Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass users warned their master passwords are compromised

bleepingcomputer.com

Post reply on HN
Print view View original

91–100 of 326 posts

Re: LastPass users warned their master passwords are compromised

#91

Post by vorpalhex »

gruez wrote: post #83
vorpalhex wrote: post #44

Earlier quoted context omitted.

Yes, you should always have at least two and keep one in a reasonably fire resistant safe. You may want to enroll multiple and keep them in other places too, but you can't enroll a key you don't have so things like a safe deposit box are not useful for the average case.

>You may want to enroll multiple and keep them in other places too, but you can't enroll a key you don't have so things like a safe deposit box are not useful for the average case. That seems like a usability nightmare. Are there plans to improve this? Hardware wallets for cryptocurrencies seem to have it solved. You can keep multiple copies of the keys around (ie. multisig wallets) for maximum security, or you can w…

Because each hardware key is unique, this is not a feature currently available nor likely to become available. Each token from the yubikey is not (readily) linkable to the key itself since the underlying secret is opaque and can't be exported, so tricks like Shamir's aren't readily possible.

Yubikeys do solve a lot of use cases very well but that is a downside to them. That is probably still a good tradeoff for most consumers.

Re: LastPass users warned their master passwords are compromised

#92

Post by vorpalhex »

gkoberger wrote: post #55
vorpalhex wrote: post #49

Earlier quoted context omitted.

LastPass has had enough other security issues that I am doubtful of them to this day. https://www.mcafee.com/blogs/enterprise/cloud-security/lastp... Unfortunately the only password solutions I would recommend at this point are 1Password for something turn key, and BitWarden if you want to self host.

Agreed, and I highly recommend 1Password. But just because they've had problems in the past doesn't mean the framing of this article is fair. The title made me think everyone's passwords were compromised due to a leak or hack, when in reality the article is a rehash of a HN post from yesterday.

The official story from LastPass and the claims of the reporters are in direct conflict. Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users.

One [incident] reporter claims they changed their master password and had a breach attempt using the new password. If that is true that is extremely alarming.

There could be some malware targeting a LastPass extension or app cache somewhere, but that is groundless theory on my part.

Re: LastPass users warned their master passwords are compromised

#94

Post by civilized »

Confession: I store all my passwords in a plaintext file on my local desktop.

I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension).

Think about today's threat landscape and tell me I'm wrong. I may not be more secure in every possible situation, but I'm more secure in the situations that cause the vast majority of breaches today.

Re: LastPass users warned their master passwords are compromised

#96

Post by tuwtuwtuwtuw »

mNovak wrote: post #42
bryan0 wrote: post #7

> Some customers have also reported changing their master passwords since they received the login warning, only to receive another alert after the password was changed. Must be a compromised browser extension at this point. > To make things even worse, customers who tried disabling and deleting their LastPass accounts after receiving these warnings also report [1, 2] receiving "Something went wrong: A" errors after c…

Just tried deleting my account--got exactly that error. That's not reassuring

If you Google for the error message you'll find that this behavior has been there for several years. I guess they just don't care about the usability in his part of the process. I tried deleting an account with dev tools installed and the web server gave HTTP error 500 (internal server error). I think the JavaScript just bails out at that point.

From 2019: https://www.reddit.com/r/Lastpass/comments/afmfop/cant_delet...

From 2020: https://twitter.com/jowouters/status/1222438393981886464

There's a ton of those posts. Some in the official LastPass forum as well, and the response from LogMeIn was basically that the account was deleted.

(It's of course crappy, just saying that this behavior is nothing new and probably just something they don't care about enough to fix..)

Re: LastPass users warned their master passwords are compromised

#98

Post by kalekold »

civilized wrote: post #94

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secur…

I do the same and encrypt the file with a simple encryption tool.

Re: LastPass users warned their master passwords are compromised

#99

Post by hetspookjee »

samtho wrote: post #90
yawaworht1978 wrote: post #74

Earlier quoted context omitted.

Wow, how can this amount of files be justified? And how did this breached exactly happen?

> Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.

I think for a security application you want to reduce your exposure as much as possible, and one way to do so is reducing the amount of dependencies in your application. I think a high dependency count is orthonogal to that.

Re: LastPass users warned their master passwords are compromised

#100

Post by Strilanc »

samtho wrote: post #90
yawaworht1978 wrote: post #74

Earlier quoted context omitted.

Wow, how can this amount of files be justified? And how did this breached exactly happen?

> Wow, how can this amount of files be justified? File count is not a good metric of complexity nor is an indicator of the quality of an application. There is a good chance a lot of that are packages that have been packaged up into the extension. Lastpass itself is not a super trivial application, either.

Seems like a pretty good metric of complexity to me, particularly when it comes to a security audit. Having a lot of packages packaged up in the extension corresponds to having a lot of source code you have to vet, lest it be an avenue of attack.
Post reply on HN