4 ms·

Sorry, what do you mean by "to log in to their bbuletin or whatever php forum"? According to LastPass, they don't have access to the master password // presuma

Sorry, what do you mean by "to log in to their bbuletin or whatever php forum"? According to LastPass, they don't have access to the master password // presumably it's not stored on their side. Is that accurate..? Thanks

40four 5y ago
I don’t use Lastpass, but if what you are saying is correct, they could not have sent the OP an e-mail (assuming it’s legit) informing them of the attempt to sign in using the master pass from Brazil, right?
- lillecarl 5y ago
  Cryptography means lastpass doesn't need the master password to verify the password.
  - Retric 5y ago
    If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password. It’s a combination of people being very bad at generating, remembering, and entering passwords plus generally being unwilling to wait minutes or even seconds to generate the hash on their local computer.
    - md_ 5y ago
      > If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password. I mean, technically this is true, but it's also true if you have the ciphertext of the stored-password database, which is sort of LastPass's entire job. ;) The only thing that might make it harder to brute force the master password with the latter than with a hashed password database is if the key derivation algorithm differs. But I think your blanket statement is sort of misleading. In principle, if you trust someone with your encrypted password storage database, you should trust them with a hash of your master password; both serve as brute forcing oracles.
    - EVa5I7bHFq9mnYK 5y ago
      MD5 is long considered a broken, weak hash algorithm. Here is the MD5 hash of a password: d9afca35a87a2af4168500640fcf2370 Password is 16 characters long, all lower case, no numbers, no special symbols. Please tell me the password.
      - Retric 5y ago
        What percentage of people do you think actually use 16 character passwords?
        40four 5y ago
        Probably pretty low. I use 64 character passwords, or if there is a length limit, always the longest possible. That’s the beauty of using a password manager :)
        NmAmDa 5y ago
        Do you use 64 character master password?
        DrivebySecurity 5y ago
        One advantage about having memorized a bunch of poetry back in the day is I have a lot of secure long passphrases to hand Aesop, my author, makes mention of two mice and they were sisters dear 1234567890123456789012345678901234567890123456789012345678901234567890 70 and little effort
        mod 5y ago
        I consider mine pretty long, and it's right around 30 characters.
      - tyingq 5y ago
        56 billion md5 hashes per second for $1.80 per hour at OVH. (single Nvidia Tesla v100 GPU) Still a no-go for plain old brute forcing all a-z combinations. But, if your password is some combination of actual words, common keyboard sequences, or anything else in a password dictionary, it's cracked pretty quick/cheap.
  - deleted 5y ago
    [deleted]
indigochill 5y ago
You don't need access to a password to check it, just the hash (then they hash what you enter and compare the hash to the one they have). So both "They use it to log in to their whatever" and "They don't have access to it" can be correct.
- hsbauauvhabzb 5y ago
  If there’s a breached phpbb instance, the attacker can modify login.php to log plaintext credentials.
gkoberger 5y ago
After a bit of searching, I wasn't able to find any PHP forum software that LastPass lets you log in to. I could only find one official-seeming forum, and it uses a different login. So, I think this is FUD... I don't use LastPass, but accusing them of something like this (and using the phrase "or whatever") is pretty serious without proof.
- ComputerGuru 5y ago
  They appear to have sunset their phpBB instance. It was the main hub and support portal on their website with up to thousands of active visitors at any given time. You can see it archived here: https://web.archive.org/web/20150629081250/https://forums.lastpass.com/ https://web.archive.org/web/20150629081250/https://forums.la... Here's the archived phpBB login page. It asks for your LastPass login and password (not your forum account, your actual LastPass login and actual LastPass master password): https://web.archive.org/web/20150717071236/https://lastpass.com/?ac=1&from_uri=https%3A%2F%2Flastpass.com%2Fsaml%2Fmodule.php%2Flpauth%2Fresume.php%3FState%3D_e80712e721ff063b566e9e962d0fb43f82fb424434%253Ahttps%253A%252F%252Flastpass.com%252Fsaml%252Fmodule.php%252Fcore%252Fas_login.php%253FAuthId%253Dlpauth%2526ReturnTo%253Dhttps%25253A%25252F%25252Flastpass.com%25252Fsaml%25252Flogin%25252F7907806%25252Fa566%25253FSAMLRequest%25253DfZHRboIwFIbv9xSk90CL1EojGNQsMXGL0W0Xu6twiCSUsp7itrcfw5lsF7OX%2525252Fc%2525252FX8%2525252BfrfPGhG%2525252B8MFmvTpoQFlCyyO%2525252B9y5qh008m8d6d2D289oPOG8RblGKSkt600CmuUrdKA0hXykD9sZRRQ2VnjTGEa8gu5TShEsG7oQbzNOiXfgPWj2bGAUlVQTaNJFceCMTEVnLJEJJTFrIqBA42EUHwKPJmImE2LZHaMGZ8UjMfDW4g9bFp0qnUpiSjjPhU%2525252BE0%2525252BUSz6TlL0S7%2525252BUqYOhBvPxaZGVa7DXYA9hzXcDzfpuSk3MdyjCsjO01Bo1C1w3Ng8LokGSjMjmutNl2yHZDJrtTt1zKG%2525252BQ8%2525252FM39eH8cDG3WO9PUxaeXN415X1lQDlLibA%2525252FEuzdWK%2525252Fe%2525252FUxaw8aYu%2525252FWoclaBV3eRlaQGRhNll698Pzr4A%252526RelayState%25253Dhttps%2525253A%2525252F%2525252Fforums.lastpass.com%2525252F&lcid=7907806&lcidhash=a566 https://web.archive.org/web/20150717071236/https://lastpass.... Here's a past HN discussion from the time with some guesses at how such a phpBB login using the master password could, theoretically, be implemented without knowledge of the password. Note that this doesn't imply it's possible to implement it in a way that would be resistant to their web server (running phpBB!!!!) being compromised: https://news.ycombinator.com/item?id=16016171 https://news.ycombinator.com/item?id=16016171
  - 5y ago

40four 5y ago

I don’t use Lastpass, but if what you are saying is correct, they could not have sent the OP an e-mail (assuming it’s legit) informing them of the attempt to sign in using the master pass from Brazil, right?

lillecarl 5y ago
Cryptography means lastpass doesn't need the master password to verify the password.
- Retric 5y ago
  If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password. It’s a combination of people being very bad at generating, remembering, and entering passwords plus generally being unwilling to wait minutes or even seconds to generate the hash on their local computer.
  - md_ 5y ago
    > If you have the hash and algorithm used to generate it of a human generated password you can in the vast majority of cases get the password. I mean, technically this is true, but it's also true if you have the ciphertext of the stored-password database, which is sort of LastPass's entire job. ;) The only thing that might make it harder to brute force the master password with the latter than with a hashed password database is if the key derivation algorithm differs. But I think your blanket statement is sort of misleading. In principle, if you trust someone with your encrypted password storage database, you should trust them with a hash of your master password; both serve as brute forcing oracles.
  - EVa5I7bHFq9mnYK 5y ago
    MD5 is long considered a broken, weak hash algorithm. Here is the MD5 hash of a password: d9afca35a87a2af4168500640fcf2370 Password is 16 characters long, all lower case, no numbers, no special symbols. Please tell me the password.
    - Retric 5y ago
      What percentage of people do you think actually use 16 character passwords?
      - 40four 5y ago
        Probably pretty low. I use 64 character passwords, or if there is a length limit, always the longest possible. That’s the beauty of using a password manager :)
        NmAmDa 5y ago
        Do you use 64 character master password?
        DrivebySecurity 5y ago
        One advantage about having memorized a bunch of poetry back in the day is I have a lot of secure long passphrases to hand Aesop, my author, makes mention of two mice and they were sisters dear 1234567890123456789012345678901234567890123456789012345678901234567890 70 and little effort
        mod 5y ago
        I consider mine pretty long, and it's right around 30 characters.
    - tyingq 5y ago
      56 billion md5 hashes per second for $1.80 per hour at OVH. (single Nvidia Tesla v100 GPU) Still a no-go for plain old brute forcing all a-z combinations. But, if your password is some combination of actual words, common keyboard sequences, or anything else in a password dictionary, it's cracked pretty quick/cheap.
- deleted 5y ago
  [deleted]

indigochill 5y ago

You don't need access to a password to check it, just the hash (then they hash what you enter and compare the hash to the one they have). So both "They use it to log in to their whatever" and "They don't have access to it" can be correct.

hsbauauvhabzb 5y ago
If there’s a breached phpbb instance, the attacker can modify login.php to log plaintext credentials.

gkoberger 5y ago

After a bit of searching, I wasn't able to find any PHP forum software that LastPass lets you log in to. I could only find one official-seeming forum, and it uses a different login. So, I think this is FUD... I don't use LastPass, but accusing them of something like this (and using the phrase "or whatever") is pretty serious without proof.

ComputerGuru 5y ago
They appear to have sunset their phpBB instance. It was the main hub and support portal on their website with up to thousands of active visitors at any given time. You can see it archived here: https://web.archive.org/web/20150629081250/https://forums.lastpass.com/ https://web.archive.org/web/20150629081250/https://forums.la... Here's the archived phpBB login page. It asks for your LastPass login and password (not your forum account, your actual LastPass login and actual LastPass master password): https://web.archive.org/web/20150717071236/https://lastpass.com/?ac=1&from_uri=https%3A%2F%2Flastpass.com%2Fsaml%2Fmodule.php%2Flpauth%2Fresume.php%3FState%3D_e80712e721ff063b566e9e962d0fb43f82fb424434%253Ahttps%253A%252F%252Flastpass.com%252Fsaml%252Fmodule.php%252Fcore%252Fas_login.php%253FAuthId%253Dlpauth%2526ReturnTo%253Dhttps%25253A%25252F%25252Flastpass.com%25252Fsaml%25252Flogin%25252F7907806%25252Fa566%25253FSAMLRequest%25253DfZHRboIwFIbv9xSk90CL1EojGNQsMXGL0W0Xu6twiCSUsp7itrcfw5lsF7OX%2525252Fc%2525252FX8%2525252BfrfPGhG%2525252B8MFmvTpoQFlCyyO%2525252B9y5qh008m8d6d2D289oPOG8RblGKSkt600CmuUrdKA0hXykD9sZRRQ2VnjTGEa8gu5TShEsG7oQbzNOiXfgPWj2bGAUlVQTaNJFceCMTEVnLJEJJTFrIqBA42EUHwKPJmImE2LZHaMGZ8UjMfDW4g9bFp0qnUpiSjjPhU%2525252BE0%2525252BUSz6TlL0S7%2525252BUqYOhBvPxaZGVa7DXYA9hzXcDzfpuSk3MdyjCsjO01Bo1C1w3Ng8LokGSjMjmutNl2yHZDJrtTt1zKG%2525252BQ8%2525252FM39eH8cDG3WO9PUxaeXN415X1lQDlLibA%2525252FEuzdWK%2525252Fe%2525252FUxaw8aYu%2525252FWoclaBV3eRlaQGRhNll698Pzr4A%252526RelayState%25253Dhttps%2525253A%2525252F%2525252Fforums.lastpass.com%2525252F&lcid=7907806&lcidhash=a566 https://web.archive.org/web/20150717071236/https://lastpass.... Here's a past HN discussion from the time with some guesses at how such a phpBB login using the master password could, theoretically, be implemented without knowledge of the password. Note that this doesn't imply it's possible to implement it in a way that would be resistant to their web server (running phpBB!!!!) being compromised: https://news.ycombinator.com/item?id=16016171 https://news.ycombinator.com/item?id=16016171
- 5y ago