11 ms·

LastPass breach is worse than you think because URLs were unencrypted

70 points by scarygliders 4y ago

2Gkashmiri 4y ago
i have been a hardened user of keepass and it is strange to find people who "HATE" the idea of keepass over anything online, bitwarden or lastpass or 1password or whatever BS "zero knowledge backup" or other nonsense. you dont need to have LIVE SYNCING for your passwords. i have a keepass on my laptop and its copy on my phone. if occasionally i have to update anything, i do that and copy the file to the other place. say i update on the phone so next time i just share the file to the laptop and i am synced. this "janky" method has worked for over 5-7 years now without any problems so i dont understand why anyone wants to "keep live sync" enabled for such things and have to pay someone for the privilege and then have to wait for them to get hacked. nonsense
- h2rra 4y ago
  I keep the file in dropbox so it syncs to all the devices.
  - 2Gkashmiri 4y ago
    good for you. are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? probably but that would mean keepass has been broken, something that hasnt been the case so whats the problem?
    - Ekaros 4y ago
      And if that was the case wouldn't same risk profile apply to something hacking the file from your device?
      - 2Gkashmiri 4y ago
        sure. where do you draw the line? mind- your own mind/post-it notes- you forget and you loose notes offline- keepass- works. is safe. has not been broken online- whatever SAAS- works but only pinky promise of being unhackable- can leak from beyond your own control. your keepass could be hacked but they would require access to your device. you have control over that. you do not have control over lastpass servers
        hackernewds 4y ago
        best to use what is the most secure. your own brain?
      - CyanBird 4y ago
        Dropbox famously worked with the NSA sharing both encrypted user data as well as decrypted user data... I would not use them for anything sensitive ever.... But you do you I guess
    - TMWNN 4y ago
      >are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? I keep a copy of my password file in Dropbox, as one of several backups. (The file, to begin with, is GPG-encrypted.)
- Starz0r 4y ago
  Glad that method works out for you. Fortunately for the rest of the world, technology has progressed far enough that Password Storage is a solved problem. I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. Some people would rather entrust a reputable service to handle the very menial task of managing their passwords for them, rather than go through the hassle of doing it themselves. Not only do these services provide better convenience, they make you more secure! Many people reuse the same password, so when a site gets "owned", any site using that same password is now compromised as well. Some of these services will even automatically tell you when a site gets "owned" and offer to change that password for you retroactively. Now, if you want to go ahead and use a local only method, be my guest. But please, don't ever suggest to anyone else that they should do the same, that's just bad security advice! By the way, getting hacked in the password manager does not mean all your passwords leaked. It just means some extra metadata about you may get discovered, which I'd argue is a reasonable trade-off.
  - 2Gkashmiri 4y ago
    >I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. this should be taught in schools if that is your concern. what i am doing with the "manual sync" for files is because i have 2 machines i want to get my passwords. there is a HUGE population who only have a phone. for them, keepassdroid or some other keepass app is the only thing that they should ever need or use. i know because i have set up the files for my family members, they only have their phones at hand and the file has served them well for years without any problem. now they "whatsapp or email" the file to themselves or to me if they have to change their phone and get it back in a matter of minutes. this is not as big of a deal that you need to have online tied system and be a techie otherwise
    - eternityforest 4y ago
      If I only had a phone, I would definitely want live sync, so I had a chance of recovery if my phone was gone. Keepass isn't even something I'd consider. I'm not sure what you're referring to that should be taught in schools. The problem of forgetting things is often "human error" not "pilot error", a random packet loss of the mind rather than lack of skill. There's strategies to mitigate it, like always leaving the house with the same set of items and never changing it up, and avoiding situations where you rely on memory, but live sync is going to prevent a lot of mistakes.
- c22 4y ago
  I keep my passwords in my head. This has worked for over 30 years.
  - c22 4y ago
    I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game? My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc. Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?
    - camgunz 4y ago
      As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons: - people forget - you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords - this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because: - you don't store passwords - you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password) - your users can't forget their passwords - it's pretty much just as secure as your email, which is probably gmail, which is fine I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.
- fragmede 4y ago
  Why don't I want live syncing between my phone and my laptop? I use my phone quite a lot despite my laptop being within an arm length or two. Having new passwords accessible between them seems like an obviously useful thing.
psychphysic 4y ago
I use moolipass with a couple passwords on yubikey I carry with me. Feels very robust and I get to be in control of my own data and passwords.
out-of-ideas 4y ago
page is dead; im surprised folks are still posting on and hot-linking to twitter. got any got a mastadon alt-link?
- scarygliders 4y ago
  Weird. New URL is at : https://twitter.com/jsrailton/status/1606195077939744768 https://twitter.com/jsrailton/status/1606195077939744768 apparently, and it worked for me just now.
  - out-of-ideas 4y ago
    maybe the ghostintheshell did not like the end number being 69
    - jonas-w 4y ago
      Whats even better is that at the time i'm writing this the hn post hast 69 votes.
scarygliders 4y ago
https://twitter.com/jsrailton/status/1606195077939744768 https://twitter.com/jsrailton/status/1606195077939744768 seems to be the new working URL.
gillesjacobs 4y ago
This is unbelievably bad. The "threat actor" (and anyone else the info is shared with on the hacker forums) now has copies of: - Customer Names - Company Names - Email Address - Billing Address - Telephone Numbers - IP addresses (from where customers accessed the service) - Website URLs saved in LastPass vaults (LastPass doesn't encrypt the website URLs) - Encrypted vaults That is a massive privacy violation and a puts every customer at risk for massive automated phishing, blackmail, and doxing. They marketed the whole vault as being encrypted in their Zero Knowledge architecture(TM). And LastPass probably knew since AUGUST and tells us the day before Christmas. Note to obfuscating, dense language in the blog notice. Specifically "unencrypted fields such as website URLs", implying other vault fields could have been unencrypted but they can't/won't say. LastPass will not survive the pending customer exodus and class action lawsuits. Seems like instead of spending Christmas with my family, I will spend it changing passwords for 100s of accounts.
- nix23 4y ago
  [flagged]
  - gillesjacobs 4y ago
    Thanks, smartass. This wouldn't have been a problem to this degree if their product matched up to their promise and the whole vault was actually encrypted. I willingly accepted the dox risk of personal identifiable data because they were transparent they maintained this and hence this would leak. I would never have used their service if I knew website URLs were unencrypted.
    - nix23 4y ago
      Don't trust people you don't know with your secrets...why do you even think they encrypt anything (trust?), in the real world you would never be that ignorant right?
      - gillesjacobs 4y ago
        Of course, lesson learned, I chose convenience over common sense. Self-hosted, encrypted passwords it is from now on. LastPass is luckily(?) the only counterparty I ever trusted to this degree except for maybe my banks. (Great, after I fix this password mess, I will have to start looking into trustless banking)
jb1991 4y ago
I wonder if these risks are also with a service like 1Password. How can you know if they are in fact, actually encrypting every single detail associated with the login? It’s not like we can view the servers ourselves.
- bb101 4y ago
  1Password also uses a secret key in addition to your master password to encrypt your data. You enter the secret key when setting up the account on a new device. So a hacker would have to get hold of the encrypted data, together with the secret key for each account. The secret key isn't stored by 1Password, requiring the hacker to brute force it. However, each key provides 128 bits of entropy, which makes it infeasible to brute force with current technology. More info: https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
  - jb1991 4y ago
    But the issue in this thread is less about how the encryption is done compared to the amount of data that is actually encrypted. I wonder if 1Password encrypts everything, in addition to passwords.
    - TechBro8615 4y ago
      My understanding is that they do, but there are some caveats. For example the feature that tells you if 2fa is available for a website presumably requires sending an HTTP request to 1Password servers including the domain of the website. Although it's possible they implement this with a local bloom filter or something. I'm just speculating. And either way, those requests would only end up stored in some server logs somewhere, rather than in a database row directly linked to your vault. EDIT: It is in fact done locally. :) see: https://support.1password.com/watchtower-privacy/ https://support.1password.com/watchtower-privacy/
- saltminer 4y ago
  BitWarden and other self-hostable open source solutions do allow you to verify everything is encrypted, though you have to self-host to truly verify it (since it's always possible the official hosting service runs different software)
tonymet 4y ago
Does this affect customers who deleted their account before the breach ? I can't find info on LastPass
- thiht 4y ago
  I have the same question. I migrated away from LastPass 2 years ago and wonder if I’m still breached
- Bud 4y ago
  After they've already been shown to have been dishonest previously, and after they chose to make an additional disclosure on the last working day (for most) before Christmas, I think you have to assume your data is at risk, and act accordingly. I certainly would. Do you trust them to tell the truth about whether all your data was reliably, securely, and permanently deleted? Can they tell you when and how?
  - tonymet 4y ago
    You’re right I’m assuming my account was breached and I’m resetting my passwords.I already started noticing hack attempts (e.g. reset password attempts) this week, so that indicates it’s likely to have been breached. I used lastpass reluctantly, knowing the risk but also knowing it was better than re-using passwords. What a fun way to spend christmas holiday resetting passwords
piyh 4y ago
So glad I migrated to bitwarden when they tried to make you choose between mobile or desktop use. Bitwarden is still vulnerable to hacks, but I guess it's a bit like saying all banks have issues, but we can all agree Wells Fargo (lastpass) sucks.
- havelhovel 4y ago
  Same boat as you. Now we just have to hope LastPass deleted our information when we asked them to.

70 points by scarygliders 4y ago

i have been a hardened user of keepass and it is strange to find people who "HATE" the idea of keepass over anything online, bitwarden or lastpass or 1password or whatever BS "zero knowledge backup" or other nonsense. you dont need to have LIVE SYNCING for your passwords. i have a keepass on my laptop and its copy on my phone. if occasionally i have to update anything, i do that and copy the file to the other place. say i update on the phone so next time i just share the file to the laptop and i am synced. this "janky" method has worked for over 5-7 years now without any problems so i dont understand why anyone wants to "keep live sync" enabled for such things and have to pay someone for the privilege and then have to wait for them to get hacked. nonsense

h2rra 4y ago
I keep the file in dropbox so it syncs to all the devices.
- 2Gkashmiri 4y ago
  good for you. are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? probably but that would mean keepass has been broken, something that hasnt been the case so whats the problem?
  - Ekaros 4y ago
    And if that was the case wouldn't same risk profile apply to something hacking the file from your device?
    - 2Gkashmiri 4y ago
      sure. where do you draw the line? mind- your own mind/post-it notes- you forget and you loose notes offline- keepass- works. is safe. has not been broken online- whatever SAAS- works but only pinky promise of being unhackable- can leak from beyond your own control. your keepass could be hacked but they would require access to your device. you have control over that. you do not have control over lastpass servers
      - hackernewds 4y ago
        best to use what is the most secure. your own brain?
    - CyanBird 4y ago
      Dropbox famously worked with the NSA sharing both encrypted user data as well as decrypted user data... I would not use them for anything sensitive ever.... But you do you I guess
  - TMWNN 4y ago
    >are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? I keep a copy of my password file in Dropbox, as one of several backups. (The file, to begin with, is GPG-encrypted.)
Starz0r 4y ago
Glad that method works out for you. Fortunately for the rest of the world, technology has progressed far enough that Password Storage is a solved problem. I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. Some people would rather entrust a reputable service to handle the very menial task of managing their passwords for them, rather than go through the hassle of doing it themselves. Not only do these services provide better convenience, they make you more secure! Many people reuse the same password, so when a site gets "owned", any site using that same password is now compromised as well. Some of these services will even automatically tell you when a site gets "owned" and offer to change that password for you retroactively. Now, if you want to go ahead and use a local only method, be my guest. But please, don't ever suggest to anyone else that they should do the same, that's just bad security advice! By the way, getting hacked in the password manager does not mean all your passwords leaked. It just means some extra metadata about you may get discovered, which I'd argue is a reasonable trade-off.
- 2Gkashmiri 4y ago
  >I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. this should be taught in schools if that is your concern. what i am doing with the "manual sync" for files is because i have 2 machines i want to get my passwords. there is a HUGE population who only have a phone. for them, keepassdroid or some other keepass app is the only thing that they should ever need or use. i know because i have set up the files for my family members, they only have their phones at hand and the file has served them well for years without any problem. now they "whatsapp or email" the file to themselves or to me if they have to change their phone and get it back in a matter of minutes. this is not as big of a deal that you need to have online tied system and be a techie otherwise
  - eternityforest 4y ago
    If I only had a phone, I would definitely want live sync, so I had a chance of recovery if my phone was gone. Keepass isn't even something I'd consider. I'm not sure what you're referring to that should be taught in schools. The problem of forgetting things is often "human error" not "pilot error", a random packet loss of the mind rather than lack of skill. There's strategies to mitigate it, like always leaving the house with the same set of items and never changing it up, and avoiding situations where you rely on memory, but live sync is going to prevent a lot of mistakes.
c22 4y ago
I keep my passwords in my head. This has worked for over 30 years.
- c22 4y ago
  I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game? My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc. Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?
  - camgunz 4y ago
    As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons: - people forget - you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords - this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because: - you don't store passwords - you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password) - your users can't forget their passwords - it's pretty much just as secure as your email, which is probably gmail, which is fine I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.
fragmede 4y ago
Why don't I want live syncing between my phone and my laptop? I use my phone quite a lot despite my laptop being within an arm length or two. Having new passwords accessible between them seems like an obviously useful thing.

psychphysic 4y ago

I use moolipass with a couple passwords on yubikey I carry with me. Feels very robust and I get to be in control of my own data and passwords.

out-of-ideas 4y ago

page is dead; im surprised folks are still posting on and hot-linking to twitter. got any got a mastadon alt-link?

scarygliders 4y ago
Weird. New URL is at : https://twitter.com/jsrailton/status/1606195077939744768 https://twitter.com/jsrailton/status/1606195077939744768 apparently, and it worked for me just now.
- out-of-ideas 4y ago
  maybe the ghostintheshell did not like the end number being 69
  - jonas-w 4y ago
    Whats even better is that at the time i'm writing this the hn post hast 69 votes.

scarygliders 4y ago

https://twitter.com/jsrailton/status/1606195077939744768 https://twitter.com/jsrailton/status/1606195077939744768 seems to be the new working URL.

gillesjacobs 4y ago

This is unbelievably bad. The "threat actor" (and anyone else the info is shared with on the hacker forums) now has copies of: - Customer Names - Company Names - Email Address - Billing Address - Telephone Numbers - IP addresses (from where customers accessed the service) - Website URLs saved in LastPass vaults (LastPass doesn't encrypt the website URLs) - Encrypted vaults That is a massive privacy violation and a puts every customer at risk for massive automated phishing, blackmail, and doxing. They marketed the whole vault as being encrypted in their Zero Knowledge architecture(TM). And LastPass probably knew since AUGUST and tells us the day before Christmas. Note to obfuscating, dense language in the blog notice. Specifically "unencrypted fields such as website URLs", implying other vault fields could have been unencrypted but they can't/won't say. LastPass will not survive the pending customer exodus and class action lawsuits. Seems like instead of spending Christmas with my family, I will spend it changing passwords for 100s of accounts.

nix23 4y ago
[flagged]
- gillesjacobs 4y ago
  Thanks, smartass. This wouldn't have been a problem to this degree if their product matched up to their promise and the whole vault was actually encrypted. I willingly accepted the dox risk of personal identifiable data because they were transparent they maintained this and hence this would leak. I would never have used their service if I knew website URLs were unencrypted.
  - nix23 4y ago
    Don't trust people you don't know with your secrets...why do you even think they encrypt anything (trust?), in the real world you would never be that ignorant right?
    - gillesjacobs 4y ago
      Of course, lesson learned, I chose convenience over common sense. Self-hosted, encrypted passwords it is from now on. LastPass is luckily(?) the only counterparty I ever trusted to this degree except for maybe my banks. (Great, after I fix this password mess, I will have to start looking into trustless banking)

jb1991 4y ago

I wonder if these risks are also with a service like 1Password. How can you know if they are in fact, actually encrypting every single detail associated with the login? It’s not like we can view the servers ourselves.

bb101 4y ago
1Password also uses a secret key in addition to your master password to encrypt your data. You enter the secret key when setting up the account on a new device. So a hacker would have to get hold of the encrypted data, together with the secret key for each account. The secret key isn't stored by 1Password, requiring the hacker to brute force it. However, each key provides 128 bits of entropy, which makes it infeasible to brute force with current technology. More info: https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
- jb1991 4y ago
  But the issue in this thread is less about how the encryption is done compared to the amount of data that is actually encrypted. I wonder if 1Password encrypts everything, in addition to passwords.
  - TechBro8615 4y ago
    My understanding is that they do, but there are some caveats. For example the feature that tells you if 2fa is available for a website presumably requires sending an HTTP request to 1Password servers including the domain of the website. Although it's possible they implement this with a local bloom filter or something. I'm just speculating. And either way, those requests would only end up stored in some server logs somewhere, rather than in a database row directly linked to your vault. EDIT: It is in fact done locally. :) see: https://support.1password.com/watchtower-privacy/ https://support.1password.com/watchtower-privacy/
saltminer 4y ago
BitWarden and other self-hostable open source solutions do allow you to verify everything is encrypted, though you have to self-host to truly verify it (since it's always possible the official hosting service runs different software)

tonymet 4y ago

Does this affect customers who deleted their account before the breach ? I can't find info on LastPass

thiht 4y ago
I have the same question. I migrated away from LastPass 2 years ago and wonder if I’m still breached
Bud 4y ago
After they've already been shown to have been dishonest previously, and after they chose to make an additional disclosure on the last working day (for most) before Christmas, I think you have to assume your data is at risk, and act accordingly. I certainly would. Do you trust them to tell the truth about whether all your data was reliably, securely, and permanently deleted? Can they tell you when and how?
- tonymet 4y ago
  You’re right I’m assuming my account was breached and I’m resetting my passwords.I already started noticing hack attempts (e.g. reset password attempts) this week, so that indicates it’s likely to have been breached. I used lastpass reluctantly, knowing the risk but also knowing it was better than re-using passwords. What a fun way to spend christmas holiday resetting passwords

piyh 4y ago

So glad I migrated to bitwarden when they tried to make you choose between mobile or desktop use. Bitwarden is still vulnerable to hacks, but I guess it's a bit like saying all banks have issues, but we can all agree Wells Fargo (lastpass) sucks.

havelhovel 4y ago
Same boat as you. Now we just have to hope LastPass deleted our information when we asked them to.