71–80 of 188 posts
The test page is still vulnerable for me. https://lock.cmpxchg8b.com/SaiGhij5/lastpass.html Chrome 57.0.2987.110 (64-bit) Version: 4.1.42 Built: Thu Mar 09 2017 12:40:16 GMT-0500 (EST) Binary Component: true (Native Messaging version 4.1.34, built Jan 11 2017 01:45:24) Any idea why? I thought no user action was required? No custom error message for NXDOMAIN (I think?), I see the Lastpass site, then calc.exe opens. ht…
>>Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations. COMMENT OF THE DECADE. If you think that lastpass should be embarrassed based on what Tavis has written, maybe consider taking a lit criticism class. There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that peo…
Earlier quoted context omitted.
It's easy when you're the only user. Pretty tricky when you want to share entries among different groups of users.
It's probably an afternoon project to get that functionality. Since it's just a git repo, that much is easily shared. GPG supports encrypting messages for multiple recepients. Since pass is simple and open source it should be quite easy to add what you need. Send your patches upstream, I'm sure that others would find them useful too!
[0] https://git.zx2c4.com/password-store/plain/src/password-stor...
>>Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations. COMMENT OF THE DECADE. If you think that lastpass should be embarrassed based on what Tavis has written, maybe consider taking a lit criticism class. There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that peo…
Additionally, in general and as is the case here, the bugs aren't in some nice kid's hobby project. It's not like he's pointing out that grandma's blog has XSS vulnerabilities. These are security products, which often seem like snake oil instead. If anything we need more stigma against people and products who claim strong security but turn out to be shams, providing only security theater.
Some things just need much more expertise to do than others. You wouldn't want a hobbyist designing your local nuclear reactor, nor performing your heart surgery. Similar standards should be in place for computer security. Accepting security systems that were hacked together like another CMS will lead to our digital lives being on a foundation of straw.
Looks like this was discovered by the same guy that discovered CloudFail. That dude is amazing.
Well, this is Project Zero, the security researchers working there are highly competent, but I do agree this guy is amazing. I wonder what kind of methodology do they use to even come up with these attacks.
>>Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations. COMMENT OF THE DECADE. If you think that lastpass should be embarrassed based on what Tavis has written, maybe consider taking a lit criticism class. There is a concept called an "unreliable narrator." Tavis has a documented track record of poor interpersonal behavior. It's time that peo…
That's a pretty serious claim to make about someone, and you haven't backed it up.
Is it just me, or are these "cloud password managers" a terrible idea given the typical person's threat model? First, there are hackers looking to score a huge pile of accounts. Second, there could be a relatively unsophisticated person with a grudge, like an ex-partner. In a distant third, there are nation-state-level actors. If I keep a local encrypted password file and copy it around by hand, I may have some vulne…
Both use an AES-256 encrypted database encrypted using a master password which is first hashed using a modern/slow hashing algorithm.
Obviously it is imperfect that the LastPass plugin has bugs in it; and I won't defend that. But I will say that the convenience is worth the risk most of the time, but LastPass needs to be better than this if they want to maintain people's respect and trust.
If you intend to keep your encrypted password database completely offline (e.g. USB keys) then, sure, it is more secure but very few users are willing to take on such inconvenience.
Password Managers in general have resulted in less password reuse, longer passwords, and more random passwords. Last Pass in particular offers "one click" password rotation on dozens of popular services.
Is it just me, or are these "cloud password managers" a terrible idea given the typical person's threat model? First, there are hackers looking to score a huge pile of accounts. Second, there could be a relatively unsophisticated person with a grudge, like an ex-partner. In a distant third, there are nation-state-level actors. If I keep a local encrypted password file and copy it around by hand, I may have some vulne…
Is it just me, or are these "cloud password managers" a terrible idea given the typical person's threat model? First, there are hackers looking to score a huge pile of accounts. Second, there could be a relatively unsophisticated person with a grudge, like an ex-partner. In a distant third, there are nation-state-level actors. If I keep a local encrypted password file and copy it around by hand, I may have some vulne…
As soon as you put a Keepass encrypted database onto any cloud service (e.g. DropBox, Google Drive, etc) you've effectively just recreated LastPass. Both use an AES-256 encrypted database encrypted using a master password which is first hashed using a modern/slow hashing algorithm. Obviously it is imperfect that the LastPass plugin has bugs in it; and I won't defend that. But I will say that the convenience is worth…