I left after the 2011 incident. Amazing, they've had so many since.
LastPass users warned their master passwords are compromised
81–90 of 326 posts
Re: LastPass users warned their master passwords are compromised
#82Earlier quoted context omitted.
What's your personal threat model? I'm always trying to balance the risk of a party focused on security vs the minimal effort I'm likely to put into it. I don't want to be a story about the guy that lost their password to a wallet or anything else important. I used to be able to reliably remember complex passwords reliably but finding that's no longer the case, now only shorter intermittently used ones based on how o…
I’ve decided that besides a password manager, all of my passwords will also have a number at the end, like 8 (simple, easy to append manually in a password field. Now the password manager has to get defeated AND my own small personal salt value will have to be known.
Now we know
Re: LastPass users warned their master passwords are compromised
#83Earlier quoted context omitted.
So is the recommendation to get something like 3 keys and keep them in different safe places and bring one when you travel? I’ve been considering getting a Yubikey. Do they work on mobile? Edit: Looks like some Yubikey work via nfc for mobile.
Yes, you should always have at least two and keep one in a reasonably fire resistant safe. You may want to enroll multiple and keep them in other places too, but you can't enroll a key you don't have so things like a safe deposit box are not useful for the average case.
>You may want to enroll multiple and keep them in other places too, but you can't enroll a key you don't have so things like a safe deposit box are not useful for the average case.
That seems like a usability nightmare. Are there plans to improve this? Hardware wallets for cryptocurrencies seem to have it solved. You can keep multiple copies of the keys around (ie. multisig wallets) for maximum security, or you can write down the private key of the device you have and store it somewhere safe. In either case you can retain the public keys so you don't need access to the device if you want to send funds to them (or in the case of authentication tokens, enroll them).
Re: LastPass users warned their master passwords are compromised
#84Earlier quoted context omitted.
This article mentions that there were users with unique LastPass passwords who had this occur. Also, I guess they have no incentive to admit a breach
LastPass doesn't store passwords on their servers, so it's not some magical breach.
Right, but from an earlier HN thread people were saying their support forums prompted for their master password to log in?
Re: LastPass users warned their master passwords are compromised
#85Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.
Ah yes, the $5 wrench method.
The xkcd author did a disservice to online security with that comic.
You can be forced to disclose your secrets but you will know they were compromised, that's encryption doing its job.
There's a world of difference in knowing.
Re: LastPass users warned their master passwords are compromised
#86Earlier quoted context omitted.
Nope. Keeping my secrets store on someone else's computer is simply not compatible with my threat model. Yes, they say it is encrypted, and I believe them and believe they're competent. But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.
How do you sync your passwords across all of your machines? Do you self host your passwords on your own server? Do you manually sync?
Not OP, but I use the standalone version of 1Password + Resilio Sync.
Re: LastPass users warned their master passwords are compromised
#87Highly recommend 1Password with Yubikey/TitanKey protection. This means even if somebody had your master password and private key, they'd need a Yubikey to access your 1Password account from a new device. It's pretty much fool-proof unless you're kidnapped and held hostage.
No post body was provided.
Re: LastPass users warned their master passwords are compromised
#88Earlier quoted context omitted.
What's your personal threat model? I'm always trying to balance the risk of a party focused on security vs the minimal effort I'm likely to put into it. I don't want to be a story about the guy that lost their password to a wallet or anything else important. I used to be able to reliably remember complex passwords reliably but finding that's no longer the case, now only shorter intermittently used ones based on how o…
I’ve decided that besides a password manager, all of my passwords will also have a number at the end, like 8 (simple, easy to append manually in a password field. Now the password manager has to get defeated AND my own small personal salt value will have to be known.
Good idea, I would add a yubikey to that, for an additional step.
Re: LastPass users warned their master passwords are compromised
#89Earlier quoted context omitted.
Self hosting sucks for an average user, and terrible for a mobile user. It is possible to have hosted password solution that is secure, so why not use it? This is basically the same "cloud" vs "on-prem" debate. Cloud won, I think.
My setup: - Windows Desktop - Macbook Air I installed Keepass on my windows desktop along with iCloud drive sync. I keep my Keepass database in my iCloud directory. I can now use this Keepass database on my iPhone (via Files app), on my Macbook (iCloud Drive). Any changes made are automatically synced daily. Is that really too difficult? And yes, it does "just work". Bonus: Any passwords stored in my iCloud Keychain…
love this setup.
are you able to sync your keepass database to your windows machine? i need to add this one drawback for people to keep in mind. and also because it happened recently and made hn frontpage. apple can decide to suspend your account for one reason or another. it is very rare but can definitely happen.
Re: LastPass users warned their master passwords are compromised
#90Earlier quoted context omitted.
>Must be a compromised browser extension at this point Just for fun, I downloaded the official LastPass chrome extension. The zip file is 32MB before unzipping, and it has 426 separate *.js files, total of 25MB of javascript. That should be a fun audit. Edit: To be clear, nobody has said the LastPass extension is compromised, though that is one possibility. Edit #2: Some of the larger js files do have a fair amount o…
Wow, how can this amount of files be justified? And how did this breached exactly happen?
> Wow, how can this amount of files be justified?
File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.