Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

51–60 of 326 posts

Re: LastPass users warned their master passwords are compromised

#51

Post by _jal »

twostorytower wrote: post #17

Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.

Nope.

Keeping my secrets store on someone else's computer is simply not compatible with my threat model.

Yes, they say it is encrypted, and I believe them and believe they're competent.

But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.

Re: LastPass users warned their master passwords are compromised

#52

Post by gruez »

Barrin92 wrote: post #5
smegsicle wrote: post #2

related: Ask HN: How did my LastPass master password get leaked? https://news.ycombinator.com/item?id=29705957

all the speculation in that thread about how the password could have been leaked reminded me of a post earlier this year that drastically changed my view on password managers. (also generated a lot of discussion here) https://news.ycombinator.com/item?id=27407603

Seems like the lesson there is to use a standalone password manager, rather than one that's a browser extension?

Re: LastPass users warned their master passwords are compromised

#54

Post by ksec »

bryan0 wrote: post #7

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. Must be a compromised browser extension at this point. > To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after c…

>Must be a compromised browser extension at this point.

The previous thread had password never typed, copied or used for years. Unless we are talking about multiple vector, otherwise browser extension doesn't fit most of the reported scenario.

Re: LastPass users warned their master passwords are compromised

#55

Post by gkoberger »

vorpalhex wrote: post #49
gkoberger wrote: post #35

This is framed so negatively toward LastPass, which is unfortunate. They stopped all usage of correct passwords they believed were compromised, which is exactly what I'd want them to do in this situation. Them warning users their master passwords are compromised is a good thing! Yet it's framed as though they're admitting to something. "However, users receiving these warnings have stated that their passwords are uniq…

LastPass has had enough other security issues that I am doubtful of them to this day. https://www.mcafee.com/blogs/enterprise/cloud-security/lastp... Unfortunately the only password solutions I would recommend at this point are 1Password for something turn key, and BitWarden if you want to self host.

Agreed, and I highly recommend 1Password. But just because they've had problems in the past doesn't mean the framing of this article is fair. The title made me think everyone's passwords were compromised due to a leak or hack, when in reality the article is a rehash of a HN post from yesterday.

Re: LastPass users warned their master passwords are compromised

#56

Post by politelemon »

_jal wrote: post #51
twostorytower wrote: post #17

Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.

Nope. Keeping my secrets store on someone else's computer is simply not compatible with my threat model. Yes, they say it is encrypted, and I believe them and believe they're competent. But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.

Agree. Moving from one proprietary online solution to another proprietary online solution isn't the answer.

Re: LastPass users warned their master passwords are compromised

#57

Post by ksec »

gkoberger wrote: post #35

This is framed so negatively toward LastPass, which is unfortunate. They stopped all usage of correct passwords they believed were compromised, which is exactly what I'd want them to do in this situation. Them warning users their master passwords are compromised is a good thing! Yet it's framed as though they're admitting to something. "However, users receiving these warnings have stated that their passwords are uniq…

>Since there only seems to be 2-3 reports of this, and they're self-reported and not cited, it doesn't seem like LastPass was compromised.

There are now over 20 in the original HN [1] thread. ( Excluding reports from Reddit and Twitter ) From password never used since 2017 to account newly created in the past few months. OP has full Bio, Links and Credential, others have long history on HN and karma points. I did at one point suspected a PR attack on Lastpass, ( sorry guys ) but that is somewhat unlikely.

Of course, this doesn't rule out a malware running wild.

[1] https://news.ycombinator.com/item?id=29705957

Re: LastPass users warned their master passwords are compromised

#58

Post by Isthatablackgsd »

Krasnol wrote: post #3

Let this be your Last non-selfhosted Pass solution.

Selfhosting solution is not always the answer. It can be effective if everyone knows how to set it up. However, I imagine 90% (I want to say 99.99%) of world population don't have knowledge or the skill to set it up.

I tried selfhosting in the past and it is painful process to set it up since I don't have an experience with it and the documentations on selfhosting are barely minimal. I tried selfhost an RSS Reader (FreshRSS) through webserver that are closed off to the public network. It is rewarding BUT frustrating experience for me beacuse of how much it needs to be functional. And don't forget the difficulty of setting up a CA for the HTTPS (SSL/TLS), it is PITA to set it up and it kept having problems. I am considering Caddy server since it generates its own CA automatically. Their documentation are not beginner-friendly and requires some prior knowledge to set it up.

Re: LastPass users warned their master passwords are compromised

#59

Post by akho »

Krasnol wrote: post #3

Let this be your Last non-selfhosted Pass solution.

Self-hosting is slightly better as you are not creating a honeypot. But it’s not inherently more secure against client-side attacks (browser extensions, mobile apps), and adds its own attack vectors (put a contaminated version on DockerHub).

I still self-host.

Re: LastPass users warned their master passwords are compromised

#60

Post by exlurker »

julianlam wrote: post #19
qzx_pierri wrote: post #13

Earlier quoted context omitted.

My setup: - Windows Desktop - Macbook Air I installed Keepass on my windows desktop along with iCloud drive sync. I keep my Keepass database in my iCloud directory. I can now use this Keepass database on my iPhone (via Files app), on my Macbook (iCloud Drive). Any changes made are automatically synced daily. Is that really too difficult? And yes, it does "just work". Bonus: Any passwords stored in my iCloud Keychain…

For what it's worth, my attempt at using Keepass drove me away because the password database kept becoming conflicted, necessitating a merge. Keepass' options for dealing with conflicts were to "accept mine" or "accept theirs", but I'd often end up in situations where the conflict went sideways and I lost my login completely. In the end I was running the conflict resolution command once every couple days. Normally I…

This used to be a problem for me too, but later versions of Keepass happily syncs any conflicting databases. I use Syncthing to share my database.
Post reply on HN