The situation at LastPass may be worse than they are letting on

Post by hoistbypetard » Sun, Dec 25, 2022, 6:30 AM UTC

pch00 wrote: post #273

hoistbypetard wrote: post #211

Earlier quoted context omitted.

> is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). You can see their server and client code here: https://github.com/bitwarden I choose to use their clients unmodified, along with an instance of the server formerly known as "bitwarden_rs" running in my basement as the sync backend. https://github.com/dani-garcia/v…

> You can see their server and client code here: https://github.com/bitwarden But in the case of the mobile apps, downloaded from their respective platform's app store, how can you guarantee the code you see on github is the exact same code you're running on your device? Admittedly this supply-chain-verification is an issue for all mobile app store apps but seems particularly important with something like a password…

Post by npc12345 » Sun, Dec 25, 2022, 7:27 AM UTC

acheron wrote: post #14

n0tth3dro1ds wrote: post #10

Earlier quoted context omitted.

Yeah: they’re cloud based. Your passwords get synced to all your devices automatically. That’s kinda the entire draw.

Exactly. I used Keepass for years but it became too much of a pain. (Though I suppose changing a bunch of passwords that I had in LastPass is also kind of a pain.)

Post by Sakos » Sun, Dec 25, 2022, 11:54 AM UTC

scarab92 wrote: post #144

Sakos wrote: post #21

Earlier quoted context omitted.

I mean the individual accounts are protected by 2fa. I have an account or two where I know the password has been leaked but they're so unimportant that I can't be bothered to change the passwords. They still can't get in without my approval.

A lot of sites don’t limit total 2FA attempts, so a determined actor could still get in eventually.

Post by catchnear4321 » Sun, Dec 25, 2022, 1:46 PM UTC

tinco wrote: post #283

darawk wrote: post #257

Earlier quoted context omitted.

It seems like a reasonably well written anecdote by someone who has some idea what they're talking about. It could obviously be false, but the consequences if he's right are potentially serious for a lot of HN users who might use LastPass. The consequences if he's wrong are a little extra reputational damage for LastPass, but that seems like a worthwhile tradeoff here. Not everything posted on HN has to be verified t…

It's like a novice programmer blaming the compiler for a bug in their application. It's very unlikely to be true. What would you have the people who are using LastPass do, stop using it? Because some crypto dude stored their highly valuable keys in a system that literally copies their keys to any system they log into, to systems that are notorious for having very leaky abstractions and vast vulnerability surfaces?

Post by ionspin » Sun, Dec 25, 2022, 11:46 PM UTC

mook wrote: post #404

ionspin wrote: post #328

Earlier quoted context omitted.

In a perfect scenario you would be able to use a reproducible build [0], for Android you can actually get Bitwarden from F-Droid [1] which uses those reproducible builds. For Google play store, there was also that developers needed to sign their apps before releasing to stores, so you knew that it came from developer, but Google removed that when they introduced app bundles. There is still a way to verify if the buil…

Looking at that, it doesn't seem like you can actually get Bitwarden from F-Droid? That looks like instructions to set up a third-party repository (hosted by Bitwarden)? The page didn't mention anything about reproducible builds. (Doesn't mean they aren't using it though, but that would be internal.)