Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lastpass Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

551–560 of 587 posts

Re: Lastpass Security Incident

#551

Post by gorgoiler »

marginalia_nu wrote: post #394
gorgoiler wrote: post #341

Earlier quoted context omitted.

Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…

Yeah I'd model it as something like this maybe? public enum Color { RED, BLACK } public enum Suit { Diamonds(RED, '♦'), Hearts(RED, '♥'), Clubs(BLACK, '♣'), Spades(BLACK, '♠'); Color color; char symbol; public Suit(Color color, char symbol) { this.color = color; this.symbol = symbol; } } public enum Rank { Ace('A'), Two('2'), //... } public record Card(Suit suit, Rank rank) { // ... } The question is fundamentally br…

Nice. Very thorough, that’s a more positive take than what I was presenting, though I feel we are both (rightly) being standoffish on the whole inheritance requirement.

Re: Lastpass Security Incident

#552

Post by hackertyper69 »

bboygravity wrote: post #335
joe_guy wrote: post #278

Earlier quoted context omitted.

It's 60 minutes as a very high estimate. You might spend a life time together.

55 minutes to install the tool-chain and libs and 5 minutes to do the coding?

give them a machine to ssh into with env setup already. or a docker container to ssh into on a port other than 22

Re: Lastpass Security Incident

#553

Post by grogenaut »

bawolff wrote: post #220
grogenaut wrote: post #212

Years before these systems came out I thought of building a similar zero trust style system and I realized the level of attack that I would be putting myself under and the insecurity of JavaScript due to extensions, mitm, and client side malware made it ridiculously unpalatable. You would have nation state attackers coming after you as well as your nation state demanding you grant access to them. It felt pretty braze…

> I realized the level of attack that I would be putting myself under and the insecurity of JavaScript due to extensions, mitm, and client side malware made it ridiculously unpalatable This doesn't really make sense. These threats apply equally to people just memorizing and typing in their passwords into web forums. If the user's browser is compromised there is literally nothing to be done.

It doesn't compromise ALL of your passwords in one go, it only gets the ones you type. I don't do my bank or my broker except on my low risk machines with 2fa. But logging into a motorcycle web forum shouldn't leak that password. Having them all in the browser local storage with one master password does.

Re: Lastpass Security Incident

#554

Post by ghosts_ »

gcanyon wrote: post #328
ghosts_ wrote: post #289

Earlier quoted context omitted.

These probably won't replace password managers, just result in passkey managers... Dashlane already supports passkeys & 1password just announced intent to support soon.

How do they "manage" passkeys? There's nothing to manage except your fingerprint/face authentication.

They're essentially certificates, so most implementations will only store them on-device, and most implementations I've seen seem to favor the phone as the device you use.

It really depends on the platform - but in short you'll either need a phone, or be locked into an ecosystem (browser, OS, etc) making using them on multiple devices & browsers difficult or impossible. A password manager supporting passkeys makes this easy as you can 1-click generate a passkey, and 1-click sign-in to services from any device or browser.

Re: Lastpass Security Incident

#555

Post by nijave »

nde wrote: post #139

Is there a better cloud-based alternative to LastPass? I see KeePass being mentioned but I’m not interested in the keeping devices in sync myself.

I've been pretty happy with cloud-hosted Bitwarden. I used 1Password at work on macOS and the form fill didn't seem to work quite as well (that was ~2020-2021 so maybe things have changed)

Not sure about 1Pass on Android, but Bitwarden works very well for me there (much better than Lastpass which afaik required a subscription to use the app)

Re: Lastpass Security Incident

#556

Post by InvaderFizz »

tomjen3 wrote: post #515
InvaderFizz wrote: post #277

Earlier quoted context omitted.

I ask a lot of questions that I preface with: I hope you are slightly insulted by the questions I'm about to ask. They get progressively more complex as we go, but the candidate is fully aware they are filter questions that I hope they clear with zero effort.

Why not just start with the questions you consider the minimum level to clear?

Because my goal isn't usually to get trivia answers. I'm laying foundation and jumping off points for a conversation.

I have some technical hurdles candidates have to clear, but I try to speed run past them and get the background stories on things that stick out to me in their resume. Also, hitting them with the DevOps equivalent of a LC hard right out the gate is a dick move that sets a bad tone and demonstrates a hostile process.

Re: Lastpass Security Incident

#557

Post by Fire-Dragon-DoL »

komadori wrote: post #413
Fire-Dragon-DoL wrote: post #351

Earlier quoted context omitted.

It's packed with enormous amount of bugs that make the day to day experience terrible. I want to move but I'm terrified of the export process

I moved to BitWarden a year ago after a billing problem with LastPass that their support handled badly. I haven't had any problems with the migrated data and I finally deleted my LastPass account last month.

my major concern is that I have:

* custom "items", so instead of "Password", I also have my own * attachments, which I know 100% are not exported. There is a CLI app to help with that, but still horrible * I have large notes with weird characters, which makes me concerned if they will be exported properly * Last time I checked, the CSV seemed very broken (not respecting the standard), I'd be surprised if it imports properly

That's the reason why I haven't moved.

I'd move to bitwarden, but the lack of tags is too much for me. I use tags everywhere, I don't want to deal with directories anymore, so 1Password it is.

Re: Lastpass Security Incident

#558

Post by josephb »

milosmns wrote: post #457
a_c wrote: post #368

Earlier quoted context omitted.

I'm curious what did people migrate to, and is there any feature disparities?

Used BitWarden for years, happy with it. Recently switched to Nord Pass, also happy with it. Not sure about feature disparity though, just mentioning some ideas in case you're researching alternatives.

Any specific reasons for the move away from BitWarden, or move to Nord Pass?

Re: Lastpass Security Incident

#559

Post by 656565656565 »

mankyd wrote: post #50
mushufasa wrote: post #31

Can someone in the know comment here on the succinct and honest scope of breach of passwords stored by LastPass users?

They're encrypted/decrypted by the user's password locally in the app or extension.

Exactly what I thought too but there appears to be a lot of dislike for LastPass on HN and I’m not seeing any evidence to back it up, perhaps it’s just a dislike for cloud based solutions

Re: Lastpass Security Incident

#560

Post by marginalia_nu »

twobitshifter wrote: post #462
gorgoiler wrote: post #341

Earlier quoted context omitted.

Sounds silly, it’s a shame you didn’t get past the initial screen. It’s a process that has to be humored and you could have added a lot of value just by joining and then patching their hiring process. When I was teaching in high school the deck-modelling thing is one that the kids come up with a lot especially when it came to doing their term project. I love the idea of being asked to implement a deck of cards using…

Some other things you could do with a deck of cards to add useful functions. Shuffle Draw Deal Cut Pile Turn Now imagine you have pinocle uno and cribbage as games. they each start with a different set of cards, but can use the functions above. The fact that it’s a 52 card deck with suits and ranks isn’t stated by GP, and there’s also the optional jokers. For a real game, you’d probably need the back of cards as well…

To be fair, none of the functions you listed, as far as I can tell, need to know anything about what they're operating on. You can implement all but the last on a generic list of objects.

The last I'd probably implement as a container object Turnable that adds an orientation state to any parametrized type, including Reversi disks.

I feel the card itself should be immutable as far as possible. It's state: orientation, owner, location and whether it's dog-eared should be kept separately.

Post reply on HN