Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds Link Cyberheist to 2022 LastPass Hacks

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 266 posts

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#51

Post by ipaddr »

BSOhealth wrote: post #40
anonym29 wrote: post #16

Earlier quoted context omitted.

Bitcoin has never been hacked. The victims did not practice proper key management. The victims got hacked because of their own insecure key management, not because of any vulnerability in Bitcoin. To claim otherwise is like claiming that because people can steal improperly secured code signing or TLS certificate private keys, all code signing and TLS certificates are inherently, fundamentally, and automatically broke…

Has the dollar been hacked?

Yes. Printing money.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#52

Post by panick21_ »

dathery wrote: post #29
colechristensen wrote: post #22

Earlier quoted context omitted.

I was under the impression that basically lastpass knew your password, 1password does not. Lastpass owned the whole key. With enterprise organizations though we can still reset a users password if they forget so 1password might “know” your password too. Maybe older versions or individual versions are more secure.

It would probably be more accurate to say that LastPass has the information to decrypt your vault if they can guess your password. By contrast 1Password would need to both guess your password and guess your personal secret key. The latter is effectively impossible assuming the key generation was well-implemented. The trade-off is that users must keep track of their own secret keys.

What if in lastpass you have 2FA?

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#53

Post by BSOhealth »

ipaddr wrote: post #51
BSOhealth wrote: post #40

Earlier quoted context omitted.

Has the dollar been hacked?

Yes. Printing money.

“Store of value”

To the moon.

Still grateful HN has enough crypto rationalists to push back on pyramid scheme noise.

Crypto could be useful — let’s build crypto apps with customer value.

Right now the customers are morally ambiguous nation states and criminals laundering money into real estate and back into fiat currency. Hold the bag.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#54

Post by makeitdouble »

chinathrow wrote: post #2

Me, looking at my local KeepassXC, calm, sticking with it.

This is the kind of control that is really becoming a luxury.

And I don't know how we get back to a simple state; Let's say you're a family of three with shared services and accounts:

Keeping everything under Keepass means handling the file sync between all the devices and OSes, with potentially your credentials flying through third party sync services, thus negating most of the advantages of Keepass.

Moving to something like a self-hosted Bitwarden instance should be the way, but then one member of the family becomes a dedicated lifetime sysop making sure that instance is secure while being accessible anytime from everywhere.

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#55

Post by yieldcrv »

CaffeineLD50 wrote: post #25
QuiDortDine wrote: post #4

Stick your passwords in the cloud, they said, nothing could go wrong they said.

Lol. I heard someone say that that the cloud was just someone else's data center behind an API but did people listen? Nope.

someone else’s computer

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#56

Post by yieldcrv »

koolba wrote: post #32
CaffeineLD50 wrote: post #24

LastPass understandably finds there to be no evidence linking the two. Uhm, OK. But what's also hard to believe is that people storing millions of dollars of "collectables" would not change their passwords on at least a yearly basis. I know that password rotation for its own sake is no longer best practice, but in this case it still seems quite prudent. No?

You can’t change the seed phrase for a derived wallet. You’d have to create a new one and transfer the assets.

glad to see the crypto discussion here getting more nuanced and technical

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#58

Post by yieldcrv »

tpurves wrote: post #23
anonym29 wrote: post #16

Earlier quoted context omitted.

Bitcoin has never been hacked. The victims did not practice proper key management. The victims got hacked because of their own insecure key management, not because of any vulnerability in Bitcoin. To claim otherwise is like claiming that because people can steal improperly secured code signing or TLS certificate private keys, all code signing and TLS certificates are inherently, fundamentally, and automatically broke…

You know what every other online money transfer mechanism has? An ability to reverse transactions in the case or error or fraud. Because those things happen all of the time.

> An ability to reverse transactions in the case or error or fraud

Yes and that bug is a risk I weigh when using those money transfer mechanisms

When it fits my risk profile I engage in that transaction

Not hard

Not a matter for an industry regulator or state

Just pure market choice

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#59

Post by joshstrange »

725686 wrote: post #49
naet wrote: post #48

What do security minded people do about passwords? It seems like you either use the same password for everything, or you need some kind of password manager, but then I'm always worried about having all my passwords in one place meaning they all get compromised instead of just one. It also feels like there's a convenience tradeoff with a lot of solutions. I could keep a physical binder full of passwords in my home off…

I use a simple algorithm. So you don't actually remember the password, put the algorithm to produce the password for the site or service. Not perfect, but each passwords turns out to be unique (mostly). I don't know what experts think about that, but it has worked fine for me.

The problems with this method are numerous:

* If 1 to N password(s) leak the pattern may be obvious leading to your other accounts being compromised

* Not all sites have the same password “rules” so there is no algorithm that works for all passwords without you being aware of the rules of the given site. Rules that only you only (may) have access to at signup time.

* Typing passwords out manually sucks (slow and error prone)

Re: Feds Link Cyberheist to 2022 LastPass Hacks

#60

Post by JadoJodo »

I switched away from LastPass after the 2nd major security breach sometime around 2013. Wikipedia only shows 3 total incidents, but I know I've seen reporting on _at least_ 5 between 2010 and today. In that time, I've continued to run into its use at companies, and it's honestly surprised me each time. Something something fool me 5x…
Post reply on HN