Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The situation at LastPass may be worse than they are letting on

twitter.com

Post reply on HN
Print view View original

91–100 of 436 posts

Re: The situation at LastPass may be worse than they are letting on

#91

Post by mbar84 »

ern wrote: post #76

This is quite interesting. A couple of weeks ago, I received an extortion phishing email, but it was directed to a secondary email address that hasn’t been previously compromised. It made it past Gmail’s spam and phishing filters into my inbox. Maybe a coincidence, but I guess every weird thing that happens is going to raise alarm bells. I was suspicious of the LastPass concept (storing passwords in a cloud app) when…

On a balance of risks, your your former employer may have made the right call. The issue is, do you use something that isn't perfect but everybody can use, or do have a substantial portion of tech illiterate people not use anything, which would be an even greater risk.

Re: The situation at LastPass may be worse than they are letting on

#92

Post by lolinder »

smt88 wrote: post #79
chank wrote: post #64

Having all your keys/passwords on a 3rd party server is something that I've never been willing to accept from a security standpoint. That's what always kept me from using a `hosted` solution. I do get the allure from a multi-user management aspect though.

I used to use KeePass and synced the database (but not the keys or password) with Dropbox. Very secure and mostly convenient.

Is the added security just that Dropbox is a lower value target (possible) and that attackers won't think to look for password databases in Dropbox accounts if they do compromise Dropbox (less likely)? Or is there something more to it?

EDIT: Given the replies below, I should be clear that I'm not interested in comparing to LastPass, I'm comparing to Bitwarden. LastPass had an obviously bad security model that failed to encrypt everything, but Bitwarden does not have that flaw.

Re: The situation at LastPass may be worse than they are letting on

#93

Post by jraph »

pigsty wrote: post #36
ddejohn wrote: post #5

For anybody else left wondering, Bitwarden does encrypt (nearly) everything in your vault: > At Bitwarden we take this trusted relationship with our users seriously. We also built our solution to be safe and secure with end-to-end encryption for all Vault data, including website URLs, so that your sensitive data is “zero trust” secure [1] I haven't used LastPass in years, but the recent news made me wonder how Bitwar…

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

> The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable.

That's a consequence of the Murphy's law [1].

Very well written. You phrased it perfectly for it to have its place at [2] which is full of this kind of stuff. It's almost like this sentence claims itself the right to appear there. If you read French you might enjoy this website. If not, you might still enjoy the different phrasings of Murphy's law in different languages here [3].

[1] https://en.wikipedia.org/wiki/Murphy's_law

[2] https://courtois.cc/murphy/murphy.html

[3] https://courtois.cc/murphy/murphy_original.html

Re: The situation at LastPass may be worse than they are letting on

#95

Post by MBCook »

phphphphp wrote: post #63
MBCook wrote: post #55

Earlier quoted context omitted.

But if you had a ton of credentials from people, scanning for crypto credentials and trying to use those may be easier/faster/safer to turn into money than system credentials to some random company network.

If the hack of LastPass happened yesterday, sure, but it happened months ago. There are a variety of different attacks that could be executed in that time, and the sooner the attacks are executed, the better — because less time for credentials to be rotated. I find it implausible that the first hint of vault compromise comes 4 months after the hack and is against a low value cryptocurrency wallet. Especially consider…

Oh I didn’t realize the compromise was months ago. I thought it was recent.

Good points.

Re: The situation at LastPass may be worse than they are letting on

#96

Post by jraph »

djbusby wrote: post #44
pigsty wrote: post #36

Earlier quoted context omitted.

I feel like there should be a law of the internet for this. The more a company asserts that their data is secure and encrypted and you should trust them, the more likely it is to leak and be proven to be massively vulnerable. It’s fine to store your passwords online for convenience, but as a user, it’s important to accept that it’s no longer your private password and will, at some point, leak.

PigSty's Razor

I suggest "the LastPass Law"

Re: The situation at LastPass may be worse than they are letting on

#97

Post by roperj »

lolinder wrote: post #92
smt88 wrote: post #79

Earlier quoted context omitted.

I used to use KeePass and synced the database (but not the keys or password) with Dropbox. Very secure and mostly convenient.

Is the added security just that Dropbox is a lower value target (possible) and that attackers won't think to look for password databases in Dropbox accounts if they do compromise Dropbox (less likely)? Or is there something more to it? EDIT: Given the replies below, I should be clear that I'm not interested in comparing to LastPass, I'm comparing to Bitwarden. LastPass had an obviously bad security model that failed…

> Or is there something more to it?

The part where they said they do not store either the key or password on Dropbox.

Re: The situation at LastPass may be worse than they are letting on

#98

Post by aborsy »

lolinder wrote: post #92
smt88 wrote: post #79

Earlier quoted context omitted.

I used to use KeePass and synced the database (but not the keys or password) with Dropbox. Very secure and mostly convenient.

Is the added security just that Dropbox is a lower value target (possible) and that attackers won't think to look for password databases in Dropbox accounts if they do compromise Dropbox (less likely)? Or is there something more to it? EDIT: Given the replies below, I should be clear that I'm not interested in comparing to LastPass, I'm comparing to Bitwarden. LastPass had an obviously bad security model that failed…

No. When you login to LastPass, your password can be taken if LastPass is compromised. You have to trust that LastPass will not do it. If you login to Dropbox, the master password to your keepass database cannot be stolen. You don’t need to trust Dropbox.

But what you said is also an additional benefit.

Re: The situation at LastPass may be worse than they are letting on

#99

Post by LelouBil »

nequo wrote: post #58
DSingularity wrote: post #12

If this is true there really is such low hope for cryptocurrency. If you can’t store your keys in a service like LP hardened via physical 2FAA. What’s left? Air gapped setups?

Passwordless might be the way to go. We (as a society) have been trying to do 2FA now wherever we can. 2FA can involve an authenticator app but it is easier with a physical key. That physical key by itself can obsolete the password for many uses. The more numerous the places where we can abandon passwords, the fewer the secrets that we need to keep.

I don't know why, but I'm still a bit afraid of using security key everywhere. I have an irrational fear of losing/breaking my security key. Even though I know my phone is fine and always with me (as a comparison).

I just set up a whole backup solution for my many self hosted applications, all encrypted with the keys safely in my password manager. Even uploaded to S3, because I figured if I'm paying for it, I could ID-and-support ticket my way to my data even if I lost my AWS credentials.

I don't know how to integrate a security key into this scheme. What to do if it actually gets lost ?

Will I have to use emergency codes for all the accounts ?

Can I make a backup of it somewhere ?

Would that defeat the purpose ?

I'll buy one someday, when I'll have all this figured out.

Re: The situation at LastPass may be worse than they are letting on

#100

Post by dspillett »

lolinder wrote: post #92
smt88 wrote: post #79

Earlier quoted context omitted.

I used to use KeePass and synced the database (but not the keys or password) with Dropbox. Very secure and mostly convenient.

Is the added security just that Dropbox is a lower value target (possible) and that attackers won't think to look for password databases in Dropbox accounts if they do compromise Dropbox (less likely)? Or is there something more to it? EDIT: Given the replies below, I should be clear that I'm not interested in comparing to LastPass, I'm comparing to Bitwarden. LastPass had an obviously bad security model that failed…

Drop box is just the sync mechanism, with keepass' encryption (and their own care to keep the keys safe and not carried on the same medium) being all the protection.

Dropbox is not added security in this setup, it is a natural factor if what is being transferred [the keepass file(s)] is sufficiently secure in itself.

Post reply on HN