4 ms·

It states in the article that among other things, Autho and LastPass credentials were stolen. I’m a 1Password user so am not familiar with those password manage

It states in the article that among other things, Autho and LastPass credentials were stolen. I’m a 1Password user so am not familiar with those password managers. Don’t they encrypt the credentials making theft of the data useless? Or am I missing something?

prox 7y ago
Not sure, but reading that I was assuming that the malware was able to intercept the master password for these services. So the attackers could log into those accounts.
- obituary_latte 7y ago
  Ah ok yeah that makes perfect sense - if it was keylogging then all bets were off.
- notlukesky 7y ago
  SAASPASS is a password manager that unlocks on the desktop only with multi-factor authentication. There is no master password to be stolen.
  - oarsinsync 7y ago
    Multi-factor means more than one factor. Something you have + something you know are multiple factors. There should still be a password. If there isn't, then it's single factor auth. Also, SAASPASS looks really interesting. Thanks for sharing. Going to take a much deeper look into this now. EDIT: Nope, change of plans. The account recovery flow depends on SMS, which isn't safe given how easy SIM-jacking is: https://saaspass.com/how-to-recover-saaspass-id-account/ https://saaspass.com/how-to-recover-saaspass-id-account/
    - tialaramex 7y ago
      Ideally when you have a less capable device-based solution to "Something you have" like a FIDO token you want the user to enter their password (a "Something you know" factor) into that device, not the general purpose computer. So now the password isn't in the computer at all and can't be stolen from it. For example to sign into the web site for my bank account I need to enter a PIN into a chiclet keypad device they gave me, it spits out a one-time code and I type that into the web site. You can't steal the PIN from my PC, even if you have some kind of super zero day exploit and co-operation from the OS vendor, because the PIN gets typed into a separate device that doesn't even have a USB connector. You might as well try to use the PC to steal cash out of my wallet.
    - notlukesky 7y ago
      Actually not. There is account recovery options that include a separate custom question and answer (password let’s say), and also the option of cloning it from another device as well. Those two different methods mitigate against SIM jacking.
      - oarsinsync 7y ago
        See this link from today: https://news.ycombinator.com/item?id=22016212 https://news.ycombinator.com/item?id=22016212 The parent's whole point was that this service doesn't have a master password. Nope, instead it has a 4 digit PIN and SMS as it's base flow, with security as an optional extra. A password manager shouldn't need to be caveated to be recommended. It's too important for that.
  - DownGoat 7y ago
    No password managers really help in this scenario, as the attackers have access to the machine the client runs on. Any malware will simply wait untill you unlock it, and then siphon out any credentials.
    - notlukesky 7y ago
      True in that case as that has nothing to do with the password manager. Any password that you would type in manually is also vulnerable.
- zxczxc111 7y ago
  So what you're saying is, they need 2FA for their 2FA
StavrosK 7y ago
You can also probably extract everything from memory if the password manager is unlocked, I'd guess.
- obituary_latte 7y ago
  1Password automatically locks after some predetermined amount of time - wonder if those other two do as well. I guess it doesn’t really matter, though, if the malware is smart enough to be reading mem it’s probably smart enough to just wait until the db is unlocked to copy.
  - y4mi 7y ago
    > 1Password automatically locks after some predetermined amount of time only if enabled. Just like any password manager out there.
    - Maximus9000 7y ago
      for what it's worth, it's enabled by default to 10 minutes.
diamondo25 7y ago
If your pc is in any way compromised, and no 2fa is enabled (and the 2fa device is not compromised as well), you must assume everything is or has been available to the evil actor. Sometimes, its a drive-by download or a dropper malware that will install other virii. You will never really know what went in or out your pc...
lukasm 7y ago
Here is a potential solution to solve a problem of LastPass being a single point of failure http://lukasz-madon.github.io/Password-management/ http://lukasz-madon.github.io/Password-management/
- 3fe9a03ccd14ca5 7y ago
  Sounds complicated. I’m sure the world will still be much better off if people used password managers as-is, even with the drawbacks.
milesokeefe 7y ago
Auth0 isn't a password manager. It's an authorization platform. If they stole Auth0 API secret keys and/or saved logins to the Auth0 management portal, they'd have access to other users' accounts but not passwords.

prox 7y ago

Not sure, but reading that I was assuming that the malware was able to intercept the master password for these services. So the attackers could log into those accounts.

obituary_latte 7y ago
Ah ok yeah that makes perfect sense - if it was keylogging then all bets were off.
notlukesky 7y ago
SAASPASS is a password manager that unlocks on the desktop only with multi-factor authentication. There is no master password to be stolen.
- oarsinsync 7y ago
  Multi-factor means more than one factor. Something you have + something you know are multiple factors. There should still be a password. If there isn't, then it's single factor auth. Also, SAASPASS looks really interesting. Thanks for sharing. Going to take a much deeper look into this now. EDIT: Nope, change of plans. The account recovery flow depends on SMS, which isn't safe given how easy SIM-jacking is: https://saaspass.com/how-to-recover-saaspass-id-account/ https://saaspass.com/how-to-recover-saaspass-id-account/
  - tialaramex 7y ago
    Ideally when you have a less capable device-based solution to "Something you have" like a FIDO token you want the user to enter their password (a "Something you know" factor) into that device, not the general purpose computer. So now the password isn't in the computer at all and can't be stolen from it. For example to sign into the web site for my bank account I need to enter a PIN into a chiclet keypad device they gave me, it spits out a one-time code and I type that into the web site. You can't steal the PIN from my PC, even if you have some kind of super zero day exploit and co-operation from the OS vendor, because the PIN gets typed into a separate device that doesn't even have a USB connector. You might as well try to use the PC to steal cash out of my wallet.
  - notlukesky 7y ago
    Actually not. There is account recovery options that include a separate custom question and answer (password let’s say), and also the option of cloning it from another device as well. Those two different methods mitigate against SIM jacking.
    - oarsinsync 7y ago
      See this link from today: https://news.ycombinator.com/item?id=22016212 https://news.ycombinator.com/item?id=22016212 The parent's whole point was that this service doesn't have a master password. Nope, instead it has a 4 digit PIN and SMS as it's base flow, with security as an optional extra. A password manager shouldn't need to be caveated to be recommended. It's too important for that.
- DownGoat 7y ago
  No password managers really help in this scenario, as the attackers have access to the machine the client runs on. Any malware will simply wait untill you unlock it, and then siphon out any credentials.
  - notlukesky 7y ago
    True in that case as that has nothing to do with the password manager. Any password that you would type in manually is also vulnerable.
zxczxc111 7y ago
So what you're saying is, they need 2FA for their 2FA

StavrosK 7y ago

You can also probably extract everything from memory if the password manager is unlocked, I'd guess.

obituary_latte 7y ago
1Password automatically locks after some predetermined amount of time - wonder if those other two do as well. I guess it doesn’t really matter, though, if the malware is smart enough to be reading mem it’s probably smart enough to just wait until the db is unlocked to copy.
- y4mi 7y ago
  > 1Password automatically locks after some predetermined amount of time only if enabled. Just like any password manager out there.
  - Maximus9000 7y ago
    for what it's worth, it's enabled by default to 10 minutes.

diamondo25 7y ago

If your pc is in any way compromised, and no 2fa is enabled (and the 2fa device is not compromised as well), you must assume everything is or has been available to the evil actor. Sometimes, its a drive-by download or a dropper malware that will install other virii. You will never really know what went in or out your pc...

lukasm 7y ago

Here is a potential solution to solve a problem of LastPass being a single point of failure http://lukasz-madon.github.io/Password-management/ http://lukasz-madon.github.io/Password-management/

3fe9a03ccd14ca5 7y ago
Sounds complicated. I’m sure the world will still be much better off if people used password managers as-is, even with the drawbacks.

milesokeefe 7y ago

Auth0 isn't a password manager. It's an authorization platform. If they stole Auth0 API secret keys and/or saved logins to the Auth0 management portal, they'd have access to other users' accounts but not passwords.