4 ms·

Posts like this are so frustrating. It's a whole lot of words to say nothing. There's a small mention of the alerts being triggered by a bug/error, but it is su

by kup0 5y ago

Posts like this are so frustrating. It's a whole lot of words to say nothing. There's a small mention of the alerts being triggered by a bug/error, but it is surrounded hundreds of words of deflection/spin. Additionally, it is bothersome that absolutely zero detail on this error is given. Given the incredible gravity of the situation (potential of having one's entire password vault compromised), I expect a better response than this

tryptophan 5y ago
Not communicating clearly and pretending like dumb blog posts like this are an answer are both major red flags. I don't understand the thought process behind such legal-ese talk. Do they think we are dumb and can't see through it? Putting this sort of stuff up is just saying "we don't care about you in reality but here is a post saying we do".
- kup0 5y ago
  I think one thing that really got to me is that the post is by the VP of Engineering, which for some reason gave me an expectation of a detailed explanation of the problem, only to find none The post sounds like it was actually written by either legal or marketing instead
  - redis_mlc 5y ago
  - thrwaway9871 5y ago
    So much this. Don't use any online password managers but with this response lastpass became godaddy for passwords in my book.
  - nescioquid 5y ago
    And when the VP of Engineering writes > some of these security alerts...were likely triggered in error one can conclude that they do not know that any of the alerts were triggered in error (else he would have said as much). Some of the VP's statements were likely triggered by the legal department, though I don't know that any actually were. It doesn't exactly shed light on anything.
    - LevGoldstein 5y ago
      Or more likely, there were probably some legitimate alerts that would have gone out at the same time as per normal operations, and they do not want to conflate these with the ones sent in error.
      - deleted 5y ago
        [deleted]
      - nescioquid 5y ago
        None, some, all; always, sometimes, never. > some of these security alerts...were likely triggered in error Our VP made no statement about the totality. Draw what conclusions you may from the equivocal register of this public-relations statement, but he is relegating his statement to those alerts which, by his own words, he cannot say to a certainty whether or not they were triggered in error. I presume that this statement is calculated to exclude all those alerts that they can know were legitimate. If you want to expand the scope of the statement, then the only implication would be that they cannot discern the legitimate from the illegitimate alerts. The only purpose of my comment was to draw attention to the apparent equivocation, that is, the art of misleading without lying. If they can't tell right from wrong (alerts), so much the more damning.
  - klyrs 5y ago
    If I were to guess, anything written by the VP of Engineering would be heavily edited by legal and marketing until the result was indistinguishable. Source: I work for a company that doesn't let anything go out without approval of Legal, Marketing, and a few other nebulous 'stakeholders'
  - peakaboo 5y ago
    Some (bad) companies have a VP of Engineering that has no clue about technology and with a background in another field. But come on, Lastpass has been on a downwards slope for a very long time. They can't even make their main product as good as Bitwarden which is free.
unixbane 5y ago
never used them but just went to their website and concluded it's some novice programmer who has no skill and wants to make a business around software so after going through a few ideas he came up with a password manager. no idea why people (on HN) use these things.
- kup0 5y ago
  They're a relatively well-known company, currently owned by LogMeIn, though that seems like it will be changing. It's definitely not some solo person's side project or anything. They're one of the most well-known names (whether good or bad) in the password manager category. While they have had security trouble in the past- they're big enough that it's not surprising at all to me that many people, including those on HN, are their customers. I would also not be surprised if they lose a chunk of tech-savvy customers over this- as they should.
- stanski 5y ago
  Kind of a poor way to judge a product, I'd say. I'm no longer a lastpass user but if you read up on them you'll find that your initial assessment is way off. They've had their issues but the idea of it being built by a novice programmer is very far from reality.
  - unixbane 5y ago
    I use a trivial program that manages a list of passwords generated using /dev/urandom constrained to simple ascii chars and provides basic features like copying it to clipboard to avoid shoulder surfing. It took an hour to write 10 years ago. and judging software from how bullshit their website front page is has not failed me a single time in the last 20 years. my predictions of what vulns they have is always spot on. im not interested in your (HN's) definition of reality as they still think string injection attacks are fundamentally hard to solve
feldrim 5y ago
This may very well be a good example of strategic ambiguity. They grant themselves a broad area for future, not a limiting direction. Since nothing is presented precisely, the following reports, articles, announcements can be shaped the way the environment requires. With this, they say nothing more than "it was not a cyber attack". It is a statement of relief for shareholders. It's not about the customers.
stingraycharles 5y ago
Assuming for a moment that what they claim is true (never attribute to malice that what can be explained by incompetence), that it is indeed a bug / password reuse, what information would you have liked them to give? It seems to me that they’re communicating they’re not hacked, looked into the issue and found nothing special. I do agree that they’re patting themselves on the back a bit too much and also should have been a bit more humble when dismissing things as password reuse.
- kup0 5y ago
  In general, when tech-related companies have problems like this (with potentially severe consequences), I think a post-mortem should be a minimum expectation. I just feel like the way this post frames the issue is almost like it doesn't matter that much to them. "Oops, it was just a bug, for some accounts, we think. All fixed!" just doesn't sit well with me (maybe that's a me problem...) I would want some follow-up answers, to questions like: - Why would a bug trigger alerts that are as severe as "someone else tried to use your unique not-used-elsewhere master password"? I understand bugs, even severe ones, happen- but can I trust that your alerts aren't going to cry wolf on my account going forward? - Why did you originally conclude it was credential stuffing/reuse, when there are a number of people that got the alert that clearly stated they had never used their master password anywhere else? Are you monitoring user reports / social platforms / etc to respond to and address these situations? - When you say "some" were triggered in error- does this mean some of the attempts were legitimate, or were they all due to a bug? Do you even know the answer to this question? If there are legitimate attempts on non-reused-password accounts, it appears master passwords are leaking/being captured/etc in some other way and that deserves further investigation I just want more than a sentence or two surrounded by 10+ paragraphs of "this happened because of how good we are at keeping you safe"

by kup0 5y ago

tryptophan 5y ago

Not communicating clearly and pretending like dumb blog posts like this are an answer are both major red flags. I don't understand the thought process behind such legal-ese talk. Do they think we are dumb and can't see through it? Putting this sort of stuff up is just saying "we don't care about you in reality but here is a post saying we do".

kup0 5y ago
I think one thing that really got to me is that the post is by the VP of Engineering, which for some reason gave me an expectation of a detailed explanation of the problem, only to find none The post sounds like it was actually written by either legal or marketing instead
- redis_mlc 5y ago
- thrwaway9871 5y ago
  So much this. Don't use any online password managers but with this response lastpass became godaddy for passwords in my book.
- nescioquid 5y ago
  And when the VP of Engineering writes > some of these security alerts...were likely triggered in error one can conclude that they do not know that any of the alerts were triggered in error (else he would have said as much). Some of the VP's statements were likely triggered by the legal department, though I don't know that any actually were. It doesn't exactly shed light on anything.
  - LevGoldstein 5y ago
    Or more likely, there were probably some legitimate alerts that would have gone out at the same time as per normal operations, and they do not want to conflate these with the ones sent in error.
    - deleted 5y ago
      [deleted]
    - nescioquid 5y ago
      None, some, all; always, sometimes, never. > some of these security alerts...were likely triggered in error Our VP made no statement about the totality. Draw what conclusions you may from the equivocal register of this public-relations statement, but he is relegating his statement to those alerts which, by his own words, he cannot say to a certainty whether or not they were triggered in error. I presume that this statement is calculated to exclude all those alerts that they can know were legitimate. If you want to expand the scope of the statement, then the only implication would be that they cannot discern the legitimate from the illegitimate alerts. The only purpose of my comment was to draw attention to the apparent equivocation, that is, the art of misleading without lying. If they can't tell right from wrong (alerts), so much the more damning.
- klyrs 5y ago
  If I were to guess, anything written by the VP of Engineering would be heavily edited by legal and marketing until the result was indistinguishable. Source: I work for a company that doesn't let anything go out without approval of Legal, Marketing, and a few other nebulous 'stakeholders'
- peakaboo 5y ago
  Some (bad) companies have a VP of Engineering that has no clue about technology and with a background in another field. But come on, Lastpass has been on a downwards slope for a very long time. They can't even make their main product as good as Bitwarden which is free.

unixbane 5y ago

never used them but just went to their website and concluded it's some novice programmer who has no skill and wants to make a business around software so after going through a few ideas he came up with a password manager. no idea why people (on HN) use these things.

kup0 5y ago
They're a relatively well-known company, currently owned by LogMeIn, though that seems like it will be changing. It's definitely not some solo person's side project or anything. They're one of the most well-known names (whether good or bad) in the password manager category. While they have had security trouble in the past- they're big enough that it's not surprising at all to me that many people, including those on HN, are their customers. I would also not be surprised if they lose a chunk of tech-savvy customers over this- as they should.
stanski 5y ago
Kind of a poor way to judge a product, I'd say. I'm no longer a lastpass user but if you read up on them you'll find that your initial assessment is way off. They've had their issues but the idea of it being built by a novice programmer is very far from reality.
- unixbane 5y ago
  I use a trivial program that manages a list of passwords generated using /dev/urandom constrained to simple ascii chars and provides basic features like copying it to clipboard to avoid shoulder surfing. It took an hour to write 10 years ago. and judging software from how bullshit their website front page is has not failed me a single time in the last 20 years. my predictions of what vulns they have is always spot on. im not interested in your (HN's) definition of reality as they still think string injection attacks are fundamentally hard to solve

feldrim 5y ago

This may very well be a good example of strategic ambiguity. They grant themselves a broad area for future, not a limiting direction. Since nothing is presented precisely, the following reports, articles, announcements can be shaped the way the environment requires. With this, they say nothing more than "it was not a cyber attack". It is a statement of relief for shareholders. It's not about the customers.

stingraycharles 5y ago

Assuming for a moment that what they claim is true (never attribute to malice that what can be explained by incompetence), that it is indeed a bug / password reuse, what information would you have liked them to give? It seems to me that they’re communicating they’re not hacked, looked into the issue and found nothing special. I do agree that they’re patting themselves on the back a bit too much and also should have been a bit more humble when dismissing things as password reuse.

kup0 5y ago
In general, when tech-related companies have problems like this (with potentially severe consequences), I think a post-mortem should be a minimum expectation. I just feel like the way this post frames the issue is almost like it doesn't matter that much to them. "Oops, it was just a bug, for some accounts, we think. All fixed!" just doesn't sit well with me (maybe that's a me problem...) I would want some follow-up answers, to questions like: - Why would a bug trigger alerts that are as severe as "someone else tried to use your unique not-used-elsewhere master password"? I understand bugs, even severe ones, happen- but can I trust that your alerts aren't going to cry wolf on my account going forward? - Why did you originally conclude it was credential stuffing/reuse, when there are a number of people that got the alert that clearly stated they had never used their master password anywhere else? Are you monitoring user reports / social platforms / etc to respond to and address these situations? - When you say "some" were triggered in error- does this mean some of the attempts were legitimate, or were they all due to a bug? Do you even know the answer to this question? If there are legitimate attempts on non-reused-password accounts, it appears master passwords are leaking/being captured/etc in some other way and that deserves further investigation I just want more than a sentence or two surrounded by 10+ paragraphs of "this happened because of how good we are at keeping you safe"