4 ms·

It's negative because something's up and they haven't given a good explanation. > They stopped all usage of correct passwords they believed were compromised I

It's negative because something's up and they haven't given a good explanation. > They stopped all usage of correct passwords they believed were compromised Immediate question: how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? From the information provided, the only thing they have is the IP & geolocation data, which isn't going to be reliable when the attacker(s) are using VPNs. For everyone whose account was protected by blocking access from odd region, how many are there whose accounts were quietly accessed and no email was shot off to warn the owner? They are claiming that the master password was used on some other (compromised) service, but they provide zero evidence for this. And if they don't know your passwords, how on earth do they know that you've reused them on a compromised service? Can they name that service? Has anyone yet found a service every affected user has in common? I haven't seen that. > "However, users receiving these warnings have stated that their passwords are unique to LastPass and not used elsewhere." That's really hard to verify. That is true, but there are so many reports now that it's really hard for me to believe they were all dumb enough to reuse their master passwords elsewhere and are also bullshitting us on HN. > I haven't seen any indication at this point that LastPass has been compromised at all. Neither have I, but I still believe it to be a plausible explanation. I don't think we have a "smoking gun" or a site/service/extension that is common to everyone who reported this thing happening to them.

srcreigh 5y ago
Login attempts from unusual locations
dqv 5y ago
I'm not here to defend LastPass, but there are some rational answers to the questions you're asking, a lot of them having to do with human psychology. First thing's first, and yes I am "victim blaming" when I say this: 60% of users reuse their passwords. [0,1] It's a widespread problem. Maybe that number is lower for a technical site like HN, but I have encountered technical people who do not practice what they preach. >how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? You can check for a compromised password the same way you check if a password is valid, both without having stored the original password in plaintext. You have a list of known-compromised hashes and see if the hashed password is in that list. [2] >For everyone whose account was protected by blocking access from odd region, how many are there whose accounts were quietly accessed and no email was shot off to warn the owner? None based on my experience with the service. Each time you login from an unrecognized device or IP, you receive an email and have to confirm the login. It's good hygiene to check the access logs, although I've been dirty in that regard. >They are claiming that the master password was used on some other (compromised) service, but they provide zero evidence for this. And if they don't know your passwords, how on earth do they know that you've reused them on a compromised service? Can they name that service? No. And they probably won't ever be able to. And probably neither will anyone else. See [2]. >That is true, but there are so many reports now that it's really hard for me to believe they were all dumb enough to reuse their master passwords elsewhere and are also bullshitting us on HN. Well I can imagine a few things going on. Like that 60% reuse number in [0], there are probably a lot of people who did reuse their master password. I'd be embarrassed myself to admit I reused a password and it got compromised (correction: I have reused passwords and have been compromised, luckily not in a damaging way). You're kind of exemplifying that point by calling someone who would do that "dumb enough". The other group of people who really didn't reuse their passwords may have done something I did a few weeks ago - forgot I was connected with a VPN. I SSH'd into a server, saw a weird IP and freaked out. Then after 15 minutes of investigation, I realized duh I was just connected through a VPN in Europe. >bullshitting us on HN I'd be careful about this assumption. I have seen people bullshitting here. I won't go as far as outright denying that people haven't reused their passwords, but I am always a little skeptical of things like this (i.e. where people say one thing because they're embarrassed about being associated with the other). It has certainly heightened my senses. >I don't think we have a "smoking gun" or a site/service/extension that is common to everyone who reported this thing happening to them. As has been theorized elsewhere, it's very possible we're seeing early signs of the results of the log4j exploits. I'm in wait and watch mode to see if LP really is compromised. [0]: https://spycloud.com/password-reuse/ https://spycloud.com/password-reuse/ [1]: https://www.troyhunt.com/password-reuse-credential-stuffing-and-another-1-billion-records-in-have-i-been-pwned/#:~:text=Because%20of%20the%20prevalence%20with%20which%20people%20reuse%20their%20accounts%2C%20nobody%20who%20confirmed%20their%20password%20could%20actually%20tell%20me%20where%20it%20came%20from!%20Could%20have%20been%20anywhere.%20Who%20knows%2C%20it%27s%20%22their%20standard%20password%22 https://www.troyhunt.com/password-reuse-credential-stuffing-.... [2]: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords A password from my late childhood to early teens shows up 150 times
- foxfluff 5y ago
  > You can check for a compromised password the same way you check if a password is valid, both without having stored the original password in plaintext. You have a list of known-compromised hashes and see if the hashed password is in that list. That would require them to store password hashes unsalted and using the same hash function & number of rounds as the online dumps of compromised hashes. If that's what's going on, then that would be good reason to immediately abandon said program. Password databases are supposed to encrypted, so without the master password they also won't see see the rest of the hashes in the db to see if they reused the master password. So no, they won't know which passwords are compromised unless there are some absolute design disasters going on. > None based on my experience with the service. Each time you login from an unrecognized device or IP, you receive an email and have to confirm the login. Ok, that is good to hear. Still, they shouldn't have any way to really know which passwords are compromised. I guess they could have blanket-rejected all logins from unknown IPs and make the claim above (putting some PR spin on it). That'd be quite meh. > No. And they probably won't ever be able to. And probably neither will anyone else. Then they should not make a statement saying so, because it is bullshit until proven otherwise. If they don't know how these passwords got compromised, they should say as much. But they've determined: "LastPass investigated recent reports of blocked login attempts and determined the activity is related to fairly common bot-related activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained from third-party breaches related to other unaffiliated services." If that isn't bollocks, then I'm really curious how they determined anything. And if they actually didn't determine anything, then I really don't think they should post a statement like this. > Well I can imagine a few things going on. Like that 60% reuse number in > duh I was just connected through a VPN in Europe. > I have seen people bullshitting here. All plausible theories. If it were one or two people, I'd consider "user error" a very likely explanation for this (it wouldn't be the first time someone freaks out and it turns out to be nothing). But right now, 20+ different people on HN? To be fair, many of these are green (that's a bit suspicious but I'd totally understand wanting to protect identity when admitting your passwords may have been breached) but we also have quite a few old users. I just have a really hard time believing such a number of pebcaks all of a sudden come in swarms and lie on HN about using a random password that was written down and never used anywhere else (or such). That would be unprecedented here. One or two, again I'd consider it, but this is too many for me. I think if people here reused their passwords, got it compromised, and were embarrassed about it, they probably wouldn't announce it at all or at least they wouldn't fabricate a lie. As much as I think there are dumb and embarrassed people out there, I just don't buy that everyone here is lying. Also, reusing any random password is not at all the same as reusing your master password. I'm sure someone will reuse that too but it's quite different level. I reuse plenty of passwords for irritating services that mandate a login but which I don't care much for. I'd assume the frequency of reuse among technical users would be far less than 60%. > As has been theorized elsewhere, it's very possible we're seeing early signs of the results of the log4j exploits. That sounds again plausible, except for the cases of people who got theirs compromised even though they haven't used it in years. Who do you exploit to get the master password that was last typed in 2017? Long running malware (including malicious extensions) on the users' PCs is also plausible but again I'd be a bit disappointed to learn that it's been going on for years and nobody noticed until now? I'm also not betting on any one theory. I really hope we do get to the bottom of this though.

srcreigh 5y ago

dqv 5y ago

I'm not here to defend LastPass, but there are some rational answers to the questions you're asking, a lot of them having to do with human psychology. First thing's first, and yes I am "victim blaming" when I say this: 60% of users reuse their passwords. [0,1] It's a widespread problem. Maybe that number is lower for a technical site like HN, but I have encountered technical people who do not practice what they preach. >how the heck would they know which passwords are compromised, if it wasn't a compromise on their end? You can check for a compromised password the same way you check if a password is valid, both without having stored the original password in plaintext. You have a list of known-compromised hashes and see if the hashed password is in that list. [2] >For everyone whose account was protected by blocking access from odd region, how many are there whose accounts were quietly accessed and no email was shot off to warn the owner? None based on my experience with the service. Each time you login from an unrecognized device or IP, you receive an email and have to confirm the login. It's good hygiene to check the access logs, although I've been dirty in that regard. >They are claiming that the master password was used on some other (compromised) service, but they provide zero evidence for this. And if they don't know your passwords, how on earth do they know that you've reused them on a compromised service? Can they name that service? No. And they probably won't ever be able to. And probably neither will anyone else. See [2]. >That is true, but there are so many reports now that it's really hard for me to believe they were all dumb enough to reuse their master passwords elsewhere and are also bullshitting us on HN. Well I can imagine a few things going on. Like that 60% reuse number in [0], there are probably a lot of people who did reuse their master password. I'd be embarrassed myself to admit I reused a password and it got compromised (correction: I have reused passwords and have been compromised, luckily not in a damaging way). You're kind of exemplifying that point by calling someone who would do that "dumb enough". The other group of people who really didn't reuse their passwords may have done something I did a few weeks ago - forgot I was connected with a VPN. I SSH'd into a server, saw a weird IP and freaked out. Then after 15 minutes of investigation, I realized duh I was just connected through a VPN in Europe. >bullshitting us on HN I'd be careful about this assumption. I have seen people bullshitting here. I won't go as far as outright denying that people haven't reused their passwords, but I am always a little skeptical of things like this (i.e. where people say one thing because they're embarrassed about being associated with the other). It has certainly heightened my senses. >I don't think we have a "smoking gun" or a site/service/extension that is common to everyone who reported this thing happening to them. As has been theorized elsewhere, it's very possible we're seeing early signs of the results of the log4j exploits. I'm in wait and watch mode to see if LP really is compromised. [0]: https://spycloud.com/password-reuse/ https://spycloud.com/password-reuse/ [1]: https://www.troyhunt.com/password-reuse-credential-stuffing-and-another-1-billion-records-in-have-i-been-pwned/#:~:text=Because%20of%20the%20prevalence%20with%20which%20people%20reuse%20their%20accounts%2C%20nobody%20who%20confirmed%20their%20password%20could%20actually%20tell%20me%20where%20it%20came%20from!%20Could%20have%20been%20anywhere.%20Who%20knows%2C%20it%27s%20%22their%20standard%20password%22 https://www.troyhunt.com/password-reuse-credential-stuffing-.... [2]: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords A password from my late childhood to early teens shows up 150 times

foxfluff 5y ago
> You can check for a compromised password the same way you check if a password is valid, both without having stored the original password in plaintext. You have a list of known-compromised hashes and see if the hashed password is in that list. That would require them to store password hashes unsalted and using the same hash function & number of rounds as the online dumps of compromised hashes. If that's what's going on, then that would be good reason to immediately abandon said program. Password databases are supposed to encrypted, so without the master password they also won't see see the rest of the hashes in the db to see if they reused the master password. So no, they won't know which passwords are compromised unless there are some absolute design disasters going on. > None based on my experience with the service. Each time you login from an unrecognized device or IP, you receive an email and have to confirm the login. Ok, that is good to hear. Still, they shouldn't have any way to really know which passwords are compromised. I guess they could have blanket-rejected all logins from unknown IPs and make the claim above (putting some PR spin on it). That'd be quite meh. > No. And they probably won't ever be able to. And probably neither will anyone else. Then they should not make a statement saying so, because it is bullshit until proven otherwise. If they don't know how these passwords got compromised, they should say as much. But they've determined: "LastPass investigated recent reports of blocked login attempts and determined the activity is related to fairly common bot-related activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained from third-party breaches related to other unaffiliated services." If that isn't bollocks, then I'm really curious how they determined anything. And if they actually didn't determine anything, then I really don't think they should post a statement like this. > Well I can imagine a few things going on. Like that 60% reuse number in > duh I was just connected through a VPN in Europe. > I have seen people bullshitting here. All plausible theories. If it were one or two people, I'd consider "user error" a very likely explanation for this (it wouldn't be the first time someone freaks out and it turns out to be nothing). But right now, 20+ different people on HN? To be fair, many of these are green (that's a bit suspicious but I'd totally understand wanting to protect identity when admitting your passwords may have been breached) but we also have quite a few old users. I just have a really hard time believing such a number of pebcaks all of a sudden come in swarms and lie on HN about using a random password that was written down and never used anywhere else (or such). That would be unprecedented here. One or two, again I'd consider it, but this is too many for me. I think if people here reused their passwords, got it compromised, and were embarrassed about it, they probably wouldn't announce it at all or at least they wouldn't fabricate a lie. As much as I think there are dumb and embarrassed people out there, I just don't buy that everyone here is lying. Also, reusing any random password is not at all the same as reusing your master password. I'm sure someone will reuse that too but it's quite different level. I reuse plenty of passwords for irritating services that mandate a login but which I don't care much for. I'd assume the frequency of reuse among technical users would be far less than 60%. > As has been theorized elsewhere, it's very possible we're seeing early signs of the results of the log4j exploits. That sounds again plausible, except for the cases of people who got theirs compromised even though they haven't used it in years. Who do you exploit to get the master password that was last typed in 2017? Long running malware (including malicious extensions) on the users' PCs is also plausible but again I'd be a bit disappointed to learn that it's been going on for years and nobody noticed until now? I'm also not betting on any one theory. I really hope we do get to the bottom of this though.