now, it may be true that the convenience factor is very strong right now, bu…

My problem is that as an unskilled person - will I be any better at securing my own system?

If the password journal my mom left at my house while visiting is any indication: absolutely not.

Use a password manager, remember a 2nd password for your email yourself, and then use a second factor for as many things as possible. USB keys are best, but anything is better than nothing: SMS, Authy, Google Authenticator, phone call, whatever. Chrome and Safari both have password managers these days, and some Chromebooks even have a builtin second factor. 2FA is still a hassle for sure, but it's getting better all the time.

Re: LastPass: Notice of Security Incident

#43

Post by [deleted] »

fezfight wrote: post #20
smt88 wrote: post #12

Earlier quoted context omitted.

Yeah, again: all of this is great for you, but it doesn't change the fact that you are a very, very niche case. You can't just dismiss cloud syncing of passwords because you are the edge case who doesn't need it. > I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. That doesn't work for…

You've picked a strange subset of 'most' for the people you're imagining. They are savy enough to know what a password manager is, but not savy enough to deal with an offline one. Are you sure its not just a few people like you?

[deleted]

Re: LastPass: Notice of Security Incident

#45

Post by jiveturkey »

whoisjohnkid wrote: post #42

Hmm, even though LastPass doesn’t have access to your pass, couldn’t a malicious software update cause attacker to view your passwords when it runs since the software ultimately has access? This doesn’t seem to be the case in this incident though.

I think you are referring to a malicious client software update. It doesn't even have to be that, since a common way to use LP is just over the web.

Re: LastPass: Notice of Security Incident

#46

Post by solarkraft »

schmichael wrote: post #33
jrm4 wrote: post #21

For all of its warts, at least crypto has managed to come up with a clever little motto that correctly states the issue, in the form of "not your keys, not your crypto." Putting your passwords in the hands of a third party drastically increases your threat surface and no amount of hand-wavy "but it's not as convenient" will change this fact. Now, it may be true that the convenience factor is very strong right now, bu…

Not sure I follow. As stated in the article LastPass does not have the "key" (Master Password) in this case, so a straightforward reading of your comment suggests there's nothing to be worried about here. However I think what you're saying is that even trusting encrypted bundles of secrets to third parties is a bad idea? Even on this point I have to disagree because that's precisely what 2FA is for. Even if LastPass…

I thought the 2FA all the big services have is so that they will deliver you your encrypted vault, rather than another layer of encryption? (I know FIDO can theoretically do that, but AFAIK it really wasn't designed for it).

The threat isn't the service having the encrypted vault anyway; we kind of trust the encryption to be decent (though of course you can't know what technological threats are looming).

The real threat is that you're putting your password for decryption into a proprietary blob with an internet connection and auto-updates enabled. It might be sending your password random places now or maybe at some later point.

Note that even a source-available password manager doesn't really solve this issue if it's not self compiled - and most of the time you'd probably want automatic security updates enabled on something security critical. But they can put anything they want to or are pressured into putting in there.

Re: LastPass: Notice of Security Incident

#47

Post by jrm4 »

schmichael wrote: post #41
shigawire wrote: post #22

Earlier quoted context omitted.

My problem is that as an unskilled person - will I be any better at securing my own system?

If the password journal my mom left at my house while visiting is any indication: absolutely not. Use a password manager, remember a 2nd password for your email yourself, and then use a second factor for as many things as possible. USB keys are best, but anything is better than nothing: SMS, Authy, Google Authenticator, phone call, whatever. Chrome and Safari both have password managers these days, and some Chromeboo…

Unless she picked bad ones, or is prone to leaving it places, what exactly is the problem with the journal?

Re: LastPass: Notice of Security Incident

#48

Post by llbeansandrice »

schmichael wrote: post #41
shigawire wrote: post #22

Earlier quoted context omitted.

My problem is that as an unskilled person - will I be any better at securing my own system?

If the password journal my mom left at my house while visiting is any indication: absolutely not. Use a password manager, remember a 2nd password for your email yourself, and then use a second factor for as many things as possible. USB keys are best, but anything is better than nothing: SMS, Authy, Google Authenticator, phone call, whatever. Chrome and Safari both have password managers these days, and some Chromeboo…

People like to dunk on the password journal but I find it hard to believe that someone is going to break in to your mom's house as the way to access her bank or facebook account.

It's a horrible idea to leave the password for the database sitting next to the admin's workstation. But physical access is a vastly different concern for a corporation than an individual.

Threat surfaces are different for different people. I'd _love_ if my parents kept a separate password notebook instead of an unlocked note on their phone.

2FA is obviously good but different. But a notebook is an entirely offline password manager and it immediately lets people do one of the most important things which is not repeat passwords.

Re: LastPass: Notice of Security Incident

#49

Post by stusmall »

DreamFlasher wrote: post #27

Wouldn't have happened with Bitwarden ;)

That's not a healthy assumption. Breaches can and will happen to anyone and we should assume they eventually will happen to everyone. What matters is how quickly you can detect the breach how limited the impact is. It's still too early to tell exactly whats happening here yet. That said, if this only impacted a development environment that contained no customer data then this is a good example of that principle.

Re: LastPass: Notice of Security Incident

#50

Post by g_p »

whoisjohnkid wrote: post #42

Hmm, even though LastPass doesn’t have access to your pass, couldn’t a malicious software update cause attacker to view your passwords when it runs since the software ultimately has access? This doesn’t seem to be the case in this incident though.

Yes, absolutely - a compromised development environment might be the first step towards getting implanted code into shipping software, or getting to a signing environment (hopefully highly isolated, but you never know!), with a view to carrying out a supply chain attack.

That's basically what happened in the solarwinds compromise.

Post reply on HN