Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass: Notice of Security Incident

blog.lastpass.com

Post reply on HN
Print view View original

91–100 of 141 posts

Re: LastPass: Notice of Security Incident

#91

Post by woojoo666 »

whoisjohnkid wrote: post #42

Hmm, even though LastPass doesn’t have access to your pass, couldn’t a malicious software update cause attacker to view your passwords when it runs since the software ultimately has access? This doesn’t seem to be the case in this incident though.

Yes it's possible that attackers could release a malicious client-side update but it would be immediately noticed and an alarm would be raised. Also I believe lastpass's client-side apps are open source, making it even more obvious when something is changed

Re: LastPass: Notice of Security Incident

#93

Post by ta988 »

smt88 wrote: post #3
autoexec wrote: post #2

Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!

Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.

A breach in the software distribution and signing servers would be quite disastrous.

Re: LastPass: Notice of Security Incident

#94

Post by armada651 »

smt88 wrote: post #3
autoexec wrote: post #2

Not enough data to say what the impact of this is. Good for them disclosing it early while they investigate. > we have seen no evidence that this incident involved any access to customer data or encrypted password vaults. One way to prevent risk to your passwords in the event of a security breach is to not store them in the cloud at all. KeePass is great!

Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.

You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical.

Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation.

That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master password.

Re: LastPass: Notice of Security Incident

#95

Post by vlan0 »

armada651 wrote: post #94
smt88 wrote: post #3

Earlier quoted context omitted.

Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.

You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical. Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation. That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master passw…

While this is true, and I did this for the better part of 2010s, it was pretty clunky. Especially if one needs a platform for their wife or children to also use.

I'm gonna ride out LastPass until webauthn really takes off. Which could be soon based on what we're hearing from the mobile vendors.

Re: LastPass: Notice of Security Incident

#96

Post by octobus2021 »

woleium wrote: post #89
octobus2021 wrote: post #87

Earlier quoted context omitted.

A wise sysadmin said in the days of my youth: "The only perfect firewall is a pair of scissors" :)

and a soldering iron https://www.bleepingcomputer.com/news/security/data-exfiltra...

I was going to add "and Faraday Cage" until I got to

For the current experiment, researchers argue that malware that managed to infect an air-gapped [offline] computer can transform and modulate locally stored files into audio signals and relay them to another nearby computer via connected speakers, headphones, earphones, or earbuds.

Which still require infecting offline computer somehow (and connected machine in close proximity as well).

Point taken though, nothing is perfect. And if everything else fails, there's always social engineering :)

Re: LastPass: Notice of Security Incident

#97

Post by pcthrowaway »

advisedwang wrote: post #17
aborsy wrote: post #6

Suppose that LastPass is compromised. What can an attacker do? Passwords are encrypted, with keys on users’ side. Short of serving customers malicious JS code or an app to steal passwords, the production environment referred in the article can be made totally public, without secrets in vaults bring revealed, no?

I suppose you could phish people into leaking the master password

Or inject malicious code into the apps/extensions to get users to submit their master passwords

Re: LastPass: Notice of Security Incident

#98

Post by robertwt7 »

there might not be an impact straightaway, however gaining access to source code means that it's easier for hacker to find loophole is it not?

lastpass has to be ready for some sort of attacks I guess, it's good that they identified this early

Re: LastPass: Notice of Security Incident

#99

Post by mr90210 »

robertwt7 wrote: post #98

there might not be an impact straightaway, however gaining access to source code means that it's easier for hacker to find loophole is it not? lastpass has to be ready for some sort of attacks I guess, it's good that they identified this early

Not really.

Take Wordpress as an example, the code is open source, yet the majority of loopholes come from plugins, not really the core.

But, we never know.

Post reply on HN