Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LastPass Security Notice

blog.lastpass.com

Post reply on HN
Print view View original

91–100 of 311 posts

Re: LastPass Security Notice

#91

Post by Zaheer »

xbryanx wrote: post #28
Zaheer wrote: post #10

Thoughts on LastPass vs 1Password?

I use 1Password for personal/family stuff. It's a much better interface and has many fewer bugs. I manage a Last Pass Enterprise instance at work. I love/hate it. The interface is terrible and buggy. However, it's the only tool I've found to manage passwords across many users (some medium to non-technical) who need access to shared accounts within an organization. 1Password doesn't really do this, and sharing vaults…

I'm currently a LastPass user but considering 1Password for about the same reasons...

1Password seems much more consumer friendly. Annoyed at bugs and crappier interface. 1Password also recently started integrating with some apps which I found particularly useful.

Re: LastPass Security Notice

#93

Post by robto »

I've been using LastPass for a while now, but I was recently evaluating the landscape for something more open. I came across Mitro[0], and it looks like it fits the bill. Unfortunately it doesn't look like it has been much maintained since its open-sourcing last year.

Mitro checked a lot of boxes on my checklist, so it's a bit disappointing that it has a smaller community.

[0]: https://www.mitro.co/security-faq.html

Re: LastPass Security Notice

#94

Post by tptacek »

Zaheer wrote: post #10

Thoughts on LastPass vs 1Password?

I understand 1Password's security design, it makes sense to me, and it has a fairly minimal attack surface. It's not perfect, but it's a sound design of a very conventional cryptosystem.

I do not understand LastPass's design; the shared authenticator/decrypting key, the website with HTML form fields for my master password, the public key crypto in Javascript with JSBN. Also, Steve Thomas doesn't like them, and found a vulnerability in their client/server protocol a while back.

I recommend 1Password, if you can use it.

Re: LastPass Security Notice

#95

Post by jjarmoc »

Lawtonfogle wrote: post #79
jjarmoc wrote: post #12

While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that's a huge target by virtue of having thousands of similarly centralized users ain't one. Using a password manager (good idea) and then storing all your passwords on a 3rd party service of which…

I just write down my passwords. Well not exactly. A few key ones I have memorized, and a few throw away ones I rotate between for when a site requires an account and I'll never be back. But my rare use passwords for important things are physically recorded in a locked notebook. Anyone who could get access to that could've just installed a keylogger into my computer. My problem with a password manager in general is th…

> I just write down my passwords.

People may laugh, but for many people that's a huge step up. I've tried explaining password managers to family members, and I've failed. The usability just isn't there for many classes of user, and as noted elsewhere in this thread losing access to that database is catastrophic.

Getting them to use unique passwords per-site, even if those passwords are written down and stored in their desk drawer, can be an improvement.

I'm far less worried about someone breaking into my (grand)?parent's house and stealing their password diary then compromises their bank account than I am someone popping some random site and re-using the compromised password.

Now for enterprise credentials where the (physically) stored credential and the service to which it's applicable have a closer proximity there's a higher change of this kind of meatspace targeting. But then, the 'common local admin password across all domain-joined machines' problem persists too.

Re: LastPass Security Notice

#96

Post by shabble »

gherkin0 wrote: post #84
shabble wrote: post #72

Earlier quoted context omitted.

http://finalkey.net/ looks like a step in teh right direction, although I'd prefer to see something a bit more compact, and ideally with an independent user interface. Something like a smartcard, with an eInk display and membrane keypad, that lets you select a credential and then provide it to the application via keyboard injection, or where possible over using challenge-response over the existing smartcard interface…

> Something like a smartcard, with an eInk display and membrane keypad, that lets you select a credential and then provide it to the application via keyboard injection, or where possible over using challenge-response over the existing smartcard interface so the secret never leaves the card. You might be interested in this: https://hackaday.io/project/86-mooltipass

Interesting. I had seen that a while back I think, but totally forgot when writing my comment just now. It's not quite 100% what I was thinking, but it's closer than anything else.

Re: LastPass Security Notice

#97

Post by L_Rahman »

joshstrange wrote: post #82

Perhaps this isn't the thread to discuss this but I feel like the state of access in 2015 is dismal at best... Every option out there either sucks ass on mobile or only integrates with a TINY percentage of apps and on desktop they aren't much better. How does Chrome (on iOS and OS X) blow every other PW manager out of the water? It "Just Works (tm)" while every other PW manager makes me just through a shit ton of hoo…

Every other password manager is an extension on top of a browser whereas Chrome itself is the browser. This means that non-Chrome password managers have many constraints that Chrome does not.

Re: LastPass Security Notice

#98

Post by tokenizerrr »

cmdrfred wrote: post #87
AdmiralAsshat wrote: post #76

See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS. It also has a way better Firefox add-on than any of the others I've seen (which is my main browser), and the Android apps, if unofficial, aren't bad either [0]. Importantly, they feature the ability to either pull from a local Keepass DB or to get it from a connected Google Drive account. I've take…

I have a sftp account on my server for my keepass data, I can sync it from anywhere and I don't have to worry about google drive having access to my (encrypted) data. I like it.

Which extension do you use for that?

Re: LastPass Security Notice

#99

Post by jjarmoc »

tptacek wrote: post #81
groby_b wrote: post #63

Earlier quoted context omitted.

That means one compromised password - your master password - compromises all your sites. That's the kind of risk I can't stomach. LastPass is a huge target, yes - but (if we trust them) the data is only decrypted client side, so they have no access to it. Which means the only viable exploit is in the lastpass browser extension.

But isn't it encrypted with a secret that is also used to log into their web site, or to log into their API to recover the vault?

This is one of the things that scares me. If an attacker had access to dump their credential digests, could they also have modified the site to silently log credentials upon entry?

From their statements so far, it doesn't seem that happened, but it seems likely that it could.

Re: LastPass Security Notice

#100

Post by gervase »

tomjen3 wrote: post #55

Any good tricks on how to generate a new master password that is a) secure enough and b) I can memorize?

http://world.std.com/~reinhold/diceware.html

https://www.random.org/

I believe the current suggestion is 7 words. It shouldn't be hard to come up with a mnemonic device to match your new password.

Post reply on HN