We’ll find out if they actually deleted deleted data or not.
This was my first thought too. Sigh.
The situation at LastPass may be worse than they are letting on
41–50 of 436 posts
Re: The situation at LastPass may be worse than they are letting on
#42Earlier quoted context omitted.
e.g. password to facebook would be: facebook.com$293MyPasswordYouKnowIt!!123 password to gmail would be mail.google.com$113MyPasswordYouKnowIt!!123 only annoying thing is that the passwords are long. I guess it's secure, though. edit: see child post for clarification. I do something above for spammy sites, but for something like gmail I probably wouldn't do that.
That’s not secure at all. Eventually, some website you use is going to get hacked. They’ll have stored passwords as plaintext. From there, anyone who wants to hack any of your accounts knows your password format. It’s going to be obvious to them that they just need to replace the domain.
how would they figure out the unique identifier? couldn't you say the same thing about using an arbitrarily unique password and then a password manager. if your password manager is hacked then they'd get the encrypted passwords for all sites you use along with all the personal information.
of course, you'll say, don't use a crappy password manager. and that's correct. same reason I use a separate format for sketchy sites.
for what it's worth my format isn't really as described, but it is similarly deterministic, but not visually so. the cipher is basic enough to do in your head but complicated enough that you wouldn't know from a glance
a real password example for your scrunity:
m0m2a2yiplagsosowgolredd1o2t3c!o!m2
steps:
m a i l g o o g l e d o t c o m
strategy
zip
secret
mypassword123!!
offset (publicly determinable)
0
unique: 2022
m0m2a2yiplagsosowgolredd1o2t3c!o!m2
i use a password manager so the long text generally is irrelevant. the main reason I do this is because I don't feel comfortable needing my password manager. I like being able to figure out my actual password completely independent of a phone or internet or app.
the strategy depends on how sensitive the app is (strategies include: zip, append, vowel-zip, no-vowel-zip, num-zip, all the same but with a reverse-offset). unique is usually something like when I joined, or something determinable from the site and my head.
all of this seems much more complicated than it is. once you understand you could calculate the password in your head in a couple seconds.
Re: The situation at LastPass may be worse than they are letting on
#43[dead]
Re: The situation at LastPass may be worse than they are letting on
#44For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…
I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.
PigSty's Razor
Re: The situation at LastPass may be worse than they are letting on
#45Earlier quoted context omitted.
That’s not secure at all. Eventually, some website you use is going to get hacked. They’ll have stored passwords as plaintext. From there, anyone who wants to hack any of your accounts knows your password format. It’s going to be obvious to them that they just need to replace the domain.
how would they figure out the unique identifier? couldn't you say the same thing about using an arbitrarily unique password and then a password manager. if your password manager is hacked then they'd get the encrypted passwords for all sites you use along with all the personal information. of course, you'll say, don't use a crappy password manager. and that's correct. same reason I use a separate format for sketchy s…
you're putting a lot of confidence in an effective password length of 3
Re: The situation at LastPass may be worse than they are letting on
#46For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…
[dead]
Re: The situation at LastPass may be worse than they are letting on
#47I’m skeptical of this. Seems like if it were true, we would be hearing the same thing from several other independent and credible sources.
I agree: LastPass has been hot garbage for many years but it still has a significant presence, some guy’s low-value crypto wallets would not be the first we hear about a compromise of LastPass vaults. There are entire companies using LastPass for critical systems.
I absolutely believe it’s possible that LastPass has been compromised more than they’ve let on and I won’t be surprised if we eventually find out vaults are vulnerable, but I don’t believe this is how it would play out.
Sunday the 18th is conveniently around the time of the latest announcement, but not the time of the actual hack. Feels like someone is over fitting.
Re: The situation at LastPass may be worse than they are letting on
#48Earlier quoted context omitted.
how would they figure out the unique identifier? couldn't you say the same thing about using an arbitrarily unique password and then a password manager. if your password manager is hacked then they'd get the encrypted passwords for all sites you use along with all the personal information. of course, you'll say, don't use a crappy password manager. and that's correct. same reason I use a separate format for sketchy s…
you're putting a lot of confidence in an effective password length of 3
you're thinking too much about the specific example and not the general point, but I edited the parent comment with an actual example
edit: oh, I did say append so I see why you'd think that. that's my bad. what I meant was include
Re: The situation at LastPass may be worse than they are letting on
#49If this was true, i feel like it would be a little strange for the attacker to use it to steal a small amount of crypto. Once its revealed how bad this is, there would probably be a small window before people change their passwords, i would assume attackers would either go for a big score before revealing this capability, or they would try to hit everything very quickly. Just hitting a tiny amount of crypto seems odd.
Re: The situation at LastPass may be worse than they are letting on
#50Earlier quoted context omitted.
1password’s security design whitepaper can be found here: https://1passwordstatic.com/files/security/1password-white-p... It’s quite good.
Thanks! They seem to encrypt everything too. Items contain overviews and details which are encrypted separately by the vault key. We encrypt these separate so that we can quickly decrypt the information needed to list, sort, and find items without having to first decrypt everything in the vault. Item overviews include the item fields needed to list items and to quickly match items to websites, such as Title, URLs, pa…
Additionally, 1Password makes the extra effort to never even send the URLs of your accounts to their servers. Even with their Watchtower service, which notifies you of breached accounts and websites that support 2-factor authentication, your passwords and website URLs are never sent to 1Password servers.