Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How did LastPass master passwords get compromised?

palant.info

Post reply on HN
Print view View original

71–80 of 189 posts

Re: How did LastPass master passwords get compromised?

#71

Post by yellowstuff »

rexreed wrote: post #57

Out of curiosity the meaning of "credential stuffing" doesn't jibe with what I would assume the term would mean. Why isn't the more obvious "password reuse" term not preferred? I would assume credential stuffing would mean something to do with pushing a bunch of credentials into a system and overloading the credential system somehow, rather than simply being "reusing a password that was found on a third party site".

"Credential theft occurs when attackers breach a system and steal users' access credentials -- usually ID and password. The ID is most commonly the user's email address. Credential spilling is when those credentials are made available to other criminals. Credential stuffing is the large scale use of automated means to test stolen passwords against other unrelated websites."

https://www.securityweek.com/credential-stuffing-successful-...

The term "credential stuffing" is a bit counterintuitive for me as well, but I guess it fits the pattern of credential attacks. "Password reuse" has other meanings, so would be less precise as a technical term.

Re: How did LastPass master passwords get compromised?

#72

Post by 8organicbits »

benlivengood wrote: post #48
8organicbits wrote: post #16

Earlier quoted context omitted.

I wish there was a good way to implement this sort of double hashing in web apps. Doing the extra salted hash client side ensures that the value the server sees is globally unique, even when the user is reusing passwords across sites. Unfortunately the only way I know how to implement that is to have the server send JS down to the browser that instructs it to perform the hashing. For certain types of compromises serv…

Use client TLS certificates and let the browser handle credential management, including at-rest encryption. Or use FIDO2 hardware. There are many options available but for probably familiarity reasons the vast majority of users and browsers didn't go down that path, and neither did website owners.

I've only seen client certs used in contexts where an IT department assigns them to employees. Has anyone had success with these on public facing websites?

Extra hardware seem cool, but I've also rarely seen people using them. I'm guessing the added cost is a deterrent.

Re: How did LastPass master passwords get compromised?

#73

Post by palant »

WarOnPrivacy wrote: post #4
palant wrote: post #2

I am the author of this article. I’ve kept it short, some points made there could have been expanded considerably. So if there are questions, feel free to ask here.

There might be a cluster of old accounts in play and perhaps a smaller cluster of newly created or newly changed accounts. This hints at the possibility of more than one bad actor. It's possible the old accounts could be some old stock sold on a darknet forum and are being bundled in with the newer hashes/pwds. It's also possible that the entity harvesting the newer hashes/pwds isn't the same one who is amateurishly…

Yes, the sample is rather small to draw conclusions from. The biggest concern however are the people who got the notification again after changing their master password. It just doesn’t make sense if credential stuffing is what we are talking about.

Re: How did LastPass master passwords get compromised?

#75

Post by rexreed »

yellowstuff wrote: post #71
rexreed wrote: post #57

Out of curiosity the meaning of "credential stuffing" doesn't jibe with what I would assume the term would mean. Why isn't the more obvious "password reuse" term not preferred? I would assume credential stuffing would mean something to do with pushing a bunch of credentials into a system and overloading the credential system somehow, rather than simply being "reusing a password that was found on a third party site".

"Credential theft occurs when attackers breach a system and steal users' access credentials -- usually ID and password. The ID is most commonly the user's email address. Credential spilling is when those credentials are made available to other criminals. Credential stuffing is the large scale use of automated means to test stolen passwords against other unrelated websites." https://www.securityweek.com/credential-stu…

The use of obscure and unintuitive terms would seem to hurt the objectives of security proponents to explain how systems have been compromised. If you tell me my credentials were "stuffed", I'm going to assume it was some technically sophisticated attack using some exploit or system vulnerability. If you tell me my password was simply stolen and posted on a website, and they're just brute force trying the password on all the systems, I'm going to know that my password has been compromised and some cybercriminals are out there using bots to try them everywhere.

In the first, case, I'd feel less empowered to do something about it. In the second case I'd be more aware of all the databases with old passwords in it and never reuse a password twice. (if that's what's happening).

Re: How did LastPass master passwords get compromised?

#76

Post by unicornfinder »

40four wrote: post #47

What are the chances these emails were actually sent out in error, like Lastpass claims? It’s not in-plausible, but I also take it with a grain of salt. To be fair to them, I don’t think we’ve seen any reports of folks password DBs actually being compromised. Just a lot of presumed failed attempts. If the e-mails were sent in error, then it’s all much to do about nothing. If the master passwords were actually comprom…

Sums up my feelings really. I genuinely think that what they're saying is probably true, that these emails were sent in error (and I have to say I don't envy their teams at all in having to deal with the fallout from this), but it's also entirely understandable that many people will have been justifiably spooked to the point where they probably won't continue to use their services now.

Re: How did LastPass master passwords get compromised?

#77

Post by palant »

mizzao wrote: post #74

I've found LastPass to be increasingly buggy and less reliable as time goes on. Do they have security problems as well? Should I switch to a different service as a paying customer (for me and my family?) If so, any recommendations?

I’ve written about their security story a while ago here, not much has changed since AFAIK: https://security.stackexchange.com/questions/45170/how-safe-...

The trouble is that the majority of their competitors isn’t great either. I used to recommend 1Password, but another knowledgeable security researcher isn’t really fond of them.

Re: How did LastPass master passwords get compromised?

#78

Post by palant »

syvanen wrote: post #25

So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…

I haven’t seen it when I wrote the article. However, the formulation is vague enough that it could mean anything. Maybe the alerts were sent out by mistake which would be good news. But they don’t quite say that. Their statement might also mean that they rather disabled legitimate alerts so that people don’t get concerned. So they might have “cured” the symptoms without addressing the actual issue.

It certainly isn’t reassuring that they keep talking about credential stuffing, even though it’s quite unlikely to be the culprit here.

Re: How did LastPass master passwords get compromised?

#79

Post by 8organicbits »

faeyanpiraat wrote: post #19
8organicbits wrote: post #16

Earlier quoted context omitted.

I wish there was a good way to implement this sort of double hashing in web apps. Doing the extra salted hash client side ensures that the value the server sees is globally unique, even when the user is reusing passwords across sites. Unfortunately the only way I know how to implement that is to have the server send JS down to the browser that instructs it to perform the hashing. For certain types of compromises serv…

But then malware on the user’s machine could catch that password. There is no 100% solution to this.

Different problems need different solutions. I don't think I've ever seen a solution that solves 100% of all problems. This doesn't stop me from trying to improve security where I see opportunity.

Re: How did LastPass master passwords get compromised?

#80

Post by dehrmann »

abarringer wrote: post #43
syvanen wrote: post #25

So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…

"likely" "some", weasel words. Corporate marketing speak for we have no idea what happened so dream up some scenario that sounds plausible and do a press release.

Some of the emails were probably real, and they just happened to have been when there was supposedly a issue. That can't part be definitive.
Post reply on HN