Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What’s in a PR statement: LastPass breach explained

palant.info

Post reply on HN
Print view View original

51–60 of 292 posts

Re: What’s in a PR statement: LastPass breach explained

#51

Post by leni536 »

bikeformind wrote: post #32

Catastrophic breach after catastrophic breach since 2011. Lastpass has failed their fiduciary duty as a steward of sensitive information and IMO exhibited gross negligence in not encrypting URI data, ostensibly as a trade off for consumer functionality. not to be overly vindictive, as I understand the near impossibility of running a perfectly secure service at absolutely enormous scale…but does anyone else feel LastP…

They could might as well dissolve the whole company. Most, if not all of their products are very security sensitive.

Re: What’s in a PR statement: LastPass breach explained

#52

Post by _Algernon_ »

tex0 wrote: post #33

Why did people think that using a cloud based password manager (or for that matter: a closed source one) was ever a good idea?

This contributes nothing to the discussion, except giving you a reason to feel better than others for arbitrary reasons.

Re: What’s in a PR statement: LastPass breach explained

#53

Post by revskill »

I'm not sure about the insight. But i hate the UI, UX of Lastpass. Why it's so hard to change for simplicty and ease of use ? Is it dark pattern, is it technically impossible due to technical architectural complexity, or tech debt,.. ?

At least the UI tells me something about the internal.

Re: What’s in a PR statement: LastPass breach explained

#54

Post by gregmac »

prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

I see a few things that might be worth adding, as some were explicitly why I switched from LastPass a few years ago:

* Security model. What is stored server-side unencrypted? In what circumstances is the server-side encrypted data available on the server in plaintext?

* Defaults: "parent-safe"? What trade-offs are made with the defaults picked?

* Ability to edit (Android) app associations. Bitwarden has this, and it solved a huge problem I had with duplicates on LastPass. There's URI entries like androidapp://com.example.app that are easy to manually merge and keep together with corresponding web sites.

* Domain matching. Bitwarden can do: base, host, exact, starts with, or regex. Lastpass had an "equivalent domains" managed from obscure settings, which never really worked the way I wanted. I used to have a billion entries for things in .mydomain.com, but bitwarden fixes this and by setting that flag properly I get only relevant things for each internal app. At the same time, for .myapp.com and .myapp.local I can get the default dev login, so when I deploy a new instance/tenant for dev, it "just works".

Username generation. Can it do plus-addresses? Catch-all domains?

Re: What’s in a PR statement: LastPass breach explained

#55

Post by prepend »

It would be interesting to hear people’s life philosophy in this area.

For me, lastpass always seemed like a bad idea as passwords are very important to me and giving someone else a copy of my passwords seems like a bad idea. Similarly, I don’t let any services know my bank passwords even if they super promise to protect them and not misuse them.

Another similar seeming task that I can’t delegate is to read my bank statements and keep track of my assets and performance.

This isn’t meant to shame people who are now at risk from lastpass’ failure, but to understand if HN readers have similar personal habits and rules.

Re: What’s in a PR statement: LastPass breach explained

#56

Post by bertman »

neonsunset wrote: post #24
betaby wrote: post #20

For non-tech-savvy people - https://www.amazon.ca/Password-Book-Alphabetical-Colorful-Le... For tech-savvy people - https://www.passwordstore.org/ The rest doesn't work unfortunately, proven over and over.

Self-hosted instance of Bitwarden works pretty well, and you can make it accessible behind a VPN to your local network only (plus there are multiple implementations of its back-end). Less-automated solutions make impractical concessions in usability. Reference impl. in C#: https://github.com/bitwarden/server Self-host friendly impl. in Rust: https://github.com/dani-garcia/vaultwarden p.s.: reference implementation is…

I always found running 12 containers for hosting a password repository a bit overkill.

https://bitwarden.com/help/install-on-premise-linux/

Re: What’s in a PR statement: LastPass breach explained

#57

Post by dml2135 »

mrstone wrote: post #38

Incredibly pathetic. I am so disappointed in LastPass. I was willing to forgive their subpar UX because hey, at least my passwords were safe. I've moved over to Bitwarden and am happy for now, but man what a shitshow.

Same, I held onto Lastpass much longer than I would have put up with any less-essential SaaS product.

Finally moved to Bitwarden and couldn't be happier. Still trying to decide if I want to self-host it or not, but more breaches of cloud-based password managers like this one may push me in that direction.

Re: What’s in a PR statement: LastPass breach explained

#58

Post by dahart »

palant wrote: post #28
johndhi wrote: post #13

The know it all tone of this article is kind of annoying. Security professionals seem to have a common trait of thinking they know better. Some good points in there, but limited pragmatism.

Disclaimer : I am the author of this article. What kind of pragmatism would you prefer? LastPass messed up way more than they are willing to admit. And it’s not like nobody warned them before, quite a few of the issues which turn out to be very problematic now aren’t news – I brought them up years ago as did others. LastPass should be warning users now and suggesting mitigation steps, instead they claim that nobody h…

This is a compelling article, I feel more motivated now to reconsider my options. FWIW, my $0.02 feedback on pragmatism: as a user, it would be nice to have more what-to-do-about-it for non-security-experts. Also I didn’t love the parts of the article where you speculated about LastPass’ motivations and process (even if they turn out to be true!) The opening paragraph is making assumptions about the timing, which could backfire pretty badly if you’re wrong. You also speculated about the web site storing master passwords, justified by saying “they absolutely could, and you wouldn’t even notice.” They could do a lot of things, including selling passwords to the highest bidder. From my non-expert point of view, it’d be more helpful & pragmatic to stick to known facts and not whip additional fear into what is most definitely a bad situation.

Re: What’s in a PR statement: LastPass breach explained

#60

Post by rkagerer »

prettyStandard wrote: post #2

I wasn't quite ready to self promote this but I will go ahead anyway, since people are probably researching alternatives now. I'm working on a comparison of different password managers. https://password-manager.soft-wa.re/ At this point it's mainly a fork&merge of some previous work. If you find any issues with the data please submit a PR. Edit: I am standing on the shoulders of giants. Take a look at the contributor…

This is helpful. Would love to see KeePass and its variants on here.
Post reply on HN