Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

61–70 of 326 posts

Re: LastPass users warned their master passwords are compromised

#61

Post by FearlessNebula »

_jal wrote: post #51
twostorytower wrote: post #17

Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.

Nope. Keeping my secrets store on someone else's computer is simply not compatible with my threat model. Yes, they say it is encrypted, and I believe them and believe they're competent. But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.

How do you sync your passwords across all of your machines? Do you self host your passwords on your own server? Do you manually sync?

Re: LastPass users warned their master passwords are compromised

#62

Post by karmakaze »

_jal wrote: post #51
twostorytower wrote: post #17

Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.

Nope. Keeping my secrets store on someone else's computer is simply not compatible with my threat model. Yes, they say it is encrypted, and I believe them and believe they're competent. But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.

What's your personal threat model? I'm always trying to balance the risk of a party focused on security vs the minimal effort I'm likely to put into it. I don't want to be a story about the guy that lost their password to a wallet or anything else important. I used to be able to reliably remember complex passwords reliably but finding that's no longer the case, now only shorter intermittently used ones based on how often I have to use "reset password".

Re: LastPass users warned their master passwords are compromised

#63

Post by pelorat »

moneywoes wrote: post #37
shireboy wrote: post #14

Earlier quoted context omitted.

So original article is down, but this sounds like people who used the same password as their master and in some _other_ service that has been leaked. ie a user who's lastpass master pass is same as their facebook. Very different from having LastPass leak master pass. Is this the same issue or a case of LastPass not getting the situation?

This article mentions that there were users with unique LastPass passwords who had this occur. Also, I guess they have no incentive to admit a breach

LastPass doesn't store passwords on their servers, so it's not some magical breach.

Re: LastPass users warned their master passwords are compromised

#64

Post by Isthatablackgsd »

jimsi wrote: post #12
simpleguitar wrote: post #8

Earlier quoted context omitted.

Self hosting sucks for an average user, and terrible for a mobile user. It is possible to have hosted password solution that is secure, so why not use it? This is basically the same "cloud" vs "on-prem" debate. Cloud won, I think.

I use KeePassDX on Android and KeePassXC on a laptop, and they are synced with Syncthing. I have no issues with this setup

That is not selfhosting. Selfhosting means web/cloud applications maintained by the users. Technically Syncthing is selfhosting but Keepass variants are not. So your setup is not really selfhosting because you are not hosting Keepass in the webserver.

Re: LastPass users warned their master passwords are compromised

#66

Post by junon »

_jal wrote: post #51
twostorytower wrote: post #17

Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.

Nope. Keeping my secrets store on someone else's computer is simply not compatible with my threat model. Yes, they say it is encrypted, and I believe them and believe they're competent. But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.

1password has been audited a bazillion times. They're E2EE. They're cheap. Your master passwords aren't stored on their servers. Neither is your key information.

The only thing I pay for is the managed hosting, but in theory it's not much different than anything else properly designed (e.g. bitwarden) aside from the obvious things, such as OSS-ness.

The only relevant CVEs are relatively mild compared to LastPass.

Give them some credit.

Re: LastPass users warned their master passwords are compromised

#67

Post by gruez »

_wldu wrote: post #33

Blog post about the design flaws of password managers: https://www.go350.com/posts/the-design-flaws-of-password-man...

I can't say I like the post.

>Users must also devise a master password to unlock the encrypted passwords stored by the password manager. This is similar to a master key. It is generally accepted that master keyed locks are less secure than non-master keyed locks. If the master password is exposed, then confidence (in all the passwords that it unlocks) is lost.

1. In a perfect world, having a master password is worse than having independent passwords. However, realistically you can't remember that many passwords, so in practice you end up reusing passwords across sites. Using a master password in this case is a worthwhile tradeoff.

2. on most password managers, you need access to both the database (either through the web, or as a file) and the master password to compromise its contents. Even if your password was "hunter2" or something, your accounts would probably be fine.

>DPG

Deterministic password generators/managers have problems of their own. Their main draw is supposedly the lack of state to keep track of, but realistically you still need to sync stuff (eg. usernames, site identifiers, password formats, counters), so that dream is never realized.

>1. Never store passwords. Rather, generate them as needed based on user input. The need to backup, synchronize and properly encrypt passwords is removed. There is no master password that immediately unlocks all of the other passwords. There is nothing to become lost, stolen or corrupt.

I can't tell whether this is satire or not. The author dunks on other password managers for having a "master password that immediately unlocks all of the other passwords", but his program literally has the same flaw? At least with traditional password managers you need access to the database and the master password.

Re: LastPass users warned their master passwords are compromised

#68

Post by scrapcode »

mNovak wrote: post #42
bryan0 wrote: post #7

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. Must be a compromised browser extension at this point. > To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after c…

Just tried deleting my account--got exactly that error. That's not reassuring

Same here. It appears(?) that my account got deleted.

Re: LastPass users warned their master passwords are compromised

#69

Post by rtomanek »

If you decide it's time to switch, consider switching to Keepass(-compatible software), with the DB file hosted via WebDAV (which you can either self-host or have hosted by a multitude of low-cost providers).

This will give you nice conflict resolution if accessing (modifying) the file from multiple machines.

There are clients available for all platforms. I use: Keepass (Windows), Macpass/ Keeweb/ Strongbox (MacOS), StrongBox (iPad) and Keepass2Android (Android, this one's fantastic!).

Re: LastPass users warned their master passwords are compromised

#70

Post by mattrighetti »

twostorytower wrote: post #17

Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.

This kind of feature is also available on BitWarden Premium
Post reply on HN