12 ms·

LastPass release fix for DOM manipulation vulnerability

158 points by taviso 10y ago

zaatar 10y ago
Related bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
sillysaurus3 10y ago
It will be nice when "It's unethical to disclose security vulnerabilities immediately" mindset fades away: https://twitter.com/stits/status/845717835733094401 https://twitter.com/stits/status/845717835733094401 There's nothing wrong with publishing your findings immediately. It's not up to a security researcher to do a bunch of unpaid, extra work. Finding a bug is enough. Which is better: Finding a bug and bringing attention to it, or someone malicious finding the bug? The latter is objectively worse, but people keep trying to punish researchers for not following the third path of "Report it in private, following strict and lengthy procedures, and make no mention of it until a timeline of their choosing." It's a professional courtesy for someone to do that for free, but not a requirement, and it's certainly not unethical to tweet about it.
- jMyles 10y ago
  Tell it. Pointing out that structures of power are not what they appear - be they public or corporate - is in the best spirit of a free press. And reporting a security vulnerability in a widely-used product is just that.
- foota 10y ago
  While I'm not sure how keeping the bug secret compares to revealing the bug immediately in terms of ethicality, I think we can all agree that keeping it secret for a reasonable amount of time while the company fixes it (unless there is active evidence of exploitation, or you have significant reason to believe there is) is strictly more ethical than either of those options.
  - tedunangst 10y ago
    Well, the controversy in this case is that Tavis announced the existence of a bug (no details). Not sure why that would upset anybody. You thought it was perfectly bugfree?
    - foota 10y ago
      It sounded like the parent was arguing for it not being wrong to do immediate full disclosure. I was responding to that. Perhaps the parent was merely talking about stating there is a vulnerability? That is much more ethical. However, I am not sure that I believe it is something that would pass my threshold for clearly ethical (not your words, mine). You would need to weigh the damage to the company and consumer knee-jerk against the ability for consumers to make an informed decision about what they're willing to risk. In this case, maybe LastPass deserves for consumers to know immediately. They seem to have an extremely buggy program with a number of disclosed vulnerabilities. It's hard to know whether other programs are necessarily better though. Another factor that you should account for against disclosing is that stating the nature of the vuilnerability could potentially make it easier for someone to exploit. Do you think Tavis could find a vuln easier if I told him it was an RCE vs a CSRF bug? I do.
      - tedunangst 10y ago
        I suspect if you told tavis there was a RCE or CSRF bug, he would find one of each. I mean, I've found bugs by telling myself they existed. If I told myself it was a different bug, I'd find a different bug. Software is buggy.
        geocar 10y ago
        > Software is buggy. This statement, while true, makes me sad.
  - sillysaurus3 10y ago
    I think we can all agree that keeping it secret for a reasonable amount of time while the company fixes it (unless there is active evidence of exploitation, or you have significant reason to believe there is) is strictly more ethical Here are a bunch of tptacek comments on the topic: -- "Responsible disclosure" is a term of art coined by a group of vendors and consultants with close ties to vendors. Baked into the term is the assumption that vendors have some kind of proprietary claim on research done by unrelated third parties --- that, having done work of their own volition and at their own expense, vuln researchers have an obligation to share it with vendors. Many researchers do share and coordinate, as a courtesy to the whole community. But the idea that they're obliged to is a little disquieting. If vendors want to ensure that they get some control over the release schedules on their flaws, they can do what Google does and pay a shitload of money to build internal teams that can outcompete commercial research teams. Large companies that haven't come close to doing that shouldn't get to throw terms like "responsible disclosure" around too freely. -- "Responsible disclosure" is a marketing term. Linus may be wrong about the importance of security flaws relative to bugs, but that doesn't validate the self-aggrandizing omerta of security researchers. Vendor "coordination" of security flaws often works to the detriment of users. For one thing, cliques like vendor-sec gossip and share findings with the "cool kids", ensuring that every interested party but the operators knows what's coming a week before the advisories are published. For another, it substitutes the judgement of people like you --- who, no offense, don't run real world systems or make real world risk assessments about real assets --- for the judgement of the people who are not like you, but who could potentially disable or work around vulnerable systems far in advance of "coordinated patches". -- The process of "responsible disclosure" gives product managers latitude, because it effectively dictates that researchers can't publish until the vendor releases a fix. The vendors almost always decide when to release fixes. When a researcher publishes immediately, vendors are forced to fix problems immediately. A small window of vulnerability is created ("small" relative to the half life of the vulnerability, which depends on all sorts of other things) where less-skilled attackers can exploit the problem against more hosts. On the other hand, in the "responsible" scenario, many months will invariably pass before fixes to known problems are released. During that longer window, anybody else who finds the same problem (and, obviously, anyone who had it beforehand) can exploit the vulnerability as well. Furthermore, full disclosure creates a norm in which vendors are forced to allocate more resources to fixing security problems, instead of waiting half a year or more. This costs vendors. But the alternative may cost everyone else more. It depends on how well-armed you think organized crime is. Finally, there's the issue nobody ever seems willing to point out. If you disclose immediately, lots of people can protect themselves immediately: by uninstalling or disabling the affected software. -- You are unlikely to find anyone in the "community of responsible security researchers" to say anything negative about Tavis Ormandy. It is way over the top to imply that he's not "halfways mature". You will, on the other hand, find plenty of people with real reputations in the industry at stake (unlike yours, which is influenced not one whit by anything you say about disclosure) who will be happy to explain why "responsible disclosure" is damaging the industry. It's not even a hard argument to make. The dollar value of a reliable Windows remote is too high to pretend that bona fide researchers are the only people who will find them. Meanwhile, because product managers at large vendors are given the latitude to fix problems on the business' schedule instead of the Internet's, people get to wait 6-18 months for fixes to trivial problems. Personally, without wading into "responsible" vs. "full" disclosure, I will point out that vulnerability research has made your systems more secure; the manner in which the vulnerabilities were uncovered has very little to do with it. You are more secure now because vendors and customers pay to have software tested before and after shipping it. --end-- This exchange on why the term "responsible disclosure" is Orwellian is also worth reading: https://news.ycombinator.com/item?id=12308246 https://news.ycombinator.com/item?id=12308246 All of that is just a small portion of everything he's said: https://hn.algolia.com/?query=by:tptacek%20responsible%20disclosure&sort=byDate&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=by:tptacek%20responsible%20dis... I think there are sufficiently many persuasive arguments that it's very difficult to claim that someone who informs the world of the existence of a bug is doing more harm than good, regardless of how that information is made public. And if they're doing more good than harm, it's probably ethical.
- askvictor 10y ago
  Where in the article/blog post is this sentiment stated? I can only find praise and thanks for taviso and white hat researchers from lastpass; the fact someone on Twitter disagrees shouldn't be used to suggest an entirely company takes this approach.
- foolfoolz 10y ago
  I strongly disagree. right now you are just taking about vulnerabilities in general but there's varying levels of impact. are these vulnerabiluties ok to tweet? - able to see someone else's recipes on a cooking app without permission - some has ability to transfer money away from your account - disable a pacemaker remotely https://venturebeat.com/2008/08/08/defcon-excuse-me-while-i-turn-off-your-pacemaker/ https://venturebeat.com/2008/08/08/defcon-excuse-me-while-i-... because how closely technology is to our lives there will always be sensitive things behind someone's code or design as the only defense. it's not always information at risk. there are unethical bugs to publicly expose
  - godelski 10y ago
    I only mostly agree with this. I think there is an ethics in how you release. I 100% believe you should disclose the bug to the responsible party. Give a reasonable time for them to fix, check, and then disclose to the public. If you check and they are working on it then give them more time (offer to help? Doesn't have to be free). If they push you off then post it everywhere and well... we know how that goes. If they do fix it then add it to your resume and everyone is happy. In my opinion, all vulnerabilities should be disclosed to the public. This helps prevent the same mistake from being done twice (or in reality, thousands of times). BUT there is a reasonable way to disclose. Some things are more vulnerable than others (like a cache of everyone's passwords or a device that controls someone's heart...). Public discloser makes more people aware of this. We say security through obscurity isn't security, but that is only true to an extent. tldr: Always disclose, but do it responsibly.
- username223 10y ago
  tl;dr -- This isn't unpaid work. Ethics come into play when a company is paying people to hack other companies' software. Google's Project Zero is a brilliant PR play, but it's walking a fine line ethically. Google pays some engineers to hack other companies' software, then publicizes the results. Given its recent troubles, Uber could benefit from hiring a few gray-hats, pointing them at Google, and releasing some of the resulting bugs under an arbitrary "responsible disclosure" policy.
  - kbenson 10y ago
    It's only a fine line if you think everything they find would remain unfound without them. It's sort of like saying Consumer Reports walks a fine line if they alert the public about any dangerous behavior they see in the products they test. The danger is always there, telling people about it so they can avoid it and it can be fixed is to the public's benefit.
    - username223 10y ago
      I don't think Consumer Reports rates other product review sites with which it directly competes. Project Zero is more like politicians paying for opposition research. You can argue that it benefits the public to have dirty deeds exposed by any means necessary, but it's hard to call it altruistic.
      - kbenson 10y ago
        That's one way to look at it. Another way s that they are subsidizing the security team of their competitors. Also, project zero gives 90 days or until you've released a fix[1]. If you can't roll out a fix for your problem in 90 days, you're either playing fast and loose with your customer's security, or you've lost the talent to competently fix the problem, or you've made such a poor choice in your design that makes it hard to fix that nobody should use your program or service anyway. Any company or project unwilling or unable to roll out a security fix within 90 days doesn't deserve your support or money. 1: https://googleprojectzero.blogspot.com/2015/02/feedback-and-data-driven-updates-to.html https://googleprojectzero.blogspot.com/2015/02/feedback-and-...
- technion 10y ago
  I clearly recall people debating this in relation to IIS vulnerabilities under Windows NT4, which therefore must have been some time pre-2000. Unfortunately, I don't see this nicety in the future.
- sp0rk 10y ago
  > Which is better: Finding a bug and bringing attention to it, or someone malicious finding the bug? The latter is objectively worse, but people keep trying to punish researchers for not following the third path of "Report it in private, following strict and lengthy procedures, and make no mention of it until a timeline of their choosing." He put a lot of details out there that simply weren't necessary, and I think this is where the problem lies for a lot of people. Please explain to me how making the distinction between "There's an RCE" and "There's an RCE that's exploitable by messing with <feature X> in the API" benefits anybody besides nefarious actors (when the software developer is already working on a fix, as LastPass was at the time)?
csours 10y ago
Software needs to be Secure by Design Secure by Default Secure by Deployment I can't comment on Deployment, but the defaults are not secure (defaults to autofill info), and it's not secure by design - surface area is much too large. For me to trust lastpass, I will have to see real changes on those.
- scrollaway 10y ago
  I highly recommend KeepassX instead. https://www.keepassx.org/ https://www.keepassx.org/ It's a local db only, you're in full control of where it is, where it goes. It's one of my favourite pieces of software actually: Simple enough that my aunt is using it, secure enough that I'm using it for my company's accounts.
  - interfixus 10y ago
    KeePassXC is a fork of the 1.x version. Fixes all the annoyances that the official 2.x series somehow never got around to. Recommended. https://keepassxc.org/ https://keepassxc.org/
    - scrollaway 10y ago
      xc is a fork of the 2.x series. I would possibly recommend it, but it's less battle-tested and they're aiming to enable the HTTP server by default which I think is a mistake. I'm using it, but disabling that stuff. (Either way the databases are compatible with one-another, so it's up to you what client you use)
      - interfixus 10y ago
        You're right. I'm thinking 1.x because it has kept and augmented all the useful 1.x behavior which the regular 2.x somehow managed to butcher.
  - deleted 10y ago
    [deleted]
  - 10y ago
dleibovic 10y ago
All of your LastPass browser extensions should be updated to version 4.1.44 or higher On firefox, the version I'm using is still 3.3.4, which is the version available from the mozilla addon store: https://addons.mozilla.org/en-US/firefox/addon/lastpass-password-manager/ https://addons.mozilla.org/en-US/firefox/addon/lastpass-pass... Why the discrepancy? Am I still vulnerable? In their blog post, they even note: We want to thank our partners at Apple, Google, Microsoft, Mozilla, Opera, Yandex and others who fast-tracked our extension review and release.
- taviso 10y ago
  I believe you have to switch to the "beta" channel, because 3.3.x is deprecated. imho, you should do this urgently. https://addons.mozilla.org/en-Us/firefox/addon/lastpass-password-manager/versions/beta https://addons.mozilla.org/en-Us/firefox/addon/lastpass-pass... https://blog.lastpass.com/2017/03/plans-to-retire-the-lastpass-3-3-2-firefox-add-on.html/ https://blog.lastpass.com/2017/03/plans-to-retire-the-lastpa...
  - Steeeve 10y ago
    I've been trying out lastpass for a few weeks. I downloaded the extension that their website directed me to. Because of this discussion, I did a version check and lo and behold, it defaults to NOT auto-update. Luckily I've been using it only for a few unimportant sites. They've had two security issues disclosed since I started my trial. I'm impressed with the functionality. I'm decidedly unimpressed with the security experience.
    - Nexxxeh 10y ago
      I am a heavy LastPass user, but I've stopped using the browser plugins, and just copy and paste into my browser (or look up on my phone and manually type on my laptop/desktop). C&P'ing is also a bit risky as LP seems to lack a clear clipboard option on Android. I have a month left on my paid subscription. I think I'll be leaving for a competing product shortly.
dguido 10y ago
LastPass is a tire fire. How many exploitable vulnerabilities in a password manager do people need to drop as 0day to kill this company? Why is it that we continue to tolerate products that routinely violate the sales claims they make? Start actively telling your friends to stop using LastPass and switch to a better password manager.
- paulryanrogers 10y ago
  Which do you recommend? Which for non technical users who can barely manage LastPass?
  - TheDong 10y ago
    1Password. Just like most security folks recommend. It's damn usable too.
    - Steeeve 10y ago
      Except on Android, where it requires you to use a poor custom keyboard. Which means that you have to either build your own keyboard switching functionality or go through a ridiculous dance every time you want to use it.
      - kyrra 10y ago
        That is being fixed in Android O. 1password even has a demo show off the content fill on the dev release of O.
    - noja 10y ago
      But 1Password is too expensive to recommend to family.
      - nirvdrum 10y ago
        Indeed. It's hard enough convincing family members to use a password manager in the first place. Getting them to shell out $60/year to do so on top of that is a non-starter. Unfortunately, it falls in the same sort of category as paying for backup solutions in my experience. The cost is high enough that they're willing to roll the dice. That's not so say 1Password's pricing model is wrong -- they need to run a business after all. But LastPass makes for an easier sales pitch to family members, particularly those that need to share credentials and thus would fall into a family plan.
yladiz 10y ago
I want to ask a serious question: considering there have been some major issues with LastPass, like this one, showing up in recent memory, why do people (at least here on HN) stick with it despite these major issues? There are other options out there, depending on your use case (I use 1Password, which seems to have fared much better as far as vulnerabilities), so why keep the same software when vulnerabilities continue to be found in it? Is there a special feature in LastPass?
- arjie 10y ago
  I'm comfortable using software that has been thoroughly vetted by expert security engineers. I am even more comforted by the fact that LastPass responds rapidly to Tavis Ormandy's reports (and presumably others). I'll use the guys who are extensively studied and do all right over the guys who are less so. It's like choosing a 4 ⭐️ product with 5000 reviews over a 5 ⭐️ product with 3.
  - TheDong 10y ago
    That's not an apt comparison. Every security expert I've spoken to about password managers recommends against lastpass. Typically they recommend 1password, or passwordstore or sometimes even keepass. The more apt comparison is a product with 100 2 star reviews vs one with 1000 4 star reviews. 1password has more recommendations by security engineers, and has been reviewed in significant depth. Lastpass has been reviewed in depth, but is rarely recommended by the same engineers.
    - arjie 10y ago
      Thank you for that. Would any security engineers here who have successfully published vulnerabilities like to chime in? I would appreciate strongly informed advice.
    - DiNovi 10y ago
      I like the idea that you are just walking around asking security engineers for password managers
ikeboy 10y ago
Site seems to be relying on javascript or something to load: with umatrix on, I can only see the first page and can't scroll down.
- deleted 10y ago
  [deleted]
- jwilk 10y ago
  If you disable page style, you can read it whithout JS enabled.
icefoghacker 10y ago
We are part of a team consisting of highly efficient developers and hackers.We carry out services like,upgrade school grades, Get passwords for all social networks like Facebook,Instagram,Twitter,Whats app,Line,Skype Hack, We also delete unwanted online pictures and videos on any website,clear criminal records,hack bank accounts for transfers and credit card top ups,application hacking.We do custom software and web development in php, java, asp.net etc.We have 100% records from our client as well as highest repeat hire rate,and a refund policy we work with,our work speak for ourselves, we provide a perfect software solution to all clients.We believe in mutual growing with client and hence we work as a technology partner and consultant for our clients. Contact us .............raphaelnunezhacks@gmail.com text +13238351741
dewiz 10y ago
Too late, I decided to take the opportunity and renew my passwords and store them offline. I'm giving Enpass a try before reverting to the well known keepassx
fencepost 10y ago
My most sensitive passwords aren't in LastPass (or anywhere else for that matter) and don't overlap with any that are, but an awful lot are for less important sites. One thing I like about this is Tavis' comment on Twitter on 3/25 that it's a major structural issue and they have 90 days to fix it. 6 days later, resolved and confirmed so.
bertlequant 10y ago
Oh the number of people I see using LP at or through work...
jbg_ 10y ago
Why on earth do people who read HN keep their passwords in a cloud service? pass/gopass, stored in git over ssh on a server I control, and I have access to all my passwords everywhere while only relying on the security of ssh and gpg...
- Dayshine 10y ago
  I trust a company whose existence depends on keeping my passwords secure over my own ability to keep my personal server secure. It's not just ssh and gpg, it's every single service you have running on it, every piece of hardware and the OS itself.
  - jbg_ 10y ago
    No. If gpg does its job you could even host the passwords in a public github repository. Several pass users do this; I used to, but my server has better availability than github over the last few years so I switched after being frustrated at not being able to sync new passwords to my phone a couple of times.
    - jbg_ 10y ago
      So, to be fair, I misspoke when I said I rely on the security of gpg AND ssh. Really, it all comes down to the security of gpg. I feel pretty okay about that.
      - nrook 10y ago
        Surely you mean "pretty good"?
        jbg_ 10y ago
        Yes. In my variant of English they mean the same thing :)
        dewey 10y ago
simopaa 10y ago
As I finally decided to move away from LastPass (giving Enpass a shot) and tried to delete my account, I noticed in the advanced settings that the option "Keep track of login and form fill history" was automatically turned on. This may be just to show you the "most recent logins" in the app, but nonetheless I think this setting should've been a bit more easier to access
dbrian82 10y ago
hi,i'm Brian, i had my friend help me hack my ex's email, facebook, whatsapp,and his phone cause i suspected he was cheating. all he asked for was a his phone number. he's email is (hotcyberlord425@gmail.com)..IF u need help tell him Brian referred you to him and he'll help. Am sure his going to help you do it, good luck

158 points by taviso 10y ago

Related bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

sillysaurus3 10y ago

It will be nice when "It's unethical to disclose security vulnerabilities immediately" mindset fades away: https://twitter.com/stits/status/845717835733094401 https://twitter.com/stits/status/845717835733094401 There's nothing wrong with publishing your findings immediately. It's not up to a security researcher to do a bunch of unpaid, extra work. Finding a bug is enough. Which is better: Finding a bug and bringing attention to it, or someone malicious finding the bug? The latter is objectively worse, but people keep trying to punish researchers for not following the third path of "Report it in private, following strict and lengthy procedures, and make no mention of it until a timeline of their choosing." It's a professional courtesy for someone to do that for free, but not a requirement, and it's certainly not unethical to tweet about it.

jMyles 10y ago
Tell it. Pointing out that structures of power are not what they appear - be they public or corporate - is in the best spirit of a free press. And reporting a security vulnerability in a widely-used product is just that.
foota 10y ago
While I'm not sure how keeping the bug secret compares to revealing the bug immediately in terms of ethicality, I think we can all agree that keeping it secret for a reasonable amount of time while the company fixes it (unless there is active evidence of exploitation, or you have significant reason to believe there is) is strictly more ethical than either of those options.
- tedunangst 10y ago
  Well, the controversy in this case is that Tavis announced the existence of a bug (no details). Not sure why that would upset anybody. You thought it was perfectly bugfree?
  - foota 10y ago
    It sounded like the parent was arguing for it not being wrong to do immediate full disclosure. I was responding to that. Perhaps the parent was merely talking about stating there is a vulnerability? That is much more ethical. However, I am not sure that I believe it is something that would pass my threshold for clearly ethical (not your words, mine). You would need to weigh the damage to the company and consumer knee-jerk against the ability for consumers to make an informed decision about what they're willing to risk. In this case, maybe LastPass deserves for consumers to know immediately. They seem to have an extremely buggy program with a number of disclosed vulnerabilities. It's hard to know whether other programs are necessarily better though. Another factor that you should account for against disclosing is that stating the nature of the vuilnerability could potentially make it easier for someone to exploit. Do you think Tavis could find a vuln easier if I told him it was an RCE vs a CSRF bug? I do.
    - tedunangst 10y ago
      I suspect if you told tavis there was a RCE or CSRF bug, he would find one of each. I mean, I've found bugs by telling myself they existed. If I told myself it was a different bug, I'd find a different bug. Software is buggy.
      - geocar 10y ago
        > Software is buggy. This statement, while true, makes me sad.
- sillysaurus3 10y ago
  I think we can all agree that keeping it secret for a reasonable amount of time while the company fixes it (unless there is active evidence of exploitation, or you have significant reason to believe there is) is strictly more ethical Here are a bunch of tptacek comments on the topic: -- "Responsible disclosure" is a term of art coined by a group of vendors and consultants with close ties to vendors. Baked into the term is the assumption that vendors have some kind of proprietary claim on research done by unrelated third parties --- that, having done work of their own volition and at their own expense, vuln researchers have an obligation to share it with vendors. Many researchers do share and coordinate, as a courtesy to the whole community. But the idea that they're obliged to is a little disquieting. If vendors want to ensure that they get some control over the release schedules on their flaws, they can do what Google does and pay a shitload of money to build internal teams that can outcompete commercial research teams. Large companies that haven't come close to doing that shouldn't get to throw terms like "responsible disclosure" around too freely. -- "Responsible disclosure" is a marketing term. Linus may be wrong about the importance of security flaws relative to bugs, but that doesn't validate the self-aggrandizing omerta of security researchers. Vendor "coordination" of security flaws often works to the detriment of users. For one thing, cliques like vendor-sec gossip and share findings with the "cool kids", ensuring that every interested party but the operators knows what's coming a week before the advisories are published. For another, it substitutes the judgement of people like you --- who, no offense, don't run real world systems or make real world risk assessments about real assets --- for the judgement of the people who are not like you, but who could potentially disable or work around vulnerable systems far in advance of "coordinated patches". -- The process of "responsible disclosure" gives product managers latitude, because it effectively dictates that researchers can't publish until the vendor releases a fix. The vendors almost always decide when to release fixes. When a researcher publishes immediately, vendors are forced to fix problems immediately. A small window of vulnerability is created ("small" relative to the half life of the vulnerability, which depends on all sorts of other things) where less-skilled attackers can exploit the problem against more hosts. On the other hand, in the "responsible" scenario, many months will invariably pass before fixes to known problems are released. During that longer window, anybody else who finds the same problem (and, obviously, anyone who had it beforehand) can exploit the vulnerability as well. Furthermore, full disclosure creates a norm in which vendors are forced to allocate more resources to fixing security problems, instead of waiting half a year or more. This costs vendors. But the alternative may cost everyone else more. It depends on how well-armed you think organized crime is. Finally, there's the issue nobody ever seems willing to point out. If you disclose immediately, lots of people can protect themselves immediately: by uninstalling or disabling the affected software. -- You are unlikely to find anyone in the "community of responsible security researchers" to say anything negative about Tavis Ormandy. It is way over the top to imply that he's not "halfways mature". You will, on the other hand, find plenty of people with real reputations in the industry at stake (unlike yours, which is influenced not one whit by anything you say about disclosure) who will be happy to explain why "responsible disclosure" is damaging the industry. It's not even a hard argument to make. The dollar value of a reliable Windows remote is too high to pretend that bona fide researchers are the only people who will find them. Meanwhile, because product managers at large vendors are given the latitude to fix problems on the business' schedule instead of the Internet's, people get to wait 6-18 months for fixes to trivial problems. Personally, without wading into "responsible" vs. "full" disclosure, I will point out that vulnerability research has made your systems more secure; the manner in which the vulnerabilities were uncovered has very little to do with it. You are more secure now because vendors and customers pay to have software tested before and after shipping it. --end-- This exchange on why the term "responsible disclosure" is Orwellian is also worth reading: https://news.ycombinator.com/item?id=12308246 https://news.ycombinator.com/item?id=12308246 All of that is just a small portion of everything he's said: https://hn.algolia.com/?query=by:tptacek%20responsible%20disclosure&sort=byDate&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=by:tptacek%20responsible%20dis... I think there are sufficiently many persuasive arguments that it's very difficult to claim that someone who informs the world of the existence of a bug is doing more harm than good, regardless of how that information is made public. And if they're doing more good than harm, it's probably ethical.
askvictor 10y ago
Where in the article/blog post is this sentiment stated? I can only find praise and thanks for taviso and white hat researchers from lastpass; the fact someone on Twitter disagrees shouldn't be used to suggest an entirely company takes this approach.
foolfoolz 10y ago
I strongly disagree. right now you are just taking about vulnerabilities in general but there's varying levels of impact. are these vulnerabiluties ok to tweet? - able to see someone else's recipes on a cooking app without permission - some has ability to transfer money away from your account - disable a pacemaker remotely https://venturebeat.com/2008/08/08/defcon-excuse-me-while-i-turn-off-your-pacemaker/ https://venturebeat.com/2008/08/08/defcon-excuse-me-while-i-... because how closely technology is to our lives there will always be sensitive things behind someone's code or design as the only defense. it's not always information at risk. there are unethical bugs to publicly expose
- godelski 10y ago
  I only mostly agree with this. I think there is an ethics in how you release. I 100% believe you should disclose the bug to the responsible party. Give a reasonable time for them to fix, check, and then disclose to the public. If you check and they are working on it then give them more time (offer to help? Doesn't have to be free). If they push you off then post it everywhere and well... we know how that goes. If they do fix it then add it to your resume and everyone is happy. In my opinion, all vulnerabilities should be disclosed to the public. This helps prevent the same mistake from being done twice (or in reality, thousands of times). BUT there is a reasonable way to disclose. Some things are more vulnerable than others (like a cache of everyone's passwords or a device that controls someone's heart...). Public discloser makes more people aware of this. We say security through obscurity isn't security, but that is only true to an extent. tldr: Always disclose, but do it responsibly.
username223 10y ago
tl;dr -- This isn't unpaid work. Ethics come into play when a company is paying people to hack other companies' software. Google's Project Zero is a brilliant PR play, but it's walking a fine line ethically. Google pays some engineers to hack other companies' software, then publicizes the results. Given its recent troubles, Uber could benefit from hiring a few gray-hats, pointing them at Google, and releasing some of the resulting bugs under an arbitrary "responsible disclosure" policy.
- kbenson 10y ago
  It's only a fine line if you think everything they find would remain unfound without them. It's sort of like saying Consumer Reports walks a fine line if they alert the public about any dangerous behavior they see in the products they test. The danger is always there, telling people about it so they can avoid it and it can be fixed is to the public's benefit.
  - username223 10y ago
    I don't think Consumer Reports rates other product review sites with which it directly competes. Project Zero is more like politicians paying for opposition research. You can argue that it benefits the public to have dirty deeds exposed by any means necessary, but it's hard to call it altruistic.
    - kbenson 10y ago
      That's one way to look at it. Another way s that they are subsidizing the security team of their competitors. Also, project zero gives 90 days or until you've released a fix[1]. If you can't roll out a fix for your problem in 90 days, you're either playing fast and loose with your customer's security, or you've lost the talent to competently fix the problem, or you've made such a poor choice in your design that makes it hard to fix that nobody should use your program or service anyway. Any company or project unwilling or unable to roll out a security fix within 90 days doesn't deserve your support or money. 1: https://googleprojectzero.blogspot.com/2015/02/feedback-and-data-driven-updates-to.html https://googleprojectzero.blogspot.com/2015/02/feedback-and-...
technion 10y ago
I clearly recall people debating this in relation to IIS vulnerabilities under Windows NT4, which therefore must have been some time pre-2000. Unfortunately, I don't see this nicety in the future.
sp0rk 10y ago
> Which is better: Finding a bug and bringing attention to it, or someone malicious finding the bug? The latter is objectively worse, but people keep trying to punish researchers for not following the third path of "Report it in private, following strict and lengthy procedures, and make no mention of it until a timeline of their choosing." He put a lot of details out there that simply weren't necessary, and I think this is where the problem lies for a lot of people. Please explain to me how making the distinction between "There's an RCE" and "There's an RCE that's exploitable by messing with <feature X> in the API" benefits anybody besides nefarious actors (when the software developer is already working on a fix, as LastPass was at the time)?

csours 10y ago

Software needs to be Secure by Design Secure by Default Secure by Deployment I can't comment on Deployment, but the defaults are not secure (defaults to autofill info), and it's not secure by design - surface area is much too large. For me to trust lastpass, I will have to see real changes on those.

scrollaway 10y ago
I highly recommend KeepassX instead. https://www.keepassx.org/ https://www.keepassx.org/ It's a local db only, you're in full control of where it is, where it goes. It's one of my favourite pieces of software actually: Simple enough that my aunt is using it, secure enough that I'm using it for my company's accounts.
- interfixus 10y ago
  KeePassXC is a fork of the 1.x version. Fixes all the annoyances that the official 2.x series somehow never got around to. Recommended. https://keepassxc.org/ https://keepassxc.org/
  - scrollaway 10y ago
    xc is a fork of the 2.x series. I would possibly recommend it, but it's less battle-tested and they're aiming to enable the HTTP server by default which I think is a mistake. I'm using it, but disabling that stuff. (Either way the databases are compatible with one-another, so it's up to you what client you use)
    - interfixus 10y ago
      You're right. I'm thinking 1.x because it has kept and augmented all the useful 1.x behavior which the regular 2.x somehow managed to butcher.
- deleted 10y ago
  [deleted]
- 10y ago

dleibovic 10y ago

All of your LastPass browser extensions should be updated to version 4.1.44 or higher On firefox, the version I'm using is still 3.3.4, which is the version available from the mozilla addon store: https://addons.mozilla.org/en-US/firefox/addon/lastpass-password-manager/ https://addons.mozilla.org/en-US/firefox/addon/lastpass-pass... Why the discrepancy? Am I still vulnerable? In their blog post, they even note: We want to thank our partners at Apple, Google, Microsoft, Mozilla, Opera, Yandex and others who fast-tracked our extension review and release.

taviso 10y ago
I believe you have to switch to the "beta" channel, because 3.3.x is deprecated. imho, you should do this urgently. https://addons.mozilla.org/en-Us/firefox/addon/lastpass-password-manager/versions/beta https://addons.mozilla.org/en-Us/firefox/addon/lastpass-pass... https://blog.lastpass.com/2017/03/plans-to-retire-the-lastpass-3-3-2-firefox-add-on.html/ https://blog.lastpass.com/2017/03/plans-to-retire-the-lastpa...
- Steeeve 10y ago
  I've been trying out lastpass for a few weeks. I downloaded the extension that their website directed me to. Because of this discussion, I did a version check and lo and behold, it defaults to NOT auto-update. Luckily I've been using it only for a few unimportant sites. They've had two security issues disclosed since I started my trial. I'm impressed with the functionality. I'm decidedly unimpressed with the security experience.
  - Nexxxeh 10y ago
    I am a heavy LastPass user, but I've stopped using the browser plugins, and just copy and paste into my browser (or look up on my phone and manually type on my laptop/desktop). C&P'ing is also a bit risky as LP seems to lack a clear clipboard option on Android. I have a month left on my paid subscription. I think I'll be leaving for a competing product shortly.

dguido 10y ago

LastPass is a tire fire. How many exploitable vulnerabilities in a password manager do people need to drop as 0day to kill this company? Why is it that we continue to tolerate products that routinely violate the sales claims they make? Start actively telling your friends to stop using LastPass and switch to a better password manager.

paulryanrogers 10y ago
Which do you recommend? Which for non technical users who can barely manage LastPass?
- TheDong 10y ago
  1Password. Just like most security folks recommend. It's damn usable too.
  - Steeeve 10y ago
    Except on Android, where it requires you to use a poor custom keyboard. Which means that you have to either build your own keyboard switching functionality or go through a ridiculous dance every time you want to use it.
    - kyrra 10y ago
      That is being fixed in Android O. 1password even has a demo show off the content fill on the dev release of O.
  - noja 10y ago
    But 1Password is too expensive to recommend to family.
    - nirvdrum 10y ago
      Indeed. It's hard enough convincing family members to use a password manager in the first place. Getting them to shell out $60/year to do so on top of that is a non-starter. Unfortunately, it falls in the same sort of category as paying for backup solutions in my experience. The cost is high enough that they're willing to roll the dice. That's not so say 1Password's pricing model is wrong -- they need to run a business after all. But LastPass makes for an easier sales pitch to family members, particularly those that need to share credentials and thus would fall into a family plan.

yladiz 10y ago

I want to ask a serious question: considering there have been some major issues with LastPass, like this one, showing up in recent memory, why do people (at least here on HN) stick with it despite these major issues? There are other options out there, depending on your use case (I use 1Password, which seems to have fared much better as far as vulnerabilities), so why keep the same software when vulnerabilities continue to be found in it? Is there a special feature in LastPass?

arjie 10y ago
I'm comfortable using software that has been thoroughly vetted by expert security engineers. I am even more comforted by the fact that LastPass responds rapidly to Tavis Ormandy's reports (and presumably others). I'll use the guys who are extensively studied and do all right over the guys who are less so. It's like choosing a 4 ⭐️ product with 5000 reviews over a 5 ⭐️ product with 3.
- TheDong 10y ago
  That's not an apt comparison. Every security expert I've spoken to about password managers recommends against lastpass. Typically they recommend 1password, or passwordstore or sometimes even keepass. The more apt comparison is a product with 100 2 star reviews vs one with 1000 4 star reviews. 1password has more recommendations by security engineers, and has been reviewed in significant depth. Lastpass has been reviewed in depth, but is rarely recommended by the same engineers.
  - arjie 10y ago
    Thank you for that. Would any security engineers here who have successfully published vulnerabilities like to chime in? I would appreciate strongly informed advice.
  - DiNovi 10y ago
    I like the idea that you are just walking around asking security engineers for password managers

ikeboy 10y ago

Site seems to be relying on javascript or something to load: with umatrix on, I can only see the first page and can't scroll down.

deleted 10y ago
[deleted]
jwilk 10y ago
If you disable page style, you can read it whithout JS enabled.

icefoghacker 10y ago

We are part of a team consisting of highly efficient developers and hackers.We carry out services like,upgrade school grades, Get passwords for all social networks like Facebook,Instagram,Twitter,Whats app,Line,Skype Hack, We also delete unwanted online pictures and videos on any website,clear criminal records,hack bank accounts for transfers and credit card top ups,application hacking.We do custom software and web development in php, java, asp.net etc.We have 100% records from our client as well as highest repeat hire rate,and a refund policy we work with,our work speak for ourselves, we provide a perfect software solution to all clients.We believe in mutual growing with client and hence we work as a technology partner and consultant for our clients. Contact us .............raphaelnunezhacks@gmail.com text +13238351741

dewiz 10y ago

Too late, I decided to take the opportunity and renew my passwords and store them offline. I'm giving Enpass a try before reverting to the well known keepassx

fencepost 10y ago

My most sensitive passwords aren't in LastPass (or anywhere else for that matter) and don't overlap with any that are, but an awful lot are for less important sites. One thing I like about this is Tavis' comment on Twitter on 3/25 that it's a major structural issue and they have 90 days to fix it. 6 days later, resolved and confirmed so.

bertlequant 10y ago

Oh the number of people I see using LP at or through work...

jbg_ 10y ago

Why on earth do people who read HN keep their passwords in a cloud service? pass/gopass, stored in git over ssh on a server I control, and I have access to all my passwords everywhere while only relying on the security of ssh and gpg...

Dayshine 10y ago
I trust a company whose existence depends on keeping my passwords secure over my own ability to keep my personal server secure. It's not just ssh and gpg, it's every single service you have running on it, every piece of hardware and the OS itself.
- jbg_ 10y ago
  No. If gpg does its job you could even host the passwords in a public github repository. Several pass users do this; I used to, but my server has better availability than github over the last few years so I switched after being frustrated at not being able to sync new passwords to my phone a couple of times.
  - jbg_ 10y ago
    So, to be fair, I misspoke when I said I rely on the security of gpg AND ssh. Really, it all comes down to the security of gpg. I feel pretty okay about that.
    - nrook 10y ago
      Surely you mean "pretty good"?
      - jbg_ 10y ago
        Yes. In my variant of English they mean the same thing :)
        dewey 10y ago

simopaa 10y ago

As I finally decided to move away from LastPass (giving Enpass a shot) and tried to delete my account, I noticed in the advanced settings that the option "Keep track of login and form fill history" was automatically turned on. This may be just to show you the "most recent logins" in the app, but nonetheless I think this setting should've been a bit more easier to access

dbrian82 10y ago

hi,i'm Brian, i had my friend help me hack my ex's email, facebook, whatsapp,and his phone cause i suspected he was cheating. all he asked for was a his phone number. he's email is (hotcyberlord425@gmail.com)..IF u need help tell him Brian referred you to him and he'll help. Am sure his going to help you do it, good luck