Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Issues with LastPass on Android

abhyudaya.dev

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Security Issues with LastPass on Android

#51

Post by AvocadoCake »

1cvmask wrote: post #33
scrollaway wrote: post #22

Earlier quoted context omitted.

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

Have you taken a look at saas pass that has 2fa as the default and the password manager identifies sites with 2fa? disclaimer: was involved on the 2fa part of it.

I used SaaS pass at work for a while, and it made my day a little bit worse every time I had to use its 2FA. The app's login on push notification thing was very slow, and would fail too often (maybe 5-10% of the time). I ended up using the QR code scanning for 2FA more often than not, but even that was slow, not even accounting for for the time it takes a human to unlock their phone and open the app. Doing thing multiple times throughout the workday was a real drag.

It's a shame, because I think the idea of it is nicer and no less secure than Google Auth, but I'd much rather enter 6 numbers than wait for the app.

Disclaimer: This was around a year ago, perhaps it's improved since.

Re: Security Issues with LastPass on Android

#52

Post by forty »

forty wrote: post #50
jfktn5ntkfl wrote: post #23

I'm more and more worried about a supply chain attack on LastPass/KeePass. To the point that I'm skittish about upgrading them. It feels to me like we need someone with huge resources, like Microsoft/Gooogle/Apple... to buy them and apply their methods against this attack. For example, where are the binaries built? Who controls the accounts used to upload the installers? Do they regularly pay security teams to try to…

(I work for another password manager company). Your questions are fair but not specific to password managers. All software can be victim of this kind of attacks. People tend to think it's worse when their password manager is compromised rather than another software, but the truth is that a troyan in (say) your text editor can very well be used to compromise your device and steal all your passwords. But you are right,…

Oh, and I cannot comment for the software you listed specifically, but I would strongly recommend that you update regularly software you use. Even if they don't create any vulnerability in their own code, they probably use some code dependencies, and it's unlikely that there are never vulnerabilities in any of those (and as per my previous comment, this is true of all software, not only password managers)

Re: Security Issues with LastPass on Android

#53

Post by supernovae »

batch12 wrote: post #19
kevinmgranger wrote: post #14

Earlier quoted context omitted.

> had always been provided for free IIRC, mobile usage _was not_ free, but later became free.

It was free when I signed up.

its 10 bucks a year for family... The change was years ago too. I think its time to get over it.

Re: Security Issues with LastPass on Android

#54

Post by scrollaway »

jfktn5ntkfl wrote: post #24
scrollaway wrote: post #22

Earlier quoted context omitted.

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

Do you think KeePassXC is better than original KeePass?

Absolutely, xc has been far better maintained in the last few years.

Re: Security Issues with LastPass on Android

#55

Post by scrollaway »

sour-taste wrote: post #38
scrollaway wrote: post #22

Earlier quoted context omitted.

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

And how did you come up with this list of 'correct' password managers?

Quite simply through experience.

Re: Security Issues with LastPass on Android

#56

Post by nexuist »

jfktn5ntkfl wrote: post #23

I'm more and more worried about a supply chain attack on LastPass/KeePass. To the point that I'm skittish about upgrading them. It feels to me like we need someone with huge resources, like Microsoft/Gooogle/Apple... to buy them and apply their methods against this attack. For example, where are the binaries built? Who controls the accounts used to upload the installers? Do they regularly pay security teams to try to…

At least on mobile, Apple and Google are in charge of the supply chain, given their control of the App Store, Play Store, and Chrome Web Store. I would assume that apps with very large user bases go through extended vetting and the company accounts are more locked down than individual developer accounts. For example, I doubt any one person has the credentials to log into App Store Connect and publish a new Facebook binary.

Re: Security Issues with LastPass on Android

#58

Post by 2Gkashmiri »

Arainach wrote: post #44
2Gkashmiri wrote: post #16

why can't people just use keepass and be done with it?

Keepass has no multi-user support. Their site admits as much: https://keepass.info/help/base/multiuser.html "Multiple users can log into the same database with the same password" isn't multi-user support. It's important to keep several passwords synchronized between family members and very useful to be able to securely share individual passwords with friends on occasion. Without ACLs and user accounts, this is imposs…

look man. i get it. you want ease of use, the same reason you have "browser sync" capability enabled when you only use your laptop to surf internet. I get it. I have successfully trained my family, over 5 years now to use keepass. they keep one file on their phone, all changes to their logins go into that file and often that file gets dumped to a secure backup. it works. I get the whole excitement about centralized passwords, quick one click logins, zip zip and all but the sad fact is, it takes 2 seconds to copy paste from keepassdroid which is on github if you are concerned about "random developer". without internet access, whats the best this app developer can do? delete files? oh my.

the multi user support is fine but 90 of users have just a bunch of email logins they need to keep rotating. you shouldnt carry your important credentials like bank codes and stuff on live anyways so whats the big deal if you have to remember to rotate a file every 3 months or so? or is that a big deal and being too lazy want to subject yourself to hacks and bugs that will leak data? good luck to you

Re: Security Issues with LastPass on Android

#59

Post by CuriousCosmic »

scrollaway wrote: post #22
Normal_gaussian wrote: post #5

Earlier quoted context omitted.

Thats right, we should blame the victim for trusting the tool. Password managers are increasingly mandated by organisations, and Lastpass is a very common recommendation. Even in the minority of technical users that use this kind of tool I expect small mistakes - like accidentally pasting a password in a URL. A good tool doesn't let you shoot yourself in the foot by escalting that to a non-obvious leak. The password…

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

There's some collaboration features. You can create "keeshares" between multiple separate databases. All the databases can append, update, or read the share.

You can't delete an entry but you can deprecate it and stop updating it (it's not actually feasible to revoke access anyways).

Re: Security Issues with LastPass on Android

#60

Post by scrollaway »

CuriousCosmic wrote: post #59
scrollaway wrote: post #22

Earlier quoted context omitted.

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

There's some collaboration features. You can create "keeshares" between multiple separate databases. All the databases can append, update, or read the share. You can't delete an entry but you can deprecate it and stop updating it (it's not actually feasible to revoke access anyways).

Keeshares seem new, I hadn't heard about them. Seems… interesting. Thanks for pointing them out.
Post reply on HN