6 ms·

This is framed so negatively toward LastPass, which is unfortunate. They stopped all usage of correct passwords they believed were compromised, which is exactly

This is framed so negatively toward LastPass, which is unfortunate. They stopped all usage of correct passwords they believed were compromised, which is exactly what I'd want them to do in this situation. Them warning users their master passwords are compromised is a good thing! Yet it's framed as though they're admitting to something. "However, users receiving these warnings have stated that their passwords are unique to LastPass and not used elsewhere." That's really hard to verify. I think most users would say that rather than admit they re-used passwords (or used similar passwords that were easy to reverse engineer). Since there only seems to be 2-3 reports of this, and they're self-reported and not cited, it doesn't seem like LastPass was compromised. I'm not saying I like LastPass (I use 1Password and find LastPass to be much worse), but I haven't seen any indication at this point that LastPass has been compromised at all. (To be clear, it's very possible I'm wrong and this message won't age well. But so far, it seems like LastPass is doing its job, and I'd want to see more than this before jumping on the blame-LastPass bandwagon.)

vorpalhex 5y ago
LastPass has had enough other security issues that I am doubtful of them to this day. https://www.mcafee.com/blogs/enterprise/cloud-security/lastpass-breach-by-the-numbers-91-enterprises-exposed/ https://www.mcafee.com/blogs/enterprise/cloud-security/lastp... Unfortunately the only password solutions I would recommend at this point are 1Password for something turn key, and BitWarden if you want to self host.
- gkoberger 5y ago
  Agreed, and I highly recommend 1Password. But just because they've had problems in the past doesn't mean the framing of this article is fair. The title made me think everyone's passwords were compromised due to a leak or hack, when in reality the article is a rehash of a HN post from yesterday.
  - vorpalhex 5y ago
    The official story from LastPass and the claims of the reporters are in direct conflict. Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. One [incident] reporter claims they changed their master password and had a breach attempt using the new password. If that is true that is extremely alarming. There could be some malware targeting a LastPass extension or app cache somewhere, but that is groundless theory on my part.
    - tgsovlerkhgsel 5y ago
      > Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. As you mention yourself at the end, there are other plausible explanations (e.g. malware on the machines).
      - vorpalhex 5y ago
        If there is a LastPass cache that is not encrypted, that is a breach since it is an application flaw. If it is something like a keylogger, not so much.
        dqv 5y ago
        The LastPass extension can be told to remember your master password. They say it's not recommended. We might be seeing the result of people opting to store their master password and something that exploits this.
- karmanyaahm 5y ago
  Bitwarden also has an easy to use hosted service
- 3np 5y ago
  password-store aka GNU Pass, couple with your file-sync software of choice (your choice if you want to self-host or cloud).
ksec 5y ago
>Since there only seems to be 2-3 reports of this, and they're self-reported and not cited, it doesn't seem like LastPass was compromised. There are now over 20 in the original HN [1] thread. ( Excluding reports from Reddit and Twitter ) From password never used since 2017 to account newly created in the past few months. OP has full Bio, Links and Credential, others have long history on HN and karma points. I did at one point suspected a PR attack on Lastpass, ( sorry guys ) but that is somewhat unlikely. Of course, this doesn't rule out a malware running wild. [1] https://news.ycombinator.com/item?id=29705957 https://news.ycombinator.com/item?id=29705957
foxfluff 5y ago
It's negative because something's up and they haven't given a good explanation. > They stopped all usage of correct passwords they believed were compromised Immediate question: how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? From the information provided, the only thing they have is the IP & geolocation data, which isn't going to be reliable when the attacker(s) are using VPNs. For everyone whose account was protected by blocking access from odd region, how many are there whose accounts were quietly accessed and no email was shot off to warn the owner? They are claiming that the master password was used on some other (compromised) service, but they provide zero evidence for this. And if they don't know your passwords, how on earth do they know that you've reused them on a compromised service? Can they name that service? Has anyone yet found a service every affected user has in common? I haven't seen that. > "However, users receiving these warnings have stated that their passwords are unique to LastPass and not used elsewhere." That's really hard to verify. That is true, but there are so many reports now that it's really hard for me to believe they were all dumb enough to reuse their master passwords elsewhere and are also bullshitting us on HN. > I haven't seen any indication at this point that LastPass has been compromised at all. Neither have I, but I still believe it to be a plausible explanation. I don't think we have a "smoking gun" or a site/service/extension that is common to everyone who reported this thing happening to them.
- srcreigh 5y ago
  Login attempts from unusual locations
- dqv 5y ago
  I'm not here to defend LastPass, but there are some rational answers to the questions you're asking, a lot of them having to do with human psychology. First thing's first, and yes I am "victim blaming" when I say this: 60% of users reuse their passwords. [0,1] It's a widespread problem. Maybe that number is lower for a technical site like HN, but I have encountered technical people who do not practice what they preach. >how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? You can check for a compromised password the same way you check if a password is valid, both without having stored the original password in plaintext. You have a list of known-compromised hashes and see if the hashed password is in that list. [2] >For everyone whose account was protected by blocking access from odd region, how many are there whose accounts were quietly accessed and no email was shot off to warn the owner? None based on my experience with the service. Each time you login from an unrecognized device or IP, you receive an email and have to confirm the login. It's good hygiene to check the access logs, although I've been dirty in that regard. >They are claiming that the master password was used on some other (compromised) service, but they provide zero evidence for this. And if they don't know your passwords, how on earth do they know that you've reused them on a compromised service? Can they name that service? No. And they probably won't ever be able to. And probably neither will anyone else. See [2]. >That is true, but there are so many reports now that it's really hard for me to believe they were all dumb enough to reuse their master passwords elsewhere and are also bullshitting us on HN. Well I can imagine a few things going on. Like that 60% reuse number in [0], there are probably a lot of people who did reuse their master password. I'd be embarrassed myself to admit I reused a password and it got compromised (correction: I have reused passwords and have been compromised, luckily not in a damaging way). You're kind of exemplifying that point by calling someone who would do that "dumb enough". The other group of people who really didn't reuse their passwords may have done something I did a few weeks ago - forgot I was connected with a VPN. I SSH'd into a server, saw a weird IP and freaked out. Then after 15 minutes of investigation, I realized duh I was just connected through a VPN in Europe. >bullshitting us on HN I'd be careful about this assumption. I have seen people bullshitting here. I won't go as far as outright denying that people haven't reused their passwords, but I am always a little skeptical of things like this (i.e. where people say one thing because they're embarrassed about being associated with the other). It has certainly heightened my senses. >I don't think we have a "smoking gun" or a site/service/extension that is common to everyone who reported this thing happening to them. As has been theorized elsewhere, it's very possible we're seeing early signs of the results of the log4j exploits. I'm in wait and watch mode to see if LP really is compromised. [0]: https://spycloud.com/password-reuse/ https://spycloud.com/password-reuse/ [1]: https://www.troyhunt.com/password-reuse-credential-stuffing-and-another-1-billion-records-in-have-i-been-pwned/#:~:text=Because%20of%20the%20prevalence%20with%20which%20people%20reuse%20their%20accounts%2C%20nobody%20who%20confirmed%20their%20password%20could%20actually%20tell%20me%20where%20it%20came%20from!%20Could%20have%20been%20anywhere.%20Who%20knows%2C%20it%27s%20%22their%20standard%20password%22 https://www.troyhunt.com/password-reuse-credential-stuffing-.... [2]: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords A password from my late childhood to early teens shows up 150 times
DennisP 5y ago
Apparently this just started yesterday. If someone's LastPass account has been successfully compromised since then, we might not hear about it until that person logs into another account and discovers funds missing.

vorpalhex 5y ago

LastPass has had enough other security issues that I am doubtful of them to this day. https://www.mcafee.com/blogs/enterprise/cloud-security/lastpass-breach-by-the-numbers-91-enterprises-exposed/ https://www.mcafee.com/blogs/enterprise/cloud-security/lastp... Unfortunately the only password solutions I would recommend at this point are 1Password for something turn key, and BitWarden if you want to self host.

gkoberger 5y ago
Agreed, and I highly recommend 1Password. But just because they've had problems in the past doesn't mean the framing of this article is fair. The title made me think everyone's passwords were compromised due to a leak or hack, when in reality the article is a rehash of a HN post from yesterday.
- vorpalhex 5y ago
  The official story from LastPass and the claims of the reporters are in direct conflict. Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. One [incident] reporter claims they changed their master password and had a breach attempt using the new password. If that is true that is extremely alarming. There could be some malware targeting a LastPass extension or app cache somewhere, but that is groundless theory on my part.
  - tgsovlerkhgsel 5y ago
    > Either the master passwords were reused and this is credential stuffing, or there is actually a LastPass breach affecting all users. As you mention yourself at the end, there are other plausible explanations (e.g. malware on the machines).
    - vorpalhex 5y ago
      If there is a LastPass cache that is not encrypted, that is a breach since it is an application flaw. If it is something like a keylogger, not so much.
      - dqv 5y ago
        The LastPass extension can be told to remember your master password. They say it's not recommended. We might be seeing the result of people opting to store their master password and something that exploits this.
karmanyaahm 5y ago
Bitwarden also has an easy to use hosted service
3np 5y ago
password-store aka GNU Pass, couple with your file-sync software of choice (your choice if you want to self-host or cloud).

ksec 5y ago

>Since there only seems to be 2-3 reports of this, and they're self-reported and not cited, it doesn't seem like LastPass was compromised. There are now over 20 in the original HN [1] thread. ( Excluding reports from Reddit and Twitter ) From password never used since 2017 to account newly created in the past few months. OP has full Bio, Links and Credential, others have long history on HN and karma points. I did at one point suspected a PR attack on Lastpass, ( sorry guys ) but that is somewhat unlikely. Of course, this doesn't rule out a malware running wild. [1] https://news.ycombinator.com/item?id=29705957 https://news.ycombinator.com/item?id=29705957

foxfluff 5y ago

It's negative because something's up and they haven't given a good explanation. > They stopped all usage of correct passwords they believed were compromised Immediate question: how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? From the information provided, the only thing they have is the IP & geolocation data, which isn't going to be reliable when the attacker(s) are using VPNs. For everyone whose account was protected by blocking access from odd region, how many are there whose accounts were quietly accessed and no email was shot off to warn the owner? They are claiming that the master password was used on some other (compromised) service, but they provide zero evidence for this. And if they don't know your passwords, how on earth do they know that you've reused them on a compromised service? Can they name that service? Has anyone yet found a service every affected user has in common? I haven't seen that. > "However, users receiving these warnings have stated that their passwords are unique to LastPass and not used elsewhere." That's really hard to verify. That is true, but there are so many reports now that it's really hard for me to believe they were all dumb enough to reuse their master passwords elsewhere and are also bullshitting us on HN. > I haven't seen any indication at this point that LastPass has been compromised at all. Neither have I, but I still believe it to be a plausible explanation. I don't think we have a "smoking gun" or a site/service/extension that is common to everyone who reported this thing happening to them.

srcreigh 5y ago
Login attempts from unusual locations
dqv 5y ago
I'm not here to defend LastPass, but there are some rational answers to the questions you're asking, a lot of them having to do with human psychology. First thing's first, and yes I am "victim blaming" when I say this: 60% of users reuse their passwords. [0,1] It's a widespread problem. Maybe that number is lower for a technical site like HN, but I have encountered technical people who do not practice what they preach. >how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? You can check for a compromised password the same way you check if a password is valid, both without having stored the original password in plaintext. You have a list of known-compromised hashes and see if the hashed password is in that list. [2] >For everyone whose account was protected by blocking access from odd region, how many are there whose accounts were quietly accessed and no email was shot off to warn the owner? None based on my experience with the service. Each time you login from an unrecognized device or IP, you receive an email and have to confirm the login. It's good hygiene to check the access logs, although I've been dirty in that regard. >They are claiming that the master password was used on some other (compromised) service, but they provide zero evidence for this. And if they don't know your passwords, how on earth do they know that you've reused them on a compromised service? Can they name that service? No. And they probably won't ever be able to. And probably neither will anyone else. See [2]. >That is true, but there are so many reports now that it's really hard for me to believe they were all dumb enough to reuse their master passwords elsewhere and are also bullshitting us on HN. Well I can imagine a few things going on. Like that 60% reuse number in [0], there are probably a lot of people who did reuse their master password. I'd be embarrassed myself to admit I reused a password and it got compromised (correction: I have reused passwords and have been compromised, luckily not in a damaging way). You're kind of exemplifying that point by calling someone who would do that "dumb enough". The other group of people who really didn't reuse their passwords may have done something I did a few weeks ago - forgot I was connected with a VPN. I SSH'd into a server, saw a weird IP and freaked out. Then after 15 minutes of investigation, I realized duh I was just connected through a VPN in Europe. >bullshitting us on HN I'd be careful about this assumption. I have seen people bullshitting here. I won't go as far as outright denying that people haven't reused their passwords, but I am always a little skeptical of things like this (i.e. where people say one thing because they're embarrassed about being associated with the other). It has certainly heightened my senses. >I don't think we have a "smoking gun" or a site/service/extension that is common to everyone who reported this thing happening to them. As has been theorized elsewhere, it's very possible we're seeing early signs of the results of the log4j exploits. I'm in wait and watch mode to see if LP really is compromised. [0]: https://spycloud.com/password-reuse/ https://spycloud.com/password-reuse/ [1]: https://www.troyhunt.com/password-reuse-credential-stuffing-and-another-1-billion-records-in-have-i-been-pwned/#:~:text=Because%20of%20the%20prevalence%20with%20which%20people%20reuse%20their%20accounts%2C%20nobody%20who%20confirmed%20their%20password%20could%20actually%20tell%20me%20where%20it%20came%20from!%20Could%20have%20been%20anywhere.%20Who%20knows%2C%20it%27s%20%22their%20standard%20password%22 https://www.troyhunt.com/password-reuse-credential-stuffing-.... [2]: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords A password from my late childhood to early teens shows up 150 times

DennisP 5y ago

Apparently this just started yesterday. If someone's LastPass account has been successfully compromised since then, we might not hear about it until that person logs into another account and discovers funds missing.