Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did LastPass master passwords get compromised?

palant.info

Post reply on HN
Print view View original

51–60 of 189 posts

Re: How did LastPass master passwords get compromised?

#51

Post by chrisfosterelli »

8organicbits wrote: post #16
SloopJon wrote: post #12

The article suggests that hashing (PBKDF2) is done client-side only, and that LastPass stores this hash directly. If true, this is very bad. However, LastPass claims that PBKDF2 is also used server side: > We then take that value, and use a salt (a random string per user) and do another 100,000 rounds of hashing, and compare that to what is in our database. https://blog.lastpass.com/2015/06/lastpass-security-notice/…

I wish there was a good way to implement this sort of double hashing in web apps. Doing the extra salted hash client side ensures that the value the server sees is globally unique, even when the user is reusing passwords across sites. Unfortunately the only way I know how to implement that is to have the server send JS down to the browser that instructs it to perform the hashing. For certain types of compromises serv…

There's little security advantage to doing this other than some obscurity, because a well informed attacker can still implement all the same attacks:

* An attacker with access to the database will know they can reduce the "hashing algorithm" to two sequential hashing algorithms and still bruteforce a series of plaintext passwords to check to see if the hash matches what is in the database.

* An attacker with access to the plaintext network communications or app server can just store and replay the second hash to login

* An attacker with access to the client machine can grab the plaintext password still

Lastpass does this is for end-to-end encryption reasons, where it is useful, but for standard apps I don't think it would be.

Re: How did LastPass master passwords get compromised?

#52

Post by twicetwice »

md_ wrote: post #41
SavantIdiot wrote: post #31

Earlier quoted context omitted.

This argument has never made sense to me. Keeping an encrypted password file in the cloud or locally makes no difference. There exists no computer system than can crack an AES256 encrypted document. The weaknesses are in the protocol. Storing the encrypted database in the cloud and downloading it is the same as storing it locally if the decryption protocol is performed locally. If the decryption was done in the cloud…

> There exists no computer system than can crack an AES256 encrypted document. The weaknesses are in the protocol. Well, or in the human-chosen passphrase. There are plenty of systems that can brute force an 8-character alphanumeric password run through PBKDF2 for 100,000 rounds. Per https://support.1password.com/pbkdf2/ , that costs...about $60k. So keeping the ciphertext safe is in fact a very reasonable precaution…

I simply use a 40ish character passphrase. My primary attack vectors are keyloggers/local malware and browser/extension vulnerabilities, which also apply to a local ciphertext.

Re: How did LastPass master passwords get compromised?

#53

Post by stingraycharles »

chrisfosterelli wrote: post #45
stingraycharles wrote: post #23

Earlier quoted context omitted.

Which to me begs the question: then why hash client-side at all? What are the threats it protects against?

This sort of scheme is common so that you do not have to share the encryption key with the provider. You derive two keys from your plaintext password: one used for authentication and one used for encrypting / decrypting the blob. This way, Lastpass can authenticate you without having to see the key to decrypt your data. Not sure the specifics of how lastpass implements this but this is a really common approach for en…

Oh I see, so the master password is like a seed for multiple things: the password hash, but also e2e encrypting the passwords.

That makes complete sense, thank you for the answer.

Re: How did LastPass master passwords get compromised?

#54

Post by SavantIdiot »

md_ wrote: post #41
SavantIdiot wrote: post #31

Earlier quoted context omitted.

This argument has never made sense to me. Keeping an encrypted password file in the cloud or locally makes no difference. There exists no computer system than can crack an AES256 encrypted document. The weaknesses are in the protocol. Storing the encrypted database in the cloud and downloading it is the same as storing it locally if the decryption protocol is performed locally. If the decryption was done in the cloud…

> There exists no computer system than can crack an AES256 encrypted document. The weaknesses are in the protocol. Well, or in the human-chosen passphrase. There are plenty of systems that can brute force an 8-character alphanumeric password run through PBKDF2 for 100,000 rounds. Per https://support.1password.com/pbkdf2/ , that costs...about $60k. So keeping the ciphertext safe is in fact a very reasonable precaution…

You are correct: if the password used to create the key is trivial, then there definitely exists hardware that can guess AES256 passwords even if a KDF is used weakly.

I'm not sure how to read that table. Is that really the cost for a 100,000 iteration PBKDF2?!?

Re: How did LastPass master passwords get compromised?

#56

Post by chrisfosterelli »

stingraycharles wrote: post #53
chrisfosterelli wrote: post #45

Earlier quoted context omitted.

This sort of scheme is common so that you do not have to share the encryption key with the provider. You derive two keys from your plaintext password: one used for authentication and one used for encrypting / decrypting the blob. This way, Lastpass can authenticate you without having to see the key to decrypt your data. Not sure the specifics of how lastpass implements this but this is a really common approach for en…

Oh I see, so the master password is like a seed for multiple things: the password hash, but also e2e encrypting the passwords. That makes complete sense, thank you for the answer.

No problem! If anyone is curious for more on this pattern, Firefox Sync had a great blog post breaking down their implementation: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

Re: How did LastPass master passwords get compromised?

#57

Post by rexreed »

Out of curiosity the meaning of "credential stuffing" doesn't jibe with what I would assume the term would mean. Why isn't the more obvious "password reuse" term not preferred? I would assume credential stuffing would mean something to do with pushing a bunch of credentials into a system and overloading the credential system somehow, rather than simply being "reusing a password that was found on a third party site".

Re: How did LastPass master passwords get compromised?

#58

Post by yuliyp »

chrisfosterelli wrote: post #51
8organicbits wrote: post #16

Earlier quoted context omitted.

I wish there was a good way to implement this sort of double hashing in web apps. Doing the extra salted hash client side ensures that the value the server sees is globally unique, even when the user is reusing passwords across sites. Unfortunately the only way I know how to implement that is to have the server send JS down to the browser that instructs it to perform the hashing. For certain types of compromises serv…

There's little security advantage to doing this other than some obscurity, because a well informed attacker can still implement all the same attacks: * An attacker with access to the database will know they can reduce the "hashing algorithm" to two sequential hashing algorithms and still bruteforce a series of plaintext passwords to check to see if the hash matches what is in the database. * An attacker with access t…

It does prevent inadvertent logging of passwords, though: no piece of software on the server side will have the user's password in memory at any point. Which does mean the user's actual password (if they're reusing passwords) stays more secure (by "more secure" I mean "has a lower probability of leaking to a malicious actor", not necessarily "has some additional security properties").

Re: How did LastPass master passwords get compromised?

#59

Post by shkkmo »

md_ wrote: post #37
_aavaa_ wrote: post #27

Earlier quoted context omitted.

That statement is too squirrelly for me to trust if my passwords were stored with them. “SOME of these security alerts” “were LIKELY triggered” “HAS BEEN solved” (Emphasis mine) How can the issue be definitely solved if you aren’t sure that they were actually triggered in error, if they were in error then it’s only some of them.

It's easy for me to imagine how you get here. - Eng are still writing the postmortem - Marketing want to put out a statement - Eng know or suspect a bug exists that can trigger spurious notifications, but don't have sufficient logs to be able to reconstruct if that bug was in fact in play in production - Legal advises not to say anything definitive that they can't stand behind later I don't see any of that as particu…

Then why not say:

"We have identified and fixed bugs that could result in incorrect masterpassword use notifications being sent but we have not yet been able to determine which if any of the recent wave of notifications were caused by those bugs. We are still investigating the issue".

Instead of communicating clearly around a serious security incident they are using mealy mouthed PR speak which does nothing to improve their image.

Re: How did LastPass master passwords get compromised?

#60

Post by tibbetts »

mgraczyk wrote: post #34
willis936 wrote: post #28

Earlier quoted context omitted.

Which is exactly what you say when facing an existential crisis. If you have a master password leak you either: 1. lie about it and the truth never comes to light 2. lie about it and get caught and the consequences are the same as if you came clean If LP suffered a master password leak then there is no benefit to telling the truth.

One advantage of telling the truth is that you don't go to prison for fraud. When evaluating this kind of conspiracy theory, it's important to consider the number of people who would have to remain silent for the conspiracy to survive, and to consider how much it would cost to keep that many people silent. In this case, it's at least a few dozen so I think it's fair to assume that such a lie would not survive very lo…

A few dozen, most of whom took a job at a security firm and one might imagine are the type reluctant to maintain a lie like this.
Post reply on HN