Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass: Notice of Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

71–80 of 141 posts

Re: LastPass: Notice of Security Incident

#71

Post by roustem »

mancini0 wrote: post #37

Lesspass generates reproducible unique passwords from inputs (username, domain, masterpassword). It works without an internet connection and is open source. You only need their cloud storage if you want to backup metadata about the password requirements for specific sites (i.e, no special chars allowed by foo.com, bar.com requires a capital letter and a number, etc.) This metadata can also be stored locally. The comm…

How does it solve the problem with the site is compromised and you are forced to change the password?

Re: LastPass: Notice of Security Incident

#72

Post by NoPicklez »

theshrike79 wrote: post #18

I switched providers the last time this happened, or was it the one before that. Not a good look for an online password storage service.

As someone else said.

Breaches can and will happen to anyone and we should assume they eventually will happen to everyone. What matters is how quickly you can detect the breach how limited the impact is. It's still too early to tell exactly whats happening here yet. That said, if this only impacted a development environment that contained no customer data then this is a good example of that principle.

Re: LastPass: Notice of Security Incident

#73

Post by secfirstmd »

usehackernews wrote: post #64
deepdriver wrote: post #57

Earlier quoted context omitted.

Allegedly France is also big on industrial espionage, but this doesn’t get as much press since they’re a key NATO ally: https://www.france24.com/en/20110104-france-industrial-espio...

On Lex Friedman’s podcast with former CIA spy Andrew Bustamante, Andrew stated that the French spy agency is the top in the world with this type espionage. He said they put all their resources into industrial espionage and it’s pretty much their only focus.

Israel also very blatantly does it.

The US does it also. Can't remember the exact number but contracts above 150 million can occasionally be "helped along" by national level assets.

Re: LastPass: Notice of Security Incident

#74

Post by smt88 »

fezfight wrote: post #34
HelloMcFly wrote: post #30

Earlier quoted context omitted.

> They are savy enough to know what a password manager is, but not savy enough to deal with an offline one. Not the person you responded to, but: I think that most people are savvy enough to know what a password manager is, and most people are not savvy enough to be interested in the work necessary to setup, personalize, and maintaining an offline password manager that functions well across multiple devices. That doe…

My point is to illustrate that the commenter is speaking out of their respective ass. None of us know what the average person thinks, we are a group of tremendous nerds who are engaging, not just reading, in the comments section to a post about a flipping password manager.

I'm speaking out of personal experience trying to get non-average users (my friends and family, some of whom work in non-technical roles at software companies) to understand and use password managers.

Most of them can't and won't invest the time just to switch to 1Password. The average person isn't going to exceed that bar by a margin that even I, a software developer, wouldn't bother with.

When something is too technical for even an average developer to bother with (because it's unnecessary, not because it's hard), it is totally hopeless for the average user.

Re: LastPass: Notice of Security Incident

#75

Post by nicoburns »

fezfight wrote: post #34
HelloMcFly wrote: post #30

Earlier quoted context omitted.

> They are savy enough to know what a password manager is, but not savy enough to deal with an offline one. Not the person you responded to, but: I think that most people are savvy enough to know what a password manager is, and most people are not savvy enough to be interested in the work necessary to setup, personalize, and maintaining an offline password manager that functions well across multiple devices. That doe…

My point is to illustrate that the commenter is speaking out of their respective ass. None of us know what the average person thinks, we are a group of tremendous nerds who are engaging, not just reading, in the comments section to a post about a flipping password manager.

I’ve sold some friends and family on password managers, and the cloud syncing has been a key part of getting them to accept it. The alternative is often shortish passwords shared between systems.

Re: LastPass: Notice of Security Incident

#76

Post by Godel_unicode »

jrm4 wrote: post #28
shigawire wrote: post #22

Earlier quoted context omitted.

My problem is that as an unskilled person - will I be any better at securing my own system?

And my answer, as someone who doesn't work for a password company but is into this sort of thing, is "Yes, I believe one can be." -- or more precisely, "When you do it yourself, as opposed to a no-real-liability password company, you can get a better read on what the issues are." Consider a classic "grandma" solution. A little notebook with good passwords kept in the purse or wallet. The issues here are more knowable…

> classic "grandma" solution

> with good passwords

Well, which is it?

In all seriousness though, the two main benefits of password managers are they only autofill on the correct domain and they’ll suggest actually good passwords.

Re: LastPass: Notice of Security Incident

#78

Post by int_19h »

roustem wrote: post #71
mancini0 wrote: post #37

Lesspass generates reproducible unique passwords from inputs (username, domain, masterpassword). It works without an internet connection and is open source. You only need their cloud storage if you want to backup metadata about the password requirements for specific sites (i.e, no special chars allowed by foo.com, bar.com requires a capital letter and a number, etc.) This metadata can also be stored locally. The comm…

How does it solve the problem with the site is compromised and you are forced to change the password?

The inputs are domain + username + counter. So you just increment the counter.

Re: LastPass: Notice of Security Incident

#79

Post by jrm4 »

paultopia wrote: post #65
jrm4 wrote: post #21

For all of its warts, at least crypto has managed to come up with a clever little motto that correctly states the issue, in the form of "not your keys, not your crypto." Putting your passwords in the hands of a third party drastically increases your threat surface and no amount of hand-wavy "but it's not as convenient" will change this fact. Now, it may be true that the convenience factor is very strong right now, bu…

What does empowering people on their own even mean in this context? I thought password managers were how you empower people, in view of the constraints of: - passwords need to be strong, and that is inconsistent with being memorable - passwords shouldn't be repeated - people use multiple devices What is the user empowering solution to those three constraints other than password managers that store in the cloud, or fl…

Again, there is no "cloud," there is only "other peoples computers." It's time to start taking seriously ideas like "home servers."

Re: LastPass: Notice of Security Incident

#80

Post by minitech »

mancini0 wrote: post #37

Lesspass generates reproducible unique passwords from inputs (username, domain, masterpassword). It works without an internet connection and is open source. You only need their cloud storage if you want to backup metadata about the password requirements for specific sites (i.e, no special chars allowed by foo.com, bar.com requires a capital letter and a number, etc.) This metadata can also be stored locally. The comm…

The last time I looked at Lesspass, its implementation was worryingly incompetent[1][2]. Just use your browser’s password manager; it’s less phishable than a manual `genp site` and your passwords don’t pass through your clipboard.

EDIT: I revisited the code. Looks like everything in [1] is fixed, nothing in [2] is fixed, there are now JWTs for some reason, and… they removed metadata encryption??[3][4] Or it was never in in the first place and simple-crypto-js was used for something else? Either way, it’s a current and major flaw.

[1] https://news.ycombinator.com/item?id=22587940

[2] https://news.ycombinator.com/item?id=22582570

[3] https://github.com/lesspass/lesspass/issues/185

[4] https://github.com/lesspass/lesspass/blob/314fc7386f2c29750c...

Post reply on HN