Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

41–50 of 311 posts

Re: LastPass Security Notice

#41

Post by el_duderino »

wepple wrote: post #20
LawnGnome wrote: post #5

I don't use LastPass, but one thing that impresses me about their blog post: they didn't hide behind "your passwords are hashed" or something equally weaselly, but instead said exactly and clearly how passwords are hashed. Every online company should take note.

I would however appreciate more detail on the breach. This would at least give an indication of their general security posture. I'm reading this as an embarrassing security lapse in general security, so they misdirect by talking in depth about password hashing.

Unfortunately, I don't believe they've ever posted a follow up with more technical analysis on previous breaches.

Re: LastPass Security Notice

#42

Post by Klathmon »

jlward4th wrote: post #32
pdabbadabba wrote: post #22

Earlier quoted context omitted.

But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it. I agree with you that an of…

The difference is that a password manager must be able to decrypt a password in order for it to be used, while ideally websites only store one-way hashed passwords which if stolen aren't always useful at gaining access to other sites.

Ideally websites only store the hash, but you have no way of verifying which websites are actually doing that (and if they are doing it right).

Re: LastPass Security Notice

#43

Post by tptacek »

Someone1234 wrote: post #39
quonn wrote: post #26

Earlier quoted context omitted.

1Password only stores encrypted files in Dropbox. The encryption is done offline. Assuming the encryption is done properly, it is difficult to conceive of a way to attack it even assuming that Dropbox is compromised.

Actually that's how LastPass works (they move around an AES-256 encrypted database, and decrypt it on the client/browser). The problem LastPass has, is that they re-use the same master password for two distinct things: - Authenticating to login to your account. - Encrypt your password database. So in situations like this the loss of the authentication hash is relevant. I'd prefer to have a different password for the…

I find this design kind of baffling. Why go through the trouble of storing data encrypted only to snatch defeat from the jaws of victory by demanding that the client provide a secret derived from the encryption key just to log in?

Re: LastPass Security Notice

#44

Post by radicalbyte »

jlev wrote: post #23
makeitsuckless wrote: post #17

Earlier quoted context omitted.

A centralized store is however unavoidable if you want to share and manage passwords inside an organization. Although I share you discomfort, looking at it rationally I prefer to trust a specialized service, who's very existence and reputation depends on it, more than the alternatives. The other alternative for sharing is stuff like 1Password over Dropbox, which is imho the worst of both worlds.

Why is 1Password over Dropbox the "worst of both worlds"? Seems like it's potentially safer, because it's encrypted with your passphrase and also your dropbox credentials. Sure, the NSA can probably get it, but J Random Hacker can't.

I'm not sure how encryption will stand up when you have a set of all deltas from V1... Vn of the encrypted file.

From my admittedly small knowledge of encryption I would assume that such a set of data could be used to greatly decrease the size of the search-space for the decryption key.

There are a few people experts who post here, anyone care to comment?

Re: LastPass Security Notice

#45

Post by Klathmon »

cissou wrote: post #18
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

I understand your take on the problem, but one of the features of those services is that they are precisely online: I can get my passwords on my phone, tablet, desktop, laptop, abroad or at work. If my password manager is offline, it's safer, but it's also a poorer experience. Maybe if there was a way to deploy our own personal password manager server on a dedicated server that would help the "one big target" issue.

But even that won't help much.

If you are using "off the shelf" software, then that means i have something to scan for, and a vulnerability in the software means that i have tons of targets. Most of which won't be as secure as LastPass servers might be, and probably won't update immediately.

Re: LastPass Security Notice

#47

Post by maccam94 »

TheSwordsman wrote: post #29
jlev wrote: post #23

Earlier quoted context omitted.

Why is 1Password over Dropbox the "worst of both worlds"? Seems like it's potentially safer, because it's encrypted with your passphrase and also your dropbox credentials. Sure, the NSA can probably get it, but J Random Hacker can't.

Dropbox doesn't encrypt files, AFAIK.

- Dropbox files at rest are encrypted using 256-bit Advanced Encryption Standard (AES).

- Dropbox uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit between Dropbox apps and our servers; it's designed to create a secure tunnel protected by 128-bit or higher Advanced Encryption Standard (AES) encryption.

Source: https://www.dropbox.com/help/27

Re: LastPass Security Notice

#48

Post by systematical »

I switched to lastpass a year ago for all non-critical accounts, basically everything thats not email or my personal finances. Its still a bit of a risk, but this way I only need to remember about 5 passwords. I guess I'll slowly be updating all the passwords on my lastpass sites and coming up with a new master password today.

In short, more major sites need to implement a Google Authenticator style service.

Re: LastPass Security Notice

#49

Post by geekamongus »

Someone1234 wrote: post #31

I just deleted, regenerated, and re-associated Google Authenticator and then altered the number of iterations from 10,000 to 10,001 (causing it to re-encrypt the database). None of this is really required but it has invalidated much of the information they could have stolen. The thing that really bugs me about this, is the email address. I have a very low spam level on that account (sub-1 per day on average) and I wa…

Kitchen sink spam is the worst.

"Drain covers in your neighborhood are horny now."

"Faucet dripping? Here's how to earn money from home with it."

Re: LastPass Security Notice

#50

Post by scotu »

jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

>This is one area where I feel strongly that the conveniences of 'Cloud' are outweighed by the risks.

I wish this was true, in fact with at least 3 devices I use daily, having an offline password manager means I need to type in manually "difficult" passwords on 2 (n-1) devices (at least that's assuming how password managers and username-password auth work today). Call me lazy but that's already above threshold for me, I'd rather use same password everywhere than do that. Am I missing something?

Post reply on HN