Live data from Hacker News

LastPass autofill exploit

labs.detectify.com

401–410 of 443 posts

Re: LastPass autofill exploit

#401
post #383
post #374

Earlier quoted context omitted.

Out of the year I have been using Keepass I have never had a time where something was wrong that I would need support for. I am actually not sure what I would need support for either, it seems pretty basic. I am simply storing passwords. It doesn't seem too complicated. And maybe this is because I am a tech person, so maybe I am looking for the more technical reasons why the software may be better rather than how the…

An example I like to give for why 1Password Families has helped me is this: I work remotely for my job. I do travel several times a year as a result and when I'm gone I have other family members watch my house. Before 1Password Families I had to find a way to easily get my wifi password, my garage door code, and various other instructions and information to whoever was watching my house. With 1Password Families I sim…

Sure, I'll give some of my thoughts about it when I first fired up the trial.

The installer gave me an option to create desktop icon, but gave me no option to start the program when it was finished installing. It was odd having to go find and run the program once it was done installing, it is typical for most installers to give me an option to run after install. Not a big deal, but I thought it was worth a mention.

When I opened up 1Password I clicked "I am new to 1Password", and noticed that the prompt to select a location to store my keychain is under the program itself. This is annoying as I have to move it around to properly use the file explorer. Seems like a bug. Here is an image of what I am talking about: http://i.imgur.com/0Z6xTTq.png . Clicking on the file dialogue does not bring it above the 1Password application, it is stuck hiding behind it.

Entering the master password makes me enter my password twice, which makes sense, however it is odd that there is one password strength bar for both the "new" password and "re-enter" password section. The passwords should be identical, why tell me the same thing twice? http://i.imgur.com/ySXxT8g.png

I am quite confused with how I can import Keepass data into 1Password. Some googling shows I may need to use some perl scripts someone made to import them properly. I tried exporting my keepass database to csv and importing that but there were many problems. I used a lot of specific Keepass things like folders, as well as having a duplicate record that makes reference to another password entry.

Scrolling through the list of passwords is quite choppy and not smooth at all.

The search is slower than Keepass.

For the use cases you gave of sharing passwords I'd just print them out on a sheet of paper to be honest. It actually seems easier to me than sharing passwords via a program.

And on the top of micro managing and backups. I just use dropbox which by default keeps version history so managing backups is not really a thing for me.

So in my honest opinion for now I will likely be sticking with Keepass, for the reasons above, as well as because it does not support all of the platforms I use, which in my opinion is quite a critical feature as I want my passwords on every device.

Re: LastPass autofill exploit

#402

Earlier quoted context omitted.

Not the GP, but yes, and it doesn't require a good memory. The main things I do: 1. "Salt" my email usernames with the name of the service (johndoe+reddit@example.com) 2. Use multiple (long) password bases depending on the type of service (eg website vs app) 3. Combine the password bases with a cipher/salt based on the service name and my username I'm guilty of not rotating passwords on a regular basis, however.

So do you use encryption on that combined version? If yes, how do you deal with different requirements (one website says symbols required and more than 8 characters, another says symbols forbidden and less than 8 characters). If no, what stops someone who finds one password from changing the service name part and trying it somewhere else?

No encryption or hashing, since that would require (easy-access to) an external tool and lacks control over length and characters. It's not possible to simply change the "name part" of one of my passwords since the general format looks something like: {password_base}{service_cipher}{username_cipher}{special_chars}.

Depending on the type of service, `password_base` changes. For example, HN uses a separate one from Gmail for Business. Likewise, `service_cipher` and `username_cipher` are simply that: truncated ciphers of the service name and username. Lastly, `special_chars` is used for pesky sites that want special characters outside the range provided by my password base.

I'd like to think my system is very difficult for someone to crack without gaining access to a large number of passwords. The only limitation is that a few sites have limits on password length(!) which requires using a shorter base or even truncating the password entirely.

Re: LastPass autofill exploit

#403

I am using PasswordSafe ( pwsafe.org ) and Dropbox to sync to the cloud. I do not use autofill, nor I asked my browser to manage my passwords. There are a mix of opensource and commercial implementation covering all platforms (iOS, Android and what not). PasswordSafe has also been audited. Why isn't PasswordSafe more popular ? What do other password managers have that Password Safe does not ?

I do pretty much the same thing (but I keep pwsafe in version control). Great tool.

I do the same. I've been using Password Safe for a long time and will continue to do so, big fan of it!

Re: LastPass autofill exploit

#404
post #52
post #44

Earlier quoted context omitted.

Please correct me if I'm wrong, but lastpass uses the same 'zero-knowledge' method that spideroak uses, other than spider oak uses that term everywhere including their cloud backup offering. Zero knowledge is merely the fact that spider oak only holds encrypted backups of your files and it has no way of seeing them. LastPass tells us the same thing.

Maybe I shouldn't have mentioned Encryptr. There are fair number of open source alternatives that allow you to store secrets in the cloud: vault: https://github.com/hashicorp/vault blackbox: https://github.com/StackExchange/blackbox git-crypt: https://www.agwa.name/projects/git-crypt/ Pass: http://www.zx2c4.com/projects/password-store/ Transcrypt: https://github.com/elasticdog/transcrypt Keyringer: https://keyringer.…

Definitely should have mentioned it. Encryptr is excellent.

Re: LastPass autofill exploit

#406
post #52

Earlier quoted context omitted.

Maybe I shouldn't have mentioned Encryptr. There are fair number of open source alternatives that allow you to store secrets in the cloud: vault: https://github.com/hashicorp/vault blackbox: https://github.com/StackExchange/blackbox git-crypt: https://www.agwa.name/projects/git-crypt/ Pass: http://www.zx2c4.com/projects/password-store/ Transcrypt: https://github.com/elasticdog/transcrypt Keyringer: https://keyringer.…

Definitely should have mentioned it. Encryptr is excellent.

I know.

It's probably not worth attempting to convince certain people. Not only Encryptr, but even other ones [0].

Oh, and I'm not even remotely affiliated with SpiderOak.

[0] https://spideroak.com/solutions

Re: LastPass autofill exploit

#408

Earlier quoted context omitted.

Why did you switch from LastPass to 1Password? I recently started using LastPass after years of reusing the same uncrackable password: !p@ssword123

I've been using LastPass for years now, but I'm starting to explore other options. For me, the biggest pain point is the interface. The automatic form filling rarely works as it should; I click the LastPass icon in the username field, select the site, and it only populates the username (even though there is an input with type="password" right below it). I then have to: 1) Press ALT+W to bring up the LastPass site sea…

Using Chrome on Windows, I can right-click anywhere in the browser window, select "LastPass", select "Copy Password", and click the domain/user. (There's usually only one listed, unless I have multiple accounts on the site.)

Then just click the password field and Ctrl-V, of course.

If you're concerned about the clipboard, get in the habit of typing Shift-LeftArrow Ctrl-C after entering the password, to quickly replace your clipboard with a single character.

Re: LastPass autofill exploit

#409

Earlier quoted context omitted.

In practice, in many cases, bug bounties are de facto a bid in an auction against organized crime. It doesn't need to be 1-to-1 equivalent bid, and it's not for all sources of found bugs, but the intent and the effect is definitely there.

No, they are virtually never a bid against organized crime. There are two kinds of vulnerabilities in the world: The kind organized criminals will pay tens of thousands of dollars for, and the kind they, like any Internet rando, will pay $50 for lulz. If you think this dumb regex bug is worth the same to organized criminals as a Chrome sandbox escape or drive-by reliable Flash RCE... well, people think that about a l…

I can think of few vulnerabilities with more monetary value than an arbitrary exploit of a password manager in broad use by a class of people who have access to huge numbers of private systems.

Re: LastPass autofill exploit

#410
post #12

Please correct me if I am mistaken, but couldn't this have been implemented into an iframe that when ran could send the passwords to another remote server? If so, I am a little taken back by LastPass only offering $1,000 to the researcher that found and reported it for fixing. He or she could have taken a different path and resulted in this being used in some complex targeted attack against tech corporations via shor…

I don't think of the bounty as a reward for choosing not to break the law. Staying out of jail is the reward for not breaking the law; the $1000 is just a token of appreciation for someone that could have otherwise not bothered to report the bug.

>Staying out of jail is the reward for not breaking the law

I think it works the other way around.

Post reply on HN