4 ms·
> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. https://blog.lastpass.com/2022/11/notice-of-recent-security-i
by next_xibalba 4y ago
> Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture.
https://blog.lastpass.com/2022/11/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/11/notice-of-recent-security-...
- foobiekr 4y agoZero knowledge, 100% authority on downloaded JavaScript.
- Zamicol 4y agoI wish there was a bigger push for integrity checking in the browser. It would be foundational to any solution that fixes that problem. There is already integrity checking for subresources: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... Newcastle University had a proposal for website wide integrity checking: https://github.com/toreini/DOMtegrity https://github.com/toreini/DOMtegrity Note that only 7 people have starred it on Github.
- roywiggins 4y agoI don't think either of those help if the website itself is pwned? SRI is fine if your website is secure but the CDN is pwned, the other one seems to be a defense a website can use against a malicious extension, but the risk with LastPass is if the LastPass website is pwned it can just read your password. You'd need some way to transfer essentially signed app bundles to the browser for the browser to verify, which seems like a different sort of project.
- bigDinosaur 4y agoI assume ultimately something like signed releases will become a thing on the web, with the signing process being separate from the other processes so that a hack has to compromise two entirely different systems, not just the build pipeline, to allow new JS to run. Currently the only thing that is signed is the SSL certificate which of course guarantees precisely nothing about the actual website content served from the server other than that someone didn't tamper with it after it was sent.
- adgjlsfhk1 4y agoWho hosts the signature? If you've hacked someones server enough to push out new JS what's to stop you from signing it?
- lxgr 4y agoHow would you approve updates to any site content in this model? Have users approve every time any embedded JavaScript hash changes?
- reiderrider 4y agoDoes this mean usernames and notes are not encrypted in the same way?
- cwkoss 4y agoUntil a user logs in and the passwords are decrypted using client software that could be compromised
- ghosts_ 4y agoI think this gives people a false sense of security, yes zero knowledge is extremely useful + cool, and certainly reduces the risk in event of a breach, but all it really means is that _all_ of your passwords are behind some encrypted blob in the open, that would be extremely difficult to decrypt. Not impossible. Certainly any average or even very high-end machine today would have a pretty much 0 percent chance at decrypting the data, it's still out there in the open forever. Imagine in 10 years we have some leaps in quantum computing or discover a flaw in the algorithms use, all a hacker would need to do is go back & decrypt the data to try some credential stuffing attack, etc. TL;DR is short-term I wouldn't be freaking out of my password manager was hacked, but I would still definitely update all credentials at some point & treat it as an actual breach, and not an "oh no we were hacked but it's okay because zero-knowledge!". Also how many times have they been hacked now? Who's still using last pass?
- ThunderSizzle 4y agoMy wife's password for Instagram was hacked near September, which was stored there. They lost user data and passwords and are lieing.