4 ms·

So, all three of the LastPass issues have been fixed, and within two weeks of being reported, to boot: * 2016-08-22 Vulnerability Discovered * 2016-08-24 V

So, all three of the LastPass issues have been fixed, and within two weeks of being reported, to boot: * 2016-08-22 Vulnerability Discovered * 2016-08-24 Vulnerability Reported * 2016-09-06 Vulnerability Fixed

ejcx 10y ago
The folks over there work really hard and care a lot. I'm sure that's the same with all the password managers too, but I know personally having worked at LastPass how much the founders care.
- bad_user 10y ago
  Hard-coding the symmetric encryption key used to store your master password isn't just a minor slip up. This is the kind of mistake that I for one wouldn't do and I'm no security expert. At least for proprietary apps, security is about trust. Given their other slip ups in the past, along with present design choices like making certain administration tasks available only through the web interface, I wonder how people can trust LastPass. Of course, it's better than not using a password manager at all. But one has to admit the bar for that is pretty low.
  - lm2s 10y ago
    I get baffled at how such basic security mistakes are made. Either who did them doesn't care or doesn't know, of which neither is good for - at least - applications that store such sensitive information.
    - Zombieball 10y ago
      To be fair, unless I misunderstood, the symetric key is only used when you save your master password (so you don't have to re-type it) and use a PIN instead. I believe LastPass app encourages you to NOT do this. This obviously doesn't excuse the implementation (it shouldn't of gotten past CR). Just pointing out the attack vector is not as severe as it seems (at least from the issue's title).
      - bad_user 10y ago
        Without a strong master password, encryption is useless. It's recommended to have a master password of at least 16 chars including digits and special characters. Otherwise a global enemy with the right resources, like the NSA, can brute force it from a distance. My password is 24 chars in length, includes digits and special characters and isn't made of dictionary words. Typing such a password on my laptop with a normal keyboard is fine, because I touch type, but typing it on my phone every time I need it is simply not doable. Using a PIN on the other hand is easy and should be fairly secure if the app is designed to fallback to the master password after X failures, preferably with hardware support. So in all fairness, not only did they screw up a basic feature, but this also encourages people to use weaker master passwords.
benbristow 10y ago
Really impressed ever since LogMeIn have bought Lastpass. Loads of much needed UI improvements have started to take place and it's slowly becoming less clunky.
- iamatworknow 10y ago
  I disagree with that. In my experience the apps and extensions have gotten much clunkier. The UI is inconsistent across iOS and Android, and on Firefox and Chrome. If I want to look up a password on my phone I will get logged out of the app two or three times before I finally get to the item I'm looking for. I was a premium member up until my subscription expired last week. It used to be required in order to use the mobile app. Now it's not, apparently, and given the mobile app experience I've been having lately it's not worth it. I've been passively looking for a self-hosted alternative I can switch to.
  - surfaceTensi0n 10y ago
    OwnCloud[0] has a password manager (Passman) that I've been thinking about. [0] - https://owncloud.org/features/ https://owncloud.org/features/
  - deleted 10y ago
    [deleted]
  - deleted 10y ago
    [deleted]
  - maccard 10y ago
    I swapped to keepass, and I use sync to synchronise the file. It works reasonably well!
    - hackuser 10y ago
      > It works reasonably well! How does it not work? Confidentiality and data integrity are essential for password managers; they can't work most of the time in those regards.
chmars 10y ago
That is great, however, it is still worrying since we have no chance to know if bad actors had already exploited the vulnerabilities. I am still very sceptical with regard to password managers as SaaS in the cloud – all eggs are in one basket and this basket is often not well enough protected.
- AdmiralAsshat 10y ago
  The write-up indicates that both of the exploits to get to the Master Password would have required physical access to the device, and one required a root exploit.

ejcx 10y ago

The folks over there work really hard and care a lot. I'm sure that's the same with all the password managers too, but I know personally having worked at LastPass how much the founders care.

bad_user 10y ago
Hard-coding the symmetric encryption key used to store your master password isn't just a minor slip up. This is the kind of mistake that I for one wouldn't do and I'm no security expert. At least for proprietary apps, security is about trust. Given their other slip ups in the past, along with present design choices like making certain administration tasks available only through the web interface, I wonder how people can trust LastPass. Of course, it's better than not using a password manager at all. But one has to admit the bar for that is pretty low.
- lm2s 10y ago
  I get baffled at how such basic security mistakes are made. Either who did them doesn't care or doesn't know, of which neither is good for - at least - applications that store such sensitive information.
  - Zombieball 10y ago
    To be fair, unless I misunderstood, the symetric key is only used when you save your master password (so you don't have to re-type it) and use a PIN instead. I believe LastPass app encourages you to NOT do this. This obviously doesn't excuse the implementation (it shouldn't of gotten past CR). Just pointing out the attack vector is not as severe as it seems (at least from the issue's title).
    - bad_user 10y ago
      Without a strong master password, encryption is useless. It's recommended to have a master password of at least 16 chars including digits and special characters. Otherwise a global enemy with the right resources, like the NSA, can brute force it from a distance. My password is 24 chars in length, includes digits and special characters and isn't made of dictionary words. Typing such a password on my laptop with a normal keyboard is fine, because I touch type, but typing it on my phone every time I need it is simply not doable. Using a PIN on the other hand is easy and should be fairly secure if the app is designed to fallback to the master password after X failures, preferably with hardware support. So in all fairness, not only did they screw up a basic feature, but this also encourages people to use weaker master passwords.

benbristow 10y ago

Really impressed ever since LogMeIn have bought Lastpass. Loads of much needed UI improvements have started to take place and it's slowly becoming less clunky.

iamatworknow 10y ago
I disagree with that. In my experience the apps and extensions have gotten much clunkier. The UI is inconsistent across iOS and Android, and on Firefox and Chrome. If I want to look up a password on my phone I will get logged out of the app two or three times before I finally get to the item I'm looking for. I was a premium member up until my subscription expired last week. It used to be required in order to use the mobile app. Now it's not, apparently, and given the mobile app experience I've been having lately it's not worth it. I've been passively looking for a self-hosted alternative I can switch to.
- surfaceTensi0n 10y ago
  OwnCloud[0] has a password manager (Passman) that I've been thinking about. [0] - https://owncloud.org/features/ https://owncloud.org/features/
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]
- maccard 10y ago
  I swapped to keepass, and I use sync to synchronise the file. It works reasonably well!
  - hackuser 10y ago
    > It works reasonably well! How does it not work? Confidentiality and data integrity are essential for password managers; they can't work most of the time in those regards.

chmars 10y ago

That is great, however, it is still worrying since we have no chance to know if bad actors had already exploited the vulnerabilities. I am still very sceptical with regard to password managers as SaaS in the cloud – all eggs are in one basket and this basket is often not well enough protected.

AdmiralAsshat 10y ago
The write-up indicates that both of the exploits to get to the Master Password would have required physical access to the device, and one required a root exploit.