LastPass’ Authenticator app is not secure • Hacker News Board

Re: LastPass’ Authenticator app is not secure

#61

Post by derimagia » Wed, Dec 27, 2017, 5:52 PM UTC

BearGoesChirp wrote: post #51

ComputerGuru wrote: post #20

The code, tech, and mindset behind LastPass is a joke. They started just after the “dark ages” of security but don’t seem to have upgraded their mental model of security since. I’ll share with you the moment I discovered something that made me cancel my schedule for the day, research alternatives, write a LastPass to 1Password converter [0], and cancel my LastPass account and subscription. Are you ready? You log in t…

Electronic password managers never made sense to me. While you can do more to secure a single target, it is a more valuable target and one mistake costs you all your passwords. For me a physical password journal is best. While it does make you vulnerable to physical attackers, the cost invest to target someone physically is so much higher that if I have to deal with that threat level I'm already a goner. Just have to…

Does make it more vulnerable to things like keylogging - electronic managers skip typing completely. Also it makes people create simpler passwords than they would if it was electronic and becomes pretty unmanageable with a large amount of passwords.

I'm not saying it's the wrong way to go but if electronic password managers "never made sense" then I feel like you don't have the entire picture.

Re: LastPass’ Authenticator app is not secure

#62

Post by david-cako » Wed, Dec 27, 2017, 5:54 PM UTC

UncleMeat wrote: post #53

david-cako wrote: post #2

Wow, color me surprised. Software developers aren't perfect, and closed source software with less eyes on it tends to be even less perfect. I will never trust my passwords all being in one place other than my brain.

This "problem" has precisely nothing to do with open source vs closed source. "Tell me the list of activities that are public" and "tell me the name of each activity as I launch it" are babies-first-app-analysis level and work equally well on open and closed source apps. Are we really concerned about an exploit that requires somebody to have unlocked access to your phone?

I'm not saying that's the problem, I'm just suggesting that you have to have a lot of faith in a company to trust it with all of your passwords, especially when there's only a handful of eyes on its source code.

It's not for me, personally.

And yes, because the scariest aspect of password managers is the fact that you have basically shifted the responsibility of "I use the same password everywhere" to a different party.

Re: LastPass’ Authenticator app is not secure

#63

Post by ComputerGuru » Wed, Dec 27, 2017, 5:54 PM UTC

BearGoesChirp wrote: post #51

ComputerGuru wrote: post #20

The code, tech, and mindset behind LastPass is a joke. They started just after the “dark ages” of security but don’t seem to have upgraded their mental model of security since. I’ll share with you the moment I discovered something that made me cancel my schedule for the day, research alternatives, write a LastPass to 1Password converter [0], and cancel my LastPass account and subscription. Are you ready? You log in t…

Electronic password managers never made sense to me. While you can do more to secure a single target, it is a more valuable target and one mistake costs you all your passwords. For me a physical password journal is best. While it does make you vulnerable to physical attackers, the cost invest to target someone physically is so much higher that if I have to deal with that threat level I'm already a goner. Just have to…

The only drawback to that is the difficulty of logging in while out of the house (I understand making priority accounts “on site access only” but what about others?) and the fact that you’re deincentivized from making more secure passwords because (even if only subconsciously) you’re going to have to type in all those characters and symbols each time you want to log in.

I think the biggest security failure is session cookies that expire too quickly or too eagerly. Having people need to enter their password so often is more dangerous than keeping them logged in (from the same IP) for a longer period of time.

If my bank would keep me authorized for basic access (review transactions, pay bills, transfer money between own accounts) without logging in each time, but required a password to add a payee or make changes to the account, I’d keep the password in a journal in a safe.

Re: LastPass’ Authenticator app is not secure

#64

Post by ComputerGuru » Wed, Dec 27, 2017, 5:56 PM UTC

derimagia wrote: post #61

BearGoesChirp wrote: post #51

Earlier quoted context omitted.

Electronic password managers never made sense to me. While you can do more to secure a single target, it is a more valuable target and one mistake costs you all your passwords. For me a physical password journal is best. While it does make you vulnerable to physical attackers, the cost invest to target someone physically is so much higher that if I have to deal with that threat level I'm already a goner. Just have to…

Does make it more vulnerable to things like keylogging - electronic managers skip typing completely. Also it makes people create simpler passwords than they would if it was electronic and becomes pretty unmanageable with a large amount of passwords. I'm not saying it's the wrong way to go but if electronic password managers "never made sense" then I feel like you don't have the entire picture.

I think the threat from keyloggers is not as severe as the threat from clipboard scrapers. Apple and Google absolutely need to make a secure password transport mechanism to allow one app to fill a field in a web browser or field in another app that does not rely on the clipboard because even just expiring it after n seconds is not secure enough.

Re: LastPass’ Authenticator app is not secure

#65

Post by zupzupper » Wed, Dec 27, 2017, 5:56 PM UTC

LastPass produces two apps, the Password Manager and this Authenticator App, which looks like a 2FA competitor to Google Authenticator.

The bug the article is detailing is in the Authenticator application, not the Password Manager application, which wasn't very clear to me on my first read.

Re: LastPass’ Authenticator app is not secure

#66

Post by craftyguy » Wed, Dec 27, 2017, 5:57 PM UTC

strictnein wrote: post #24

craftyguy wrote: post #15

Earlier quoted context omitted.

> What makes LastPass inferior to these other options? Well, for one, the very first sentence of the article here.

The article whose "exploit" requires handing your unlocked phone to someone?

You'd be surprised how many people (not on HN) use extremely weak (or no) unlocking mechanisms for their devices. It overlaps with the set of folks who would want to use LastPass because of how easy it is.

Re: LastPass’ Authenticator app is not secure

#67

Post by banachtarski » Wed, Dec 27, 2017, 5:58 PM UTC

zupzupper wrote: post #65

LastPass produces two apps, the Password Manager and this Authenticator App, which looks like a 2FA competitor to Google Authenticator. The bug the article is detailing is in the Authenticator application, not the Password Manager application, which wasn't very clear to me on my first read.

Now I'm confused. It says it in the title? Where might the confusion stem from?

Re: LastPass’ Authenticator app is not secure

#68

Post by sp332 » Wed, Dec 27, 2017, 6:02 PM UTC

darrmit wrote: post #3

I can’t figure out why LastPass is still so popular. Ease of use since it’s completely browser based? They were early to market? I don’t get it. So many better designed, more secure options out there. KeePass, Bitwarden, or 1Password to name a few.

It doesn't have to be browser-based. If you'd rather have a stand-alone app there's one in the Microsoft Store.

Re: LastPass’ Authenticator app is not secure

#69

Post by mickronome » Wed, Dec 27, 2017, 6:11 PM UTC

ComputerGuru wrote: post #20

The code, tech, and mindset behind LastPass is a joke. They started just after the “dark ages” of security but don’t seem to have upgraded their mental model of security since. I’ll share with you the moment I discovered something that made me cancel my schedule for the day, research alternatives, write a LastPass to 1Password converter [0], and cancel my LastPass account and subscription. Are you ready? You log in t…

Oh my god, they really do that?

I trust you to be right, but that's so incredibly stupid it's hard to believe someone selling a password manager would do that!

Re: LastPass’ Authenticator app is not secure

#70

Post by alkonaut » Wed, Dec 27, 2017, 6:12 PM UTC

BoorishBears wrote: post #4

david-cako wrote: post #2

Wow, color me surprised. Software developers aren't perfect, and closed source software with less eyes on it tends to be even less perfect. I will never trust my passwords all being in one place other than my brain.

You can't keep varied, secure passwords in your head unless you barely use any services.

Most people don’t use many services where security is important. It’s not uncommon to have several hundred accounts with passwords, but I have maybe 10 that I really worry about being hacked/lost. For all the crap sites I can just use $singlepassword+$servicename as password. For the few sensitive ones I use strong passwords and 2FA. I do use a manager to keep those strong passwords - but even though I have it, I can’t be bothered to use stronb passwords for all those forums, web shops etc.

Is my solution secure? No. Using a bad password for hundreds of sites is definitely not secure - but the quality of a password only needs to be proportional to the sensitivity of what it protects.