6 ms·

Woah, this is scary. I'll need to look closely at LastPass alternatives (perhaps something that runs separately from the browser, even if it's a little more clu

by vosper 11y ago

Woah, this is scary. I'll need to look closely at LastPass alternatives (perhaps something that runs separately from the browser, even if it's a little more clunky to use than LastPass's integration).

chrisfosterelli 11y ago
I'll keep using Lastpass and I'm not sure that this is really their fault, but I have to say this is the first phishing scheme that I've thought "Wow, I would definitely fall for that". The chrome-extension.pw domain looked almost exactly the same as the Lastpass URL at first glance. I wonder if it would help if Chrome added a special URL-bar designation for extensions. EDIT: It looks like Chromium has an issue for adding this sort of URL-bar designation: https://code.google.com/p/chromium/issues/detail?id=453093 https://code.google.com/p/chromium/issues/detail?id=453093
- stordoff 11y ago
  Same here. I saw the screenshot before scrolling down to see the explanation, and assumed it was the real thing shown for comparison purposes. Very convincing attack. Edit: assume->assumed
infinitelurker 11y ago
This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud. https://www.blackhat.com/eu-15/briefings.html#even-the-lastpass-will-be-stolen-deal-with-it https://www.blackhat.com/eu-15/briefings.html#even-the-lastp... https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h... I've been very happy with 1password, runs locally can be synced directly to other devices. https://agilebits.com/onepassword https://agilebits.com/onepassword Does anyone have experience with 1password security breaches?
- chrisfosterelli 11y ago
  I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons: 1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords. 2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerable" to this attack. 3. This current phishing attack is not a vulnerability in Lastpass itself, or anything wrong with their cryptography. As the author points out, anyone who falls for this will receive an automatic email notice (if 2FA is not on) from Lastpass and if you have geographic restrictions enabled this attack won't work at all (note 1password does not have these features). 4. Storing encrypted data in the cloud is not inherently a vulnerability, although it increases your attack surface. Many users of 1password also do this with features like Dropbox sync, and Dropbox provides much less rigorous access control compared to Lastpass. 5. 1password has had it's own share of security blunders. The most recent being their database format that leaks all of your account names and the URL they are for, which 1password defended was for "performance reasons". http://myers.io/2015/10/22/1password-leaks-your-data/ http://myers.io/2015/10/22/1password-leaks-your-data/ EDIT: Updated to mention that alert emails are only sent if 2FA is disabled.
  - redwards510 11y ago
    I think you may be wrong about #3. The author argues that anyone with 2factor turned on will NOT receive email notification, and I'm not sure what you mean by geographic restriction. You can disallow Tor IPs but that is about it.
    - chrisfosterelli 11y ago
      Sorry, you're right that 2FA accounts will not receive the email. I've updated my comment. In addition to the TOR IP block, you can also restrict it to only allow access from select countries. This is what I meant by geographic restriction.
  - infinitelurker 11y ago
TwoBit 11y ago
For sites that really matter, don't use lastpass or any system other than memory or a written down hint system.

by vosper 11y ago

chrisfosterelli 11y ago

I'll keep using Lastpass and I'm not sure that this is really their fault, but I have to say this is the first phishing scheme that I've thought "Wow, I would definitely fall for that". The chrome-extension.pw domain looked almost exactly the same as the Lastpass URL at first glance. I wonder if it would help if Chrome added a special URL-bar designation for extensions. EDIT: It looks like Chromium has an issue for adding this sort of URL-bar designation: https://code.google.com/p/chromium/issues/detail?id=453093 https://code.google.com/p/chromium/issues/detail?id=453093

stordoff 11y ago
Same here. I saw the screenshot before scrolling down to see the explanation, and assumed it was the real thing shown for comparison purposes. Very convincing attack. Edit: assume->assumed

infinitelurker 11y ago

This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud. https://www.blackhat.com/eu-15/briefings.html#even-the-lastpass-will-be-stolen-deal-with-it https://www.blackhat.com/eu-15/briefings.html#even-the-lastp... https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h... I've been very happy with 1password, runs locally can be synced directly to other devices. https://agilebits.com/onepassword https://agilebits.com/onepassword Does anyone have experience with 1password security breaches?

chrisfosterelli 11y ago
I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons: 1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords. 2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerable" to this attack. 3. This current phishing attack is not a vulnerability in Lastpass itself, or anything wrong with their cryptography. As the author points out, anyone who falls for this will receive an automatic email notice (if 2FA is not on) from Lastpass and if you have geographic restrictions enabled this attack won't work at all (note 1password does not have these features). 4. Storing encrypted data in the cloud is not inherently a vulnerability, although it increases your attack surface. Many users of 1password also do this with features like Dropbox sync, and Dropbox provides much less rigorous access control compared to Lastpass. 5. 1password has had it's own share of security blunders. The most recent being their database format that leaks all of your account names and the URL they are for, which 1password defended was for "performance reasons". http://myers.io/2015/10/22/1password-leaks-your-data/ http://myers.io/2015/10/22/1password-leaks-your-data/ EDIT: Updated to mention that alert emails are only sent if 2FA is disabled.
- redwards510 11y ago
  I think you may be wrong about #3. The author argues that anyone with 2factor turned on will NOT receive email notification, and I'm not sure what you mean by geographic restriction. You can disallow Tor IPs but that is about it.
  - chrisfosterelli 11y ago
    Sorry, you're right that 2FA accounts will not receive the email. I've updated my comment. In addition to the TOR IP block, you can also restrict it to only allow access from select countries. This is what I meant by geographic restriction.
- infinitelurker 11y ago

TwoBit 11y ago

For sites that really matter, don't use lastpass or any system other than memory or a written down hint system.