51–60 of 141 posts
I'm guessing nation-state because it seems they stole some source code/R&D. I'd guess China. That's their entire MO. Further the Chinese economy by any means necessary. Why waste years and millions on R&D when you can just steal it?
https://www.cbsnews.com/news/chinese-hackers-took-trillions-...
Get into their dev env (ideally unnoticed), exfiltrate the sensitive code you need, poke around their systems. Once you’ve got a handle on their code and have figured out what to add, do so and just begin the waiting game.
Maybe that’s all happened, and this attack is “air cover” for the last-stage.
Earlier quoted context omitted.
If the password journal my mom left at my house while visiting is any indication: absolutely not. Use a password manager, remember a 2nd password for your email yourself, and then use a second factor for as many things as possible. USB keys are best, but anything is better than nothing: SMS, Authy, Google Authenticator, phone call, whatever. Chrome and Safari both have password managers these days, and some Chromeboo…
People like to dunk on the password journal but I find it hard to believe that someone is going to break in to your mom's house as the way to access her bank or facebook account. It's a horrible idea to leave the password for the database sitting next to the admin's workstation. But physical access is a vastly different concern for a corporation than an individual. Threat surfaces are different for different people.…
Earlier quoted context omitted.
No, but there are easy-to-use, reliable and secure solutions, such as Bitwarden.
I don't particularly see why Bitwarden would be any better at defending against this kind of attack, unless you're talking about self-hosting (and I would trust a hosted service more than a non-technical person self-hosting in this case).
Self hosting can help insulate you from a server side bulk compromise (with adequate security measures in place yourself which, as you say, not everyone will do), but it won't deal with the more pervasive software supply chain issues of compromised development environments etc.
I wonder if this was nation-state backed hackers or just some rando. I'm guessing nation-state because it seems they stole some source code/R&D. I'd guess China. That's their entire MO. Further the Chinese economy by any means necessary. Why waste years and millions on R&D when you can just steal it? https://www.cbsnews.com/news/chinese-hackers-took-trillions-...
For something like a password manager using client side crypto, compromising the software supply chain of the client is an interesting proposition for an attacker.
Earlier quoted context omitted.
Not sure I follow. As stated in the article LastPass does not have the "key" (Master Password) in this case, so a straightforward reading of your comment suggests there's nothing to be worried about here. However I think what you're saying is that even trusting encrypted bundles of secrets to third parties is a bad idea? Even on this point I have to disagree because that's precisely what 2FA is for. Even if LastPass…
I thought the 2FA all the big services have is so that they will deliver you your encrypted vault, rather than another layer of encryption? (I know FIDO can theoretically do that, but AFAIK it really wasn't designed for it). The threat isn't the service having the encrypted vault anyway; we kind of trust the encryption to be decent (though of course you can't know what technological threats are looming). The real thr…
Correct, 2FA is protection in addition to your password manager. So if someone gets your unsealed vault they cannot log into any services without also compromising your second factor. 2FA is not for further cryptographic hardening of the vault itself.
> The real threat is that you're putting your password for decryption into a proprietary blob with an internet connection and auto-updates enabled. It might be sending your password random places now or maybe at some later point.
If you use Chrome and Safari your passwords are going through a proprietary blob with an internet connection and auto-updates enabled. If you use extensions for your browser they likely can steal all of your passwords.
Nothing can protect you if you don't trust any of the code you're putting your secrets into, although 2FA with some USB devices cover a mind boggling range of threats. A keylogger and screen capture combined wouldn't be sufficient to bypass them.
> Note that even a source-available password manager doesn't really solve this issue if it's not self compiled
Are you compiling your browser from source after verifying every line of code it contains? If so what makes you think you can trust your compiler?
You have to trust something. Choose your threat model. Choose your risks. Live your life.
I wonder if this was nation-state backed hackers or just some rando. I'm guessing nation-state because it seems they stole some source code/R&D. I'd guess China. That's their entire MO. Further the Chinese economy by any means necessary. Why waste years and millions on R&D when you can just steal it? https://www.cbsnews.com/news/chinese-hackers-took-trillions-...
https://www.france24.com/en/20110104-france-industrial-espio...
Earlier quoted context omitted.
My problem is that as an unskilled person - will I be any better at securing my own system?
If the password journal my mom left at my house while visiting is any indication: absolutely not. Use a password manager, remember a 2nd password for your email yourself, and then use a second factor for as many things as possible. USB keys are best, but anything is better than nothing: SMS, Authy, Google Authenticator, phone call, whatever. Chrome and Safari both have password managers these days, and some Chromeboo…
Earlier quoted context omitted.
Not sure I follow. As stated in the article LastPass does not have the "key" (Master Password) in this case, so a straightforward reading of your comment suggests there's nothing to be worried about here. However I think what you're saying is that even trusting encrypted bundles of secrets to third parties is a bad idea? Even on this point I have to disagree because that's precisely what 2FA is for. Even if LastPass…
I thought the 2FA all the big services have is so that they will deliver you your encrypted vault, rather than another layer of encryption? (I know FIDO can theoretically do that, but AFAIK it really wasn't designed for it). The threat isn't the service having the encrypted vault anyway; we kind of trust the encryption to be decent (though of course you can't know what technological threats are looming). The real thr…
TOTP is based on a shared secret that client and server both know (so inherently a compromised server can just skip it). For webauthn and similar, the token will sign a specific challenge, incorporating the site name and a counter value etc. The server stores the public key, but the check can be disabled.
The real risk is the auto updating client and the integrity and supply chain of the code it runs - unless you actually audit the client code, there's limited value in compiling it yourself. If the attacker can ship you a compromised signed binary, assuming the company is competent in their setup, they've compromised a development environment, code review environment, code signing environment, perhaps a CI/CD and testing environment, and then the release distribution environment. To get you to compile and install their dodgy source only requires a compromise of their development environment, as very few organisations will slow down their routine development cycle enough to add significant barriers to this one layer being compromised (as it has to be done for every commit checked in, every dependency changed, etc.)
Lesspass generates reproducible unique passwords from inputs (username, domain, masterpassword). It works without an internet connection and is open source. You only need their cloud storage if you want to backup metadata about the password requirements for specific sites (i.e, no special chars allowed by foo.com, bar.com requires a capital letter and a number, etc.) This metadata can also be stored locally. The comm…
in all seriousness, Lesspass has a cool concept (I hadn't heard of them before, just looked at their website now). I'd be interested in hearing what cryptography/security experts think about it.